Application Security Full Course 2026 | Application Security Tutorial For Beginners | Simplilearn

Key Takeaways

[Music] Hey there, welcome to our web application security full course by simply picture this. You finally launch your dream web app and just a few hours later it's hacked. Terrifying, isn't it? Unfortunately, that's the reality many apps face today. Hackers are quicker, smarter, and always hunting for smallest crack in your defense. That's why web application security isn't a nice to have. It's absolutely mission critical. Here we go beyond theory and give you hands-on skills to outsmart real attackers. So whether you're just starting out or already building apps, this course will train you to think like a hacker and defend like a pro. From the OSAP top 10 to SQL injection, CSRF encryption, XWS, and secure authentication, we break everything down in simple practical steps so you can apply immediately. And by the end, you won't just be building apps that work. You will be building apps that stand strong against real world cyber threats. So, hurry up and let's get started. Before we move on, here's a quick information. If you are interested in building a successful career in cyber security then simply learns professional certificate program in cyber security is the perfect choice for you. This is a 20week program designed in collaboration with port University online and IBM which offers 100 hours of live expertled classes and hands-on project. You'll master essential skills like ethical hacking, penetration testing, war analysis while working with cuttingedge tools like metasplot IT, BSuit and map. With advanced modules on ji and cyber security, you'll stay ahead in this fast growing field. You'll also earn prestigious certificate from Purdu and IBM along with access to Purdu alumini status. So what are you waiting for? Hurry up and enroll now and you can find the course link below. >> Starting with the introduction. Before that let's have a little course introduction. So we'll be uh doing an introduction to application security. What is application security? Where it is used. So as the name says application security includes all tasks that introduce a security software development life cycle development teams. Its goal is to improve security practices and find fix and prevent security issues within applications. How it is done, why it is done that we will learn along the journey along with practical examples. Application security is not confined to a certain area. It's not confined to IT as it seems that it's it might be uh confined to IT industry only. know uh you might have heard about attacks uh cyber security attacks on government institutes, energy and util utilities, healthcare institutes, banking institutes. So yes, it impacts application security impacts all of these sectors. How they impact? We will be seeing it while the journey is going on. Our course would start with the introduction which we are doing. Then the core concepts what's software security how secure software testing is done what is cryptography a very important topic and secure software life cycle management skills that we'll be covering would be web app scanning encryption application monitoring error logging or top 10 and API security the agenda for today web app security application and web security. All right. So what are the learning objectives for today? Again the basics core concepts of security. We'll be able to classify the best practices. We will be analyzing one case study that would be of Uber. We will see what went wrong or what went good. How application web application security would have done it better and we will categorize the requirements for a foolproof security team. What are the requirements? We'll be seeing it. So say if you have joined any organization as a cyber security specialist where would this course help you say you you are given the following tasks which you'll be able to do after this session. Understand the vulnerability stack. What are vulnerabilities? how they classified, which application is impacted, where to see which vulnerabilities, uh where on the net they are visible, is there any database for vulnerabilities, how many of the these are there, what about the vulnerabilities which were there in the history, can we find them? we will be able to understand the organization's security policy. So whatever organization you are working in currently, you will be able to understand their security policy. Then you'll be able to review the core security requirements. Whenever we talk about any software, so we talk about a software, we know it is something that we use in our daily day-to-day life. Uh it is a firmware with which we access applications. What is secure software? Now the same software or same application is secured by means of following attributes. Which attributes? Reliability, resiliency, recoverability. When I talk about reliability as the name says that is the software dependable it fulfills the purpose for which it was created. For example, if I talk about social uh networking sites, the social networking softwares. So we know we at once our mind will answer okay you are talking about soft uh social connection softwares. So it's either WhatsApp, Facebook, Instagram. So these companies or these softwares have made a reliability mind setup. So whenever we talk about social engineering these softwares would revolve in our mind. When we talk about resiliency resiliency means that the software does not violate any security policy. So it's able to withstand the actions of threat agents. Resilency means I downloaded the software today and tomorrow it's demanding ransomware to use. My files are encrypted. It's saying that you cannot move forward from this point. So resiliency should be there. It does not violate any any security policy. reliability was the software is dependable recoverability as the name says. So if I remove any of the application from my phone uh I have some restore point or backup point from where I will get the entire thing back in same setup without any loss of data. So software is able to restore operations when you buy a new phone. You simply have to login into with your ID which is major it is if