Services

SOA/Web Service Security Course Syllabus

Module 1 - Day 1

  1. The real risk in SOA and Web Services, not just the hype
    1. SOA
    2. Web Services
    3. XML
  2. Risks
  3. Security Goals
  4. Defense in depth
  5. Service definition
  6. Service evolution
  7. SOA Web Services Basics
  8. SOA Web Services Patterns
    1. Service Registry
    2. Identity & Access Management
    3. Message Level Security
    4. Enterprise Service Bus
    5. Service Level Management
  9. Orchestration
  10. Web Services Risks
  11. The OWASP Top Ten in a Web Services world
  12. Security Metrics

Module 2 - Day 1

  1. Service Model
  2. WSDL
  3. SOAP Request/Response
  4. Modeling Risks
  5. Shirey Model
    1. Disclosure
    2. Deception
    3. Usurpation
    4. Disruption
  6. Example attacks
  7. Security Standards
  8. WS-Security
  9. Message level security with WS-Security
  10. WS-Trust
  11. Beyond point to point
  12. Web Service metadata
  13. SAML
  14. XACML
  15. XACML Policy
  16. Input validation with Web Services
  17. Audit logging in Web Services

Module 3 - Day 2

  1. Identity under attack
  2. Laws of Identity in Web Services
  3. Impersonation
  4. Delegation
  5. Identity and Access Management in Web Services
  6. WS-Trust – composing Kerberos, X.509, SAML
  7. Detailed SAML examples
  8. XACML and related concepts
  9. XML Signature
  10. XML Encryption
  11. XML Signature and Encryption examples
  12. WS-Security
  13. Detailed WS-Security examples tags, headers, timestamps
  14. WS-Security examples supporting various token types
  15. Message level security risks
    1. encoding threats
    2. entity threats
    3. validation threats
    4. semantic threats
  16. Security Token Server pattern
  17. XML Security Gateway patterns

Module 4 - Day 2

  1. Use case modeling
  2. Integrating security in the SDLC
  3. Threat modeling
  4. Design for failure
  5. AJAX, REST, Web 2.0 and web services security
  6. Transactional security
  7. Web Services Assurance
    1. OS
    2. HW
    3. SW
    4. Systems Engineering
  8. Deployment
  9. WS-ReliableMessaging
  10. WS-SecureConversation
  11. HIDS and NIDS in Web Services
  12. Honeypots in Web Services
register