Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

LinkedIn Learning

Offline Application Security Testing Essential Training

via LinkedIn Learning

Overview

Embed security into the software development life cycle. Discover how to use offline security testing to validate your code and uncover vulnerabilities.

Building security testing into the software development life cycle is the best way to protect your app and your end users. This course identifies tools and techniques that developers can use to minimize the cost and impact of security testing—while maximizing its impact and effectiveness. In this course, instructor Jerod Brennen focuses on offline testing activities: preparing test plans, policies, and other documentation and conducting offline source code reviews. He also explains how to conduct offline testing for the OWASP Top Ten vulnerabilities. Along the way, you can become familiar with best practices around security in the SDLC. The hands-on sections—with demos of popular tools such as Codacy and SonarQube—prepare you to apply the lessons in the real world.

Syllabus

Introduction
  • The importance of offline testing
  • What you should know
1. Leading Practices
  • Security in the SDLC
  • Development methodologies
  • Programming languages
  • Security frameworks
  • Intro to the OWASP Top Ten
  • Other notable OWASP projects
  • Top 25 Software Errors
  • BSIMM
  • Building your test lab
  • Preparing your checklist
2. Security Documentation
  • Internal project plans
  • Communication planning
  • Change control policy
  • Security incident response policy
  • Logging and monitoring policy
  • Third-party agreements
  • OWASP ASVS
3. Source Code Security Reviews
  • Challenges of assessing source code
  • OWASP Code Review Project
  • Bytecode scanners
  • Binary code scanners
  • Code review models
  • Application threat modeling
  • Code review metrics
  • Demo: Codacy
  • Demo: SonarQube
4. Offline Testing for the OWASP Top Ten (2017)
  • The OWASP Top Ten
  • A1: Injection
  • A2: Broken authentication
  • A3: Sensitive data exposure
  • A4: XML external entities (XXE)
  • A5: Broken access control
  • A6: Security misconfiguration
  • A7: Cross-site scripting (XSS)
  • A8: Insecure deserialization
  • A9: Using components with known vulnerabilities
  • A10: Insufficient logging and monitoring
Conclusion
  • Next steps

Taught by

Jerod Brennen

Related Courses

Reviews

Start your review of Offline Application Security Testing Essential Training

Never Stop Learning!

Get personalized course recommendations, track subjects and courses with reminders, and more.

Sign up for free