SEC522: Application Security: Securing Web Applications, APIs, and Microservices

The course begins with web application fundamentals, including the HTTP protocol and architecture, which are essential for security. It then covers securing configurations in modern development, focusing on Infrastructure as Code. It also explores best practices for managing infrastructure, cloud, and web-server configurations to enhance security.

Section 2 focuses on defending against threats from external input, which modern applications receive from various sources, including browsers, web services, and non-web-standard systems. It covers common input-related attacks, real-world examples, and defense patterns.

Section 3 covers authentication and authorization in web apps, including exploits and mitigations. It explores passwordless and multifactor authentication, modern SSO solutions like OAuth, JWT, and OpenID Connect, and their challenges. The section concludes with encryption best practices for data in transit and storage.

This section begins with SOAP-based web services before shifting to JavaScript’s front-end security concerns, including CORS. It covers security risks, mitigation strategies, and best practices for AJAX applications. The section concludes with client-side defenses like Content Security Policy, exploring both benefits and limitations.

This section covers deserialization security, DNS rebinding, and security risks in REST and GraphQL APIs. It explores microservices architecture, common attacks, and best practices. The day concludes with a discussion on securely integrating AI components into modern applications.

This section introduces DevSecOps in enterprise web development. A hands-on lab reinforces course lessons, challenging students to identify real vs. false vulnerabilities and apply mitigations. Exercises cover securing the OS, web server, configurations, and fixing coding flaws.