Notes from Java security training

Threat Modeling:
Use Microsoft SDL Threat Modeling Tool to understand the system potential threats. Usually we have 4 steps, namely (1) Draw Diagrams (2) Analyze Model (3) Describe Environment (4) Generate Reports. We can focus on outfacing interface then features, and define process, data store, external interactor and data flow as well as (trust) boundary.

Here is one *.tms file snapshot:

Secure Development Life-cycle:
Organization or project group should define some secure development process to get security in the whole software development phase, from requirement analysis, design, development, deployment and so on.

Use JTest to fix insecure code:

Eclipse with JTest plugin provides better experience to help write secure code.

OWASP WebGoat Example:
http://localhost:6080/WebGoat-5.1/attack

Notes:

1. SDL Threat Modeling Tool needs Visio
2. JTest is from Parasoft, which provides a bunch of features including security scan