it is Android you have to use your Gmail ID and entire backup of applications from your previous phone to your new phone it clones it. So that talks about the recoverability. After software or secure software, we talk about web applications. What are web applications? These are nothing but software programs that run on web browsers. If I open uh say any website simply learned what is this? This is a web application which is running in my browser. So anything any application or any software which runs on browser which runs on web is web application. Talking about the flow let's talk about the flow. How the data flows. I'll be using different symbols here. So let's say this is my database server or I call it DB. This is my application server. [Music] This one is the web server. So all these things combined together they work in background. So these would be the back end thing. All three of these are back end when I talk about the applications if I am seeing this. So this all is in front end because it's directly on UI on which I'm interacting with it. So front end would be this would be my web browser and the system on which it is running laptop or mobile whatever device it is. So I I won't be using cloud here but yes this is front end. How would be the flow move? My database server will fetch the address I searched for simply learn application server will respond that yes this is simply learn application. It will the application server will respond and the web server will then be showing this to web browser. So now simply learn is visible on web browser and that is reflected on my device which is either laptop or mobile and this thing is front end. So just an overview how web applications work. Which main components are in action starting from database server in which entire uh applications entire simply learn things are hosted. Application server on which the application is hosted. Web server responding on web browser to your laptop or mobile. application vulnerability stack. If we talk about application vulnerability stack or as the name says it will talk about application irrespective it is web application, mobile application, cloud application any vulnerability that is impact impacting this application would be a part of application vulnerability stack. So when you talk about vulnerability, what is vulnerability? Anyone want to answer it? Uh I won't be judging over it. But yes, uh just to see how many of you can answer what is a vulnerability. If I say uh any application say if I say I won't be naming any other application. If I say simply learn application is having some vulnerability. What does that means? Does mobile app also require web server in the back end? How is web server different from web browser? All right. So I'll firstly answer these two questions from Vardan and Vasuv. So Udan says how is web server different from web browser. Verdan web server is on which the application is hosted which is in the back end from where my web browser which is Chrome it is fetching that detail from some web browser on which simply learn is hosted. So answering your question, web browser is either Chrome uh the one which is obsolete, Internet Explorer which is now not used in its place. We have Microsoft Explorer, Firefox, so Opera Mini. So all these are web browsers while web servers are Apache. Apache web server. We have some web servers from Oracle. Microsoft has its own web servers. Google has its web servers. AWS has its web servers. So that's the difference between web server and web browser. Does mobile app also require web server in the back end? Uh Vasuv yes the answer is if because you also use web browsers on your mobiles. So if you are using uh browser say you want to see your report card and you want to access uh the website of your university or college. If you are using your mobile browser, you again are accessing their web server in the back end. Praep says web application and website what is the major difference? Uh both of them work on www. So web site and web application both works on our browser. In Android Studio we use web view which is like a server. Uh that's true. Verdan vulnerability is a thing which happens integrity and availability for data. Uh so that's that shows that uh you have been good in the module one because that's from where you are answering it. That's good. All right. Answer to this in two different scenarios. one scenario the one I discussed uh where you are using mobile application say which is mobile Chrome which is Chrome or Firefox inside your mobile now it is the mobile application it runs on web servers uh Edge again these are mobile applications and they do have web servers on which they will show you the answers because they are browsers so yes they have servers in background. Talking about other applications, uh although this answers your question, google.com is a website. Yes. Yes, it uh Google ultimately uses servers, database server. Google.com when you search. So searching here although it is my default page but yes google.com it is talking to its server in the back end and showing me this page. So this page is web page of Google or website of Google. So now you got your answer. Web application would be if you're using that Google application in your phone that's the application while anything which you see on web browser is a website web app server mobile app server do they run on same server that depends upon company to company if I'm having a big company like Google or Microsoft I'll have different servers so that if my web app is down my mobile app is running it doesn't impact it While uh if I'm a small cap company or medium cap company, I might have both on same physical server of same cloud server. So I might use AWS with different instances running for mobile and web app or I might have because even if I'm smaller than that with low budget I be having single physical server with both of them running on it. So depending upon the budget I'm having, we were talking about stack. When we talk about stack, let's start from the network part. When we talk about networks, what are the things that are under attack? We either talk about routers or firewalls. When we talk about operating systems and