Statement of Qualifications

Javagirl

Description

• exposé

Phase Separation Science, Inc. Statement of Qualifications 6630 Baltimore National Pike 410-747-8770 800-932-9047 Baltimore, Maryland 21228 FAX [phone]

• project requirements during the pre-project
• environmental science statement
• full data packages
• accuracy from sample receipt to final report submission
• sample integrity
• format requirements
• analytical chemistry
• project
• laboratory

Sujets

• Exposé
• Instrumentation
• Delaware
• Maryland
• Agriculture ministry
• Washington (District de Columbia)
• Analytic
• Project
• Sample
• Accuracy

Informations

• Publié par: ribul
• Nombre de lectures: 22
• Langue: English

Extrait

TT8820:DatabaseSecurity(STIG) AccordingtoresearchbytheNationalInstituteofStandards,92%ofallsecurityvulnerabilitiesarenowconsideredapplication vulnerabilitiesandnotnetworkvulnerabilities TriveraTechnologies’BestDefense™SecurityTrainingSeriesisasuiteoffrontline‐orientedsecuritycoursesthatprovidecompleteandcurrent coverageofDISA’sSecurityTechnicalImplementationGuides(STIGS)andassociatedchecklists.STIGSareanintegralpartoftherequired configurationstandardsforDoDInformationAssurancemeasures.Thesemeasuresarefocusedonpreventingcyberespionageandcrimeaswell asdenial‐of‐serviceattacks.Ourcomprehensivesetofclassesaddresseachofthecriticalissueshead‐on,asourcourses,seminarsand workshopsexplicitly: Teachdevelopers,DBAs,andstakeholderswhatthevulnerabilitiesare Demonstrate,inrealterms,thepotentialimpactofeachofthesevulnerabilities Provideexperienceinhowtorecognizeandproperlyaddressthesevulnerabilities Teachstakeholdershowtodefendagainstthepotentialconsequencesofsecuritybreaches Illustratethevalueandtheprocessofintegratingsecurityintotheentirelifecycleofapplications,products,anddevices Course:TT8820:DatabaseSecurity(STIG) Duration:3days SkillLevel:Intermediateandbeyond Format:Extensivehands‐onprogramminglabs,expertlecturecombinedwithopendiscussionsandhigh‐Leveldemonstrationsanddynamic groupexercises. Language/Tools:SpecificdatabasesthatarecurrentlycoveredareMicrosoftSQLServer,IBM’sDB2,andOracle. DeliveryFormat:Availableforonsiteprivateclassroompresentation,orliveonline/virtualpresentation Audience:DBAs,developers,andotherenterpriseteammembers Customizable:Yes DISA’sDatabaseSTIG,inconjunctionwithbothgenericandproduct‐specificchecklists,providesacomprehensivelistingofrequirementsand needsforimprovingandmaintainingthesecurityofDatabaseManagementSystemswithintheDepartmentofDefense.Thiscoursefillsinthe context,background,andbestpracticesforfulfillingthoserequirementsandneeds.Aswithallofourcourses,wemaintaintightsynchronization betweenthelatestDISAreleasesandourmaterials.TheclosetiesbetweenthisSTIGandtheApplicationsSecurityandDevelopmentSTIGare reflectedinthecoverageofapplicationissueswithinthecontextofthiscourse. DatabaseSecurityisanintensedatabasesecuritytrainingcourseessentialforDBAs,QA,Testing,andotherpersonnelwhoneedtodeliver securedatabaseapplicationsandmanagesecuredatabaseswithintheDoD.Inadditiontoteachingbasicskills,thiscoursedigsdeepintosound processesandpracticesthatapplytotheentiresoftwaredevelopmentlifecycle.Perhapsjustassignificantly,studentslearnaboutcurrent,real examplesthatillustratethepotentialconsequencesofnotfollowingthesebestpractices. Data,databases,andrelatedresourcesareattheheartoftheDoD’sITinfrastructures.Theymustbeprotectedaccordingly.Inthiscourse, studentsrepeatedlyattackandthendefendvariousassetsassociatedwithafully‐functionaldatabase.Thisapproachillustratesthemechanicsof howtosecuredatabasesinthemostpracticalofterms. Securityexpertsagreethattheleasteffectiveapproachtosecurityis"penetrateandpatch".Itisfarmoreeffectiveto"bake"securityintoan applicationthroughoutitslifecycle.Afterspendingsignificanttimetryingtodefendapoorlydesignedandconfigured(fromasecurity perspective)databaseapplication,studentsarereadytolearnhowtobuildsecuretheirdatabasesandapplicationsstartingatprojectinception. Thefinalportionofthiscoursebuildsonthepreviouslylearnedmechanicsforbuildingdefensesbyexploringhowdesignandanalysiscanbe usedtobuildstrongerapplicationsfromthebeginningofthesoftwarelifecycle. AkeycomponenttoourcoverageofDISA’sSecurityTechnicalImplementationGuides(STIGS),thiscourseisacompanioncoursewithseveral developer‐orientedcoursesandseminars. Copyright © 2009 Trivera Technologies LLC Worldwide.| CollaborativeIT Training, Mentoring & Courseware Services TT8820_Database_Security_STIG_20090803 | Page1www.triveratech.com |[e-mail]

