JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD

Course Objectives:

• To learn web security objectives
• To learn about vulnerabilities in web hacking
• To learn about phishing, digital certificates, etc.

UNIT - I

The Web Security Landscape: The Web Security Problem, Risk Analysis, and Best Practices; Cryptography and the Web: Cryptography and Web Security, Working Cryptographic Systems and Protocols, What Cryptography Can’t Do? , Legal Restrictions on Cryptography.

UNIT - II

The Web’s War on Your Privacy: Understanding Privacy, User-Provided Information, Log Files, Understanding Cookies, Web Bugs, Conclusion; Privacy-Protecting Techniques: Choosing a Good Service Provider, Picking a Great Password, Cleaning up after Yourself, Avoiding Spam and Junk Email, Identity Theft; Privacy-Protecting Technologies: Blocking Ads and Crushing Cookies, Anonymous Browsing, Secure Email, Backups and Anti Theft: Using Backups to Protect Your Data, Preventing theft.

UNIT - III

Physical security for Servers: Planning for the Forgotten Threats, Protecting Computer Hardware, Protecting Your Data, Host Security for Servers: Current Host Security Problems, Securing the Host Computer, minimizing Risk by Minimizing Services, Operating Securely, Secure Remote Access and Content Updating, firewalls and the Web, Securing Web Applications: A Legacy of Extensibility and Risk, Rules to Code By, Security Using Fields, Hidden Fields and Cookies, Rules for Programming languages, Using PHP Securely, Writing Scripts That Run with Additional Privileges, Connecting to Databases.

UNIT - IV

Deploying SSL Server Certificates: Planning for your SSL Server, Creating SSL Servers with FreeBSD, Installing an SSL Certificate on Microsoft IIS, Obtaining a Certificate from a Commercial CA, When Things Go Wrong; Securing Your Web Service: Protecting Via Redundancy, Protecting Your DNS, Protecting Your Domain Registration.

UNIT - V

Controlling Access to Your Web Content: Access Control Strategies, Controlling Access with Apache, Controlling Access with Microsoft IIS; Client-Side Digital Certificates: Client Certificates, A Tour of the VeriSign Digital ID Center; Pornography, Filtering Software and Censorship: Pornography Filtering, PICS, RSAC, Privacy Policies, Legislation, and P3P: Policies that Protect Privacy and Privacy Policies, Children’s Online Privacy Protection Act, P3P.

TEXT BOOKS:

• 1. Web Security, Privacy & Commerce: Simson Garfinkel, Gene Spafford, SPD O’reilly.

REFERENCE BOOKS:

• 1. Web Application Security: Bryan Sullivan, Vincent Liu, Mc Graw Hill.
• 2. Web Application Hacker’s Handbook: Dafydd Stuttard, Marcus Pinto, 2nd Edition, Wiley India.
• 3. Hacking Exposed Web Applications 3: Joel Scambray, Vincent Liu, Caleb Sima, TMH.