Practical Security: Simple Practices for Defending Your Systems

Description

In this course, you will learn :

• 5 simple, yet effective, techniques for keeping attackers out of your system.
• Patching, software vulnerabilities, cryptography, Windows security, and phishing are all examples of these techniques.
• The best practises for preventing vulnerabilities and making them more detectable.

Syllabus :

1. Patching

• Upgrading Third-Party Libraries and Software
• A Closer Look at Patching
• Library Inventory
• Dependency Management: Python
• Dependency Management: JavaScript
• Automating Vulnerability Detection
• Network Inventory
• Nmap
• OpenVAS
• Patching Windows
• Finding Published Vulnerabilities
• Testing Your Patches
• If Patching Hurts, Do It More Often

 

2. Vulnerabilities

• Introduction to SQL
• Challenge: Select The Journal
• Solution Review: Select The Journal
• More SQL Commands
• Challenge: Write a Generalized Query
• Solution Review: Write a Generalized Query
• How SQL Injection Works
• Extending the Defense Beyond Prepared Statements
• Additional Defenses as a Mitigation Against Future Mistakes
• Putting It All Together for a Robust Defense
• Introduction to Cross-Site Scripting (XSS)
• HTML Encoding
• Defenses against XSS
• Introduction to Cross-Site Request Forgery (XSRF)
• XSRF Prevention with SameSite
• Misconfiguration
• Default Passwords & Credentials
• Jenkins & Public-Facing Servers

 

3. Cryptography

• Don’t Roll Your Own Crypto
• Some Key Principles
• Security When the Enemy Knows the System
• Don’t Use Low-Level Crypto Libraries
• ECB Malleability
• CBC Is Still Malleable
• Evaluating Crypto Libraries Without Being a Crypto Expert
• Password Storage
• More Techniques for Password Storage
• Storing Passwords When You’re the Client
• Minimizing the Cost of Credential Loss
• Keeping Passwords Hard to Predict
• TLS Configuration

 

4. Windows

• Login and Mimikatz
• Password Policy
• Active Directory: What Else Is It Good For?
• BitLocker

 

5. Phishing

• Types of Phishing Attacks
• Social Defense
• DNS-Based Defense SPF
• DNS-Based Defense: DKIM
• DNS-Based Defense: DMARC

Show more