---
# System prepended metadata

title: Advanced security (AS)

---

# Advanced security (AS)

## Lectures
1. Basics (Attack surface. Why to protect. Least privilege principle. OWASP. SPAR-or-what-they)
2. Developing defect-free software 1 (language level - SEI CERT++, MISRA, SEI CERT Java, constructions on the language level that brings problems)
3. Developing defect-free software 2 (coding/design level - immutable objects, plausible checks, invariants, the sequence of checks, assertive programming, defensive programming)
4. Developing defect-free software 3 (design level - CIA: availability and integrity as bugs; throttling, self-checks, data integrity code, hardware bugs of memory, etc)
5. Developing defect-free software 4 (testing level - coverage, fuzzing, debug, logging, etc)
6. Hardenings - classical app attacks and preventive actions on env level (OS and JVM)
7. Security of web-services: OAuth, SAML, OpenID Connect
8. Security of web-services (2): OAuth, SAML, OpenID Connect
9. Avoiding data leakage (we developed bug-prone service with working authorization, but how to avoid data leakage - data retention, storing user secrets, tools to verify no secrets in a repo, etc)
10. Data integrity - backups, disaster recovery, audibility, etc
11. Cloud and virtualization security(1): general 
12. Cloud and virtualization security(2): what are security benefits of moving to the cloud. what are security risks of clouds and how to eliminate them. 


## Labs
1. Rewriting the code in a secure fashion (defensive techniques, defect-prone)
2. Fuzzing for the app
3. Writing secure swagger
4. Designing secure web-service (on UML level - where to set access control, idp, audit service, vault, roles separation, etc)
5. (?) How to practice proper design of OAuth usage? Maybe case from Acronis Platform with a 3rd party service authorizing in side IdP in order to get access to Acronis users. And how to make that secure