these all are the things that you need to know to be successful in cyber security domain. Knowledge of each one of these applications would either be either be open-source or licensed which are commercial database. When you talk about DB, there are certain database that run in the background. We have Oracle, MySQL, DB2 and so on. The list goes on. But these are the major on which the attacks are targeted. What are the components? Web server either Apache Microsoft IAS custom web application. What issues do we see in custom web applications? uh this generally happens when uh there is an application already placed there uh there's a mark uh application working and it's source code is available uh say in gitlab so when you talk about it's source code is there in gitlab you try to customize it according to your wish say Uber uh is there already placed in GitLab. The code is there. I make some changes according to my requirement and uh generate a new taxi application with some name say my name is Harper. So let let it be herprit cabs or blue cabs yellow cabs whatever. So I'm using code which is already there but now I have made it customized according to my needs. We can have business logic flows or we can have technical vulnerabilities. If I'm not into uh security thing, I might change something which could induce a vulnerability in that application in that customized application, not the original one because I'm now playing with it. So I might induce some technical vulnerability in it with with the changes I'm trying to do. But again that that depends upon what kind of service you are taking from the cloud provider. If the security is managed by them then you don't have to fear anything. If anything happens your data is lost the cloud providers would compensate you but that typically never happens. Does web scrapping comes into scrapping comes into this issue as we try to extract info without permission of the company. Uh if you notice uh when I'm trying to answer your questions I'm revolving around simply learn only due to same uh thing what you are trying to question Vdan. Uh yes uh when you try to say even even when we will be attacking uh websites it would be mostly simply learn only because we won't be attacking any other website of any other company that could lead us in trouble or jail. So yes that's a very good question. If you try to fingerprint, we call it fingerprinting or footprinting. Uh when you try to collect data of any website or any company through these means, their sock team, their security team would come to know that something is something fishy is happening and yes, that might lead you in trouble. So permission of company is necessary in most of the cases. All right. Next point is single page applications. As the name says, applications which run on a single page. They they are called single page applications. How they work? uh say it it's it's a design approach that generates web pages dynamically with new data from the web server instead of loading entire new pages. So every time you open single page web application that it autogenerates the data from web server and it uh doesn't always go back to web server for fresh linkages uh which could impact in its loading. So for faster loading, SPA generally uses Ajax to exchange data with the server and JavaScript to manipulate the elements on the existing page. So what does it use? SPA uses Ajax. Why? To exchange data with server. What else is used? JavaScript to manipulate the objects. Now, uh how can I know that what elements are there on any website? So, let me show you. So, talking about single page application, this is simply learn. I want to know uh what things what are the back end things working on this page. I either I go to inspect element and uh use inspect element to go one by one or I use some bookmarks. The bookmark I will be using would be vapalizer and shoddan. Talking about webalizer, it shows that simply learn is using Microsoft advertising for performance priority. Hence for marketing automation they are using web engage sales loft. Amazon cloudfront is the VAF which is CDN. Personal personalization is done on web engage version 6. So they are using pass platform as a service. So simply learn is hosted on web application uh Amazon web services. Now you know from where it's fetching the data from the analytics they are using Facebook pixel Google Analytics Microsoft clarity loadable components jQuery cryptojs so it these are the javascript javascript libraries if you want more click on more info I guess it would be paid yes it's paid You can export this entire information if you want. You can use same thing for other application. The other application or extension that I'll be using is shoddan. It shows so I didn't know the IP address from webalizer. So Shoddan showed me that okay this is the IP address of simply learn it's on cloud we know that it is AWS open ports are 80 and 443 uh in network you will be I'm not yes network you have already done enterprise infrastructure so you know open ports 80 is for HTTP 443 is for HTTPS PS. So you can view IP details, view domain details. Moving ahead, it will show you more details. I'm not sure if it is paid now. No, it is not. So it's on Amazon. It's the ISP using CloudFront port 80 which is HTTP HTTPS. So these datas you can get from some extensions. If you are good at coding that is always a plus point because uh in web application security there are two types of testing. One is static analysis and the other is dynamic analysis. When we are doing static analysis static analysis is nothing but source code review. You review the codes for that you should be good in coding. While if you're doing dynamic testing that means websites in motion for those you you just need know how of coding and not the entire code structure. So better if you are having uh Java or Python knowledge if don't know coding that much if you are a fresher then you can learn it by heart that would help you uh in long run but if uh your job your current job doesn't require it so you may even not go along with it. I'm currently okay you are in network side. So I started uh with networks only uh I started with networks then uh uh wireless networks data