This presentation is designed to raise the awareness towards modern threats and

show the security related challenges that arise during application development. It
consists of two parts. The first is more generic and gives an overview covering the
most common attack vectors, such as phishing. The second is mainly geared
towards Web Application Security, the type of applications we develop at JR
Technologies. It focuses both on the User Interface part as well as the backend and
the communication between them. It describes possible attacks, how to protect
against them and best coding practices to avoid vulnerabilities. A non-exhaustive
list of topics covered follows.

Simple Security Principles:

 Known vulnerabilities
 Phishing/Spear Phishing
 Malware attacks
 Weak authentication
 Secure password storage
 Importance of SSL/TLS (HTTPS)
 Basic terms (authentication, integrity…)
 Network vs Application security
 Secure Requirements

Web Application Security:

 SQL injection/Command Injection
 Authentication and session management. Session hijacking, session fixation,
cookie handling...
 Cross Site Scripting (XSS) Persistent, Reflected, DOM-Based
 Insecure Direct Object Reference
 Missing Function Level Access Control
 File Upload Filtering
 Cross Site Request Forgery (CSRF)
 Unvalidated Redirects and forwards
 Same Origin Policy (SOP)
 Cross Origin Resource Sharing (CORS)
 Clickjacking
 Content Security Policy (CSP)
 Javascript, AJAX, HTML 5, JSON related security
 XML Injection
 XML External Entity Attack (XXE)
 Symmetric-Key Cryptography
 Hash algorithms
 Message Authentication Code (MAC)
 Public-Key Cryptography
 Digital Signatures
 Man-in-the-Middle Attack (MITM)
 Public-Key Infrastructure, Digital Certificates (CRLs, OCSP…)
 SSL/TLS Protocols
 Pseudo Random Number Generators (PRNGs)
 Password management, password hashing algorithms
 Input Validation
 Path Traversal Vulnerability
 Java Best Practices