Web Security Fundamentals

TL;DR: Overall, I strongly recommend this course to web application developers and their ops/security partners. The course doesn't simply present a bunch of major weaknesses in web apps and then throw up its hands, but rather presents each vector in detail and shows you how to mitigate or eliminate the problem. This includes discussing the relative merits of different mitigation strategies, and raising awareness of the consequences to users.

--

I've been in the industry, primarily working on or around web applications for years. There were a lot of things I still learned. The instructor takes security challenges that every web application (whether dev or ops side) veteran knows about - XSS, CSRF, injection attacks - and dives into them using easy to understand animations, and the same java-based web application as an example throughout the course.

There's virtually no setup or configuration required to run the example application. You download a single virtualbox VM, and all the tools you need are already installed for the entire course.

The course material and real-world examples are current up to and including a mention of this summer's Equifax fiasco in the United States. He interviews experts in the field to get their perspective - almost like a guest in a lecture.

There were two things about the course I wish would have been a little better:

- The beersafe web application is written in Java, and in a couple of the lab assignments it seems like there's an assumption of Java programming knowledge. Reading a language like Java is one thing (if you can read 2 or 3 or 4 coding languages you can more or less make enough sense of any of them to figure out generally what's going on), but writing Java can get overwhelming quickly if you don't have a background or haven't done it in a long time. There are a couple of places where the lab explanation assumes you know the deeply nested directory structure of a Java application, but that's easily corrected by amending the instructions.

- Occasionally, a test question is very confusing with multiple choice answers whose difference exists almost entirely in semantics. It is occasionally left to the student to get into the instructor's head to figure out the answer - the question behind the question if you will.

In one case, the question wants you to choose the more specific answer than the question would indicate, and in another the question is looking for the more general answer even though the question is worded very specifically. To be fair, this challenge is not unique to this course. It's how I find many of these CBT tests end up working.

Neither of these two things should dissuade you from taking the course. It's vitally important material, and obvious that the instructor put a lot of work into making the course informative and relevant.