networks wireless networks and now I mean cyber security it doesn't necessarily require you to know the websites uh the programming but yes it could help you all right brief on it. Okay. So, Ajax is a it is a set of web development techniques. Uh when I'm using Ajax on my client side on my system, it's used to create asynchronous web applications. So, we can send and receive data from server without interfering with the display and behavior of existing page. Even though uh this is working on your uh we are using the chat within this application, it is not impacting any other functionality while we are doing this session. So this is Ajax. We are using Ajax. It is just utilizing a bit of the entire thing without impacting anything. That dynamic thing is called Ajax. So it is not changing behavior of the existing page but we are still able to check any example of spa if possible single uh this one example is the zoom learning that we are doing. Uh we are using uh meeting chat without impacting any other thing in simply learn. Uh this application is again spa when I search anything random it will provide me the answer although I know herit is nowhere inside it. It will just throw an error without impacting anything else on the page. So your search did not match any content. It take it took a second or so. So without impacting this it's spa using Ajax after single page application. All right let's talk more about a bit more about how single page application works. Let's see. I don't want to save it. All right. So again this is my browser this is my server this is my application this is the response. So my browser will send a request. What it is doing? It is sending a request. Server will respond with HTML file. Then okay. Uh this is in response to your request that this the file. Now the application sends an AEX request to fetch data from the server. Just keep correlating. You open your Google Chrome. You searched for say simply learn server provided HTML file at first. Then the application sends Ajax request. Y is sent to fetch data from the server. So now it is just sending a so that additional data from server is requested without any impact on this page which is already showing on browser. The final step would be web page is updated using JSON data. So JSON data is received which is then updated on your web browser. So this is how it is functioning in the background of a single page application is payment system with UPA also spa because once we reach to payment page then it sends a request to UP and keeps pulling if we have made the payment or not. So uh there's another thing running in UPA systems because there it works uh two ways. Once it is uh interacting with a server which checks that if payment is made another it is interacting with the server which checks if you have provided the proper min or OTP. Third, it is interacting with your bank from which the payment has been made. So, it's a little different. Uh it's not entirely SPA but combination of SPA at three different levels. All these three levels that I talked is server and application generating running on same system or different is server and application generating ax running on same system or different since I am using this web browser simply learns to talk with me but I don't. So if I'm using this website on my local machine that means Ajax is running on this client system. So this answers your question that Ajax works on the same system on which the web browser or web app is running. JSON how it works? JSON is a message that you get say if you are all right. So if any response you are getting in JSON format you can simply use uh JSON viewer. Uh I don't have JSON sample currently but let me see if I can get it from somewhere. Okay. So say if this is the JSON data that we are getting simply use it in viewer. It will show you data in this format in tabular format that okay employee name is this salary is this and it's he or she is married. So this was the code JSON viewer simplified it in a table form. So if this helps you in your daily work. So what are the most common commonly used frameworks for developing SPAS? So all these frameworks that we are talking you might have heard about it especially if someone of you is a developer. ReactJS which is JavaScript, Vue JS, AngularJS. So all these frameworks are used for developing SPAS because SPA is a front end technology there. Therefore all these are the front- end utilities that we are using. So all right uh give me if you could just to check kindly provide me example of spa uh in your from your daily life from your daily life provide me an example of spa very easy even if you that that's that's the uh that's the definition of spa but uh provide an example all right one example is Facebook you edit change anything you see videos but it doesn't change the basic functioning what else share prices display if it is a good application then yes okay otherwise if it is lagging then it is not spa Gmail, right? Google Drive, right? WhatsApp. WhatsApp web. Okay. The answer Twitter. Perfect. The answer which I am searching for. SharePoint. Okay. All right. Can say because real time changes are there. Okay. Perfect. the answer which I wanted to Google maps. Uh no because we are not changing anything over it. Uh okay. Uh the answer which I was expecting from you people platform which is Netflix. Yes, Wangesh uh location can be changed dynamically but during that time uh once your location start and stop is set. it doesn't has to fetch anything uh anything new uh since you are connecting to internet so that's that's what it requires that's the ultimate thing it requires talking about OTT platform uh yes Jio uh Netflix Amazon Prime all these hundreds of people if if there's a match of Indian cricket team uh Hot star. Yes. So it cers load of a billion people, billion devices connecting to it and still it is working without going down or showing any symptoms of uh of disconnection. So that's that's where spas come into existence. You are even uh some someone who is not keen into uh cricket they are working they are watching some other thing over the same application which might uh have some different load level so catering to different loads at same