TriveraTechnologiesBestDefense™ApplicationSecurityTrainingSeries What You’ll LearnCourse Objectives:Who Should AttendAudience & Prerequisites: StudentswhoattendDatabaseSecurity(STIG)willleavethecourseThisisanintermediate‐leveldatabasecourse,designedforthose armedwiththeskillsrequiredtorecognizeactualandpotentialwhowishtogetupandrunningondevelopingwelldefended databasevulnerabilities,implementdefensesforthosedatabaseapplications.Thiscoursemaybecustomizedtosuityour vulnerabilities,andtestthosedefensesforsufficiency.team’suniqueobjectives. ThiscoursequicklyintroducesstudentstothemostcommonFamiliaritywithdatabasesisrequiredandrealworldexperienceis securityvulnerabilitiesfacedbydatabasestoday.Eachvulnerabilityhighlyrecommended.Ideally,studentsshouldhaveapproximately isexaminedfromadatabaseperspectivethroughaprocessof 6monthstoayearofdatabaseworkingknowledge. describingthethreatandattackmechanisms,recognizing Related Courses – Suggested Learning Path associatedvulnerabilities,and,finally,designing,implementing,and testingeffectivedefenses.Multiplepracticaldemonstrations reinforcetheseconceptswithrealvulnerabilitiesandattacks. TakeInstead:Weofferothercoursesthatprovidedifferentlevels Studentsarethenchallengedtodesignandimplementthelayered ofknowledgeorfocus:  defensestheywillneedindefendingtheirowndatabases. ForahighlevelviewoftheSTIGSandrelatedissues,consider TT8800InformationAssurance(STIG)Overview  Workinginadynamiclearningenvironmentattendeeswilllearnto: Foranapplicationorientation,consider:TT8810Application Understandtheconsequencesfornotproperlyhandling SecurityandDevelopment(STIG)  untrusteddatasuchasdenialofservice,cross‐sitescripting, Forahighlevelviewofwebapplicationsecurityandrelated andinjections issues,considerTT8020UnderstandingWebApplication Beabletoreviewandtestdatabasestodeterminethe Security  existenceofandeffectivenessoflayereddefensesand Forin‐depthdevelopertrainingforwebapplicationswiththe requiredchecks lifecycleaspect,consider:TT8325SecuringWebApplications   Preventanddefendthemanypotentialvulnerabilities Forin‐depthdevelopertrainingwithlesswebapplication associatedwithuntrusteddata orientation,consider:TT8200‐JSecureJavaCoding(also Understandtheconceptsandterminologybehindsupporting, offeredfor.netorotherlanguages) designing,anddeployingsecuredatabases Appreciatethemagnitudeoftheproblemsassociatedwith TakeAfter:Weofferavarietyofintroductorythroughadvanced datasecurityandthepotentialrisksassociatedwiththose security,development,projectmanagement,engineering, problems architectureanddesigncourses.Studentsmaywanttoconsider  thefollowingtopicsasfollow‐