table YouTube yes so all these are spas all right one question I saw currently is what is the difference between single page and multi-page applications. Uh okay, Madri says, "Shodan shows TLS 1.2 for security surf. Is this not a risk? The latest is 1.3." Very good question. Uh Badri, but uh sometimes it's the compatibility issues. Say the company in which I am currently working, they are also using TLS 1.2 2 because maximum of the infra inside the company they support TLS 1.2 they haven't shifted to 1.3 due to compatibility issues or support so that's why some companies are still working on TLS 1.2 2 rather than 1.3. But yeah, yes, they do have the security team working behind keep checking which is checking it regularly that nothing of that sort happen. Uh any vulnerability which is there for 1.2 they are not exploited by anyone. Uh once they uh that is also secure but every version every latest version is more secure than the earlier one. TLS 1.1 transformed into 1.2 2 due to more security. The version 1.3 is more secure but it's not very compatible to the infrastructures yet. 1.2 is widely used. So chilanjit uh the answer Sunil attempted the answer and it he is pretty much right. Single page application will interact for any new changes from the web server. It will not uh load the entire page again and again while multi-page applications will for any change they will reload the entire application. So they are more slow than single page applications. If that answers yes uh Badri answered that also. It is new page every time with user actions. CRM is multi- page application true. I guess this uh we are talking about the SAP CRM right? Are we having hybrid? Uh where where uh where are we having hybrid? I I mean I'm not getting the question. Yahoo Gmail is single page. They do not reload on receiving a new mail. They just keep new mail updated. I mean both SPA and MPA. If people prefer multi-page application uh they are uh preferred while using heavy applications. So for SPAS are preferred for heavy applications just as we discussed about the OTT things. Again the budget thing if you don't have much budget you use multi-page application. MPA example would be anything uh say I'm not sure how many of you have used medium which is a blog site technical blog site so if you talk about medium it is MPA any blog any e-commerce website which is Amazon flipkart which goes to a new page if you go to Amazon regular it is one page go to Amazon fresh yes sushi answered Zomemetto, Swiggy, these are all MPAs. Wikipedia is MPA. Very nice example of it. Are we having hybrid solution between single page and multi-page applications? Uh no. No. Uh no issues. Wangesh. Uh uh if an application is SPA, it is completely SPA. If an application is MPA, it is completely MPA. You cannot have a part of it as SPA or part of MPA because that part itself is divided into multiple pages. So if it is MPA it is completely MPA. If it is SPA completely SPA all right just one question which one is faster S spa or so Dian that is SPA no doubt about it. Amazon Prime and Amazon mini all of them are SBA. So you all know SPA is faster. Okay, we know that uh the advantages of using SPA is it is speed. Most of resources loaded only once uh data is preserved. We require less data. What are the disadvantages of using SPA? Uh whenever you click on that mini DB thing, it will redirect you to SPA rather than the MPA part. What about desktop application? Which application? We we are talked about SPA and uh MPA already. Which application? Which desktop application you are talking about? Again, that depends which application you're using. If you're using any run uh if you're using team viewer those are those command uh MPAs if you are using Netflix uh application desktop application then again it's SPA navigation is maybe the issue with SPS or uh no okay what in navigation you are not exact on the point but yes near about loading uh akib It it is faster. So loading is not an issue for SPA. Loading is an issue for MPA. What are the disadvantages of using SPA applications? Since it is faster in execution, which do you think is more prone to attacks? Is it SP or MPA? No, there are dis advantages. Answer Sunil has already answered it. So the there are kind of attacks uh injection attacks, excss attacks which we'll be seeing in uh further uh Wang it is it is not the exact thing but yes while while navigation while in uh the data is in transit there's there's scope of attacks because uh not the entire thing is reloading not the entire data is being fetched but only uh the data which is being transmitted can be manipulated by attackers. They can simply inject malicious scripts into it. So there was uh there was there was recent attack which was called that was a vulnerability in JavaScript Java uh which is called log 4j. If anyone of you remember that 4G this was a vulnerability which was there in every Java it was a zero day vulnerability every Java logging framework was having it. So whenever we talk about vulnerability and it it attacked any and every application which was working on JavaScript. So this is one of the uh example where how it got vulnerability. How it got vulnerable. Okay. Uh long story short, uh JavaScript was having some a single line in the code which was talking about the logging thing. A little change in that line or that code or that script made it vulnerable to changes in entire globe wherever Java was being used. Uh so that resulted in this vulnerability which was already present there but were never exploited. Next is microservices. When we talk about microservices, so microservices are shorter services which are running inside bigger services. It is an approach in which a single application is composed of many loosely coupled independent services. So microservices emerged to address the limitations of monolithic architectures which we will initially using such as scalability, flexibility, productivity to answer all those things. We got the concept of microservices. So what are the advantages of microservices when a single code is divided into multiple shorter codes? So updating the codes is more easy now. Updating is easier. What else? Scaling can be done of each unit independently. What else? Fault isolation. If a part or a unit is in fault, it will not impact the entire uh structure. One point which I want to see say updating is easier. Scaling can be done independently. Fold isolation. What else? Okay, I will give you a hint. Since these are different units, okay, I'll just uh ask you in yes or no. Since these are in different units, can we use multiple programs in it? Multiple pro programming languages. So the answer is yes. So basic and most advantageous thing of microservices we can use different programming languages defining different structures different component structures. What do you think about disadvantages language that is good? Yes, that's the answer. Uh Chanji, did you get the answer now? Why it is yes? All right. So, think about uh brainstorm on the disadvantages. What are the disadvantages? The answer lies here only. So the disadvantage number one is disadvantage number one which you can feel if you're using different languages in a set would yes. So the answer is complex structure. Complex or complicated we can say. What else? What will this turn into? So if we talk about Sunil Badri, Harjender all of them they are pointing to one thing which says testing can become complicated. So when you have made a complex or complicated structure and QA has to test it then they have to test it for different languages different things different services. So now let's let's talk about a case study uh case study of Uber. We are talking about Uber uh the taxi application of course. So Uber like other startups it created monolithic architecture for its application but it forgot to include scability and stability in its software. Uh I guess because it didn't know it would be very popular worldwide. So it missed that scalabil scalability part. So it used monolithic structure. When I talk about monolithic structure, what is what it is? It is a single tired application that compiles all components all components in a single program. That means it was not working on microservices. All components were on in a single program. What are those components? What were those components? Client side user interface. Server side business logic integrations data access layer. So all of these components were now in a single program rather than running on a different services. So that made the application very heavy and it now started making problems for Uber. So for why because for even a short change uh in the application they had to go through the entire program see where that particular function is change it and failure of one program. Failure of one component could bring down entire system. So as the services increased it became very difficult for Uber to sustain. That's when they shifted from single program monolithic structure to microservices. So now when they shifted to microservices the load was less because now it was decentralized every unit was independently functioning without impacting the other. So now because they were independent dependency on other features was removed and from that from that phase onwards Uber benefited by shifting its architecture from monolithic to microservices and that was a learning lesson for other uh applications which were their competitions in global market. So talking about security policy as the name says security policy is an overall general statement produced by senior management that dictates security within the organization. So what is it? What it is? An aggregate of directives, regulations, rules, practices. All of these are aggregated. that prescribes how an organization manages, protects and distributes the information, manages, protects and distribute the information for any company you are currently working in. They have their own set of policies. Some says you cannot plug in USB uh in your laptops. Some says you can plug in but it won't work. Some says no media connection is allowed be it your own phone to the laptop because you can steal the information. So this is uh how different companies frame different policies based upon their sense of security. How are these uh how to make flowchart here? Let's see. Okay. What are the how can we divide it into strategic and tactical? Let's see. So we start with laws, directives and regulations. followed by the policies followed by they call it mandatory standards. These are further followed by detailed procedures, [Music] recommended guidelines and baselines. top they follow top to bottom bottom approach. So till here It's all strategic and this part this part is strategic that means the core or VIPs they make these things CISO CTO CDO they sit together to make laws directives and regulations policies while the mandatory standards detailed procedures these are tactics based. So when we called about tactic based that means the tactical team which is there to see on mandatory standards the guidelines and baselines they are responsible for these parts the lower one talking about standards. All right. Talking about standards. Standards are nothing just okay I'll just write it here only. When you talk about standards, standards are mandatory activities, actions or rules designed to support higher level policies. So standards are basically designed to support these higher level laws, directives, regulations and security policies. They are very specific technical. They include specifications for what hardware you'll be using, what softwares you'll be using. Examples of standards that we talk about in uh cyber security is ap mid. These are the standards that we look after when we talk about cyber security. So, OASP, MIT, SAS 25 these are the standards. Talking about procedures, what is the difference between standard and procedure? [Music] It's generally called SOP. If you hear about SOP, it is they are not talking about the SOAP or anything else. It is standard operating procedure. Standard operating procedure. What it is? It is a detailed step-by-step sequence of activities that are necessary to perform a specific security task. If someone some of you are working in endpoint security then you know that there's certain procedure with which you check for uh the endpoint security. Uh so we have network guys here. So there are procedures with which you check for firewall rules. There are procedures with which you check for the routing table. There are procedures with which you change the routes if you are given that access. You cannot just go and change the routes the uh without opening a change. So first it will go to gap which is change management board and then if it is approved then you can change the routes. So that's the or procedures or standard operating procedure that we call it. Procedures are at a lower level than standards. So standards are at a higher level than procedures as we can see in this flow diagram. So answer procedures and policies are dash are they uh policies and procedures are dash option A. Option A is unimportant. Option B is mandatory. Option C is casual. Option D is none of these. So talking about guidelines, what are guidelines? you know what is procedure, what is standards. So these are important when you sit and interview for these are more of information security things rather than cyber security things. They ask you for standards, procedure, guideline. What are the differences in guidelines? You have guidelines as the name says they are just recommendations. There are the recommendations on on how standards and baseline are implemented. Oops. So guidelines are the recommendations on how standards and baselines are implemented. So that's why the guidelines are at the lowest end because it doesn't talk about something very necessary or immediate. What does it talk about? The guidelines talk about of different levels. Let's talk from the base which says why we are doing it what are we doing. When we talk about why it is defined in policy when we say what are we doing those are defined by standards. How are we doing it? That is done by procedures and guidelines are just for your information. FYI is guidelines or recommendations. See how we develop a security policy. where can we get uh an idea from where we can make a security policy. So let's see. Let's do a short activity. So we can have a little help from a tool uh a web browser only. So what we are going to do we are going to develop an application security policy uh using a template from where we are going to get the template we are going to get that template from sans.org og which template okay it's free policy templates is already there so we need to have information security policy so just click on it home security policy project so which policy do we We are talking about application security. So let's go to application security. We have web application security policies. You can download as PDF or doc. But since uh we will be making changes according to our company company name and all. I will download doc. So it is getting downloaded. You can do it sideways. So let's do it together. So once you have done it, simply open it from the downloads web web application security policy. So you see it the entire policy you can remove the things you don't want. So web application security policy change the company name your company name change it here wherever it is company name just filter it out. You can remove the footer header and footers as per your requirement. So it will talk about everything if any new or major application is released, third party or acquired web application, patch releases, emergency releases, annual review. how we uh define the severity which are the high severity, medium severity, low severity issues. The standards that we are using is a wasp. So here you will just whatever tools you are using just mention it here. You're using Kal Linux as operating system. Any other tool that you're using mention it here. Compliance policy is here. So you see standards policy and process is here. Testing guide is provided. Change these dates according to how you want it. Responsible would be your security team. Just make summary of change. What have you changed? Is it application uh updation or anything related to it? So this is from where you can make your own web application security policy. Okay. Wants to know from where should we download it as if it is sans.org. So once you move to sams.org I'll just share this. All right. OASP is the standard that we used. AASP is the standard that we used for uh taking care of the vulnerabilities in our domain. When we talk about a wasp, a wasp has top 10 vulnerabilities which keep on changing every four years. So latest one was in 2021. So this is was top 10. For 2021 it was so I told you it changes every four years. So before 2021 it was 2017. Before 2017 it was 2013. So when we talk about top 10 it says what are the most impacted vulnerabilities in any web application. We talk about initially it was injection which was mostly uh impacting any web application. Now it is at number three. Now the most impacted one is broken access control. Cryptographic failures is number two. Insecure design is number four and so on. I guess you people have done it in uh enterprise the first module that you had covered with the other trainer. I guess it was part of that module. Not sure. So our next topic is what's secure software requirements. When we talk about uh core security requirements, what are the core security requirements with which your training started? What are those three requirements which should be there in any case? What are those trials? So the core software requirements are CIA. Exactly. It says confidentiality, integrity, availability. So, uh everything in cyber security or information security revolves around these core values. for confidentiality. Uh okay. Apart from these three, there are three extra uh add-ons which says authentication. We call it AAA authentication, accounting and authorization. When you talk about confidentiality that means any sensitive data should be protected at any cost. So sensitive data should be protected. How we protected? By using some encryption mechanisms. We mask passwords, other sensitive information. We we mask it. We do not store passwords or sensitive keys in clear text. we have key pass or something like those type of tools where we uh save sensitive data like passwords. We use TLS to protect against attacks. Just we had a short discussion about TLS 1.2 and 1.3. They are just the security measures. We do not store any sensitive information in log files because it's easily visible. The logs are very easily accessible. When we talk about integrity, integrity says okay as a person when we talk of in lame language integrity is your actions should match your words. That's that's how you say how integral a person is in cyber security. That means any data any data that was actually intended to be sent any data that was actually intended to be sent from client side to the server side should be intact. free of errors and send as it is. So if my client had to send ABC that do in caps, the receiver should receive ABC that do in same format in caps and not uh some other content which is unrelated XYZ or something like that. should not be. So in other words, all user inputs must be validated for malicious or disallowed content before processing. All published software should provide a computed digital signature to validate its correctness and completeness. So let's add that requirement here. Digital signatures. So digital signatures are tested to check if the content to be delivered is integral and it is not uh it is not amended on the way. When we talk about availability, availability says it should be available 24 + 7. So the software must meet all the requirements of the SLA of 59. That means should be available at 99.999% of the time. These are the SLAs that most companies uh adhere to. If I'm providing a service to any other company, so I would say that my service availability would be up with the 0.001% 001% downtime. So that's the availability that I'm ensuring to my client. The software must be able to support up to 300 users at any point and point of time. It should not be the case as the load increases my application is crumbling. So availability is availability also defies that application do not crumbles under the load. What else should be under availability? What do you think should be under the availability? One is restoration as early as possible. If it is a P1 or high priority issue, the restoration should be within 1 hour of the disruption. The last point is no adulteration, no modification allowed during transition. That is true. Disaster recovery, how do you do it? How how is disaster recovery done? You are very near to it. But backups, what's the other name? Uh okay backups is uh if you are getting impacted or you have some backup what during the attack snapshots. Okay a little far away but all right one word run more than multiple side what is the one word for it failover. So, Swishi has answered it. We call it either failover or redundancy. Yes. Uh that's that's that only network guy will understand. Badri. Yes. High availability. That's uh failover or redundancy would be the uh main cause. Say if I'm having two routers, one of them fails, I still have the other router of some other company working for me. So that ensures the availability of services in case BT goes down is still working. Tata goes down, BT is still working. So that's where redundancy comes into place. Moving forward, authentication. All right. What do you understand by authentication? It says only authorized persons would be allowed. Uh I have some endpoint security for my company. If I want uh some third party to use it, only those some other person from other company to use it for any reason. It should be my responsibility and only that person who it is who who it belongs to the credentials for which the credentials are created only he is allowed to use it again using MFA multiffactor authentication. So that provides the authentication part. For external users, I'm talking about MFA. For internal users, it could be single sign on because we know that they are using the company's domain. If I'm using at the rates simplylearn.com I am able to use engage x and learning learns simply learn both with single sign on authorization says all right you have to be very very clear the difference between what is the authentication and authorization talking about authorization uh only users with admin roles will have permissions to execute operations. So authorization means the level of access you are having. Authentication means if you are allowed to do it. Authenticated users will have read and write permissions and regular users because they are allowed. authorized would be having the maximum scope of access. If we talk about accounting, so I saw someone talking about non-reputation that comes under accounting part. Why I made a change uh in some server or some route in routers or some firewall uh rule. I made a change and then I'm denying it. I haven't done it. So accounting says we will simply check the logs. It will show the username of the person who has made the changes and thus supporting non reputation. I cannot deny that I have not done it because logs are showing it. So accounting is nothing but logs. And what does log show? It shows identity what action you have taken on which objective you have taken the action what is the time stamp. Next part we will be discussing about general security requirements. So the general requ security requirements are session management. We don't want our session to be hijacked nor we want it to get compromised in between we are doing our work errors and exception management config parameters management So when we talk about session management, so session management says AAA protocols summary on AAA protocols. Sure. So you have AAA. This one is good. Best is Wikipedia. So I was at session management. When we talk about session management requirements, it says each user activity must be uniquely tracked. So if I am doing something, I'm being tracked what I'm doing in what application. Say if I'm using uh identity access management, then again it is tracked what I'm doing in there. If I'm using PAM, which is privilege access management, what I'm doing there is being tracked. The user should not be needed to provide their credentials once authenticated. So if and once authenticated, it would be very irritating if there if uh it's asking for credentials again and again. User session must be explicitly invalidated when user logs off or closes closes the browser. So if I talk about uh when you use your mobile applications or web app for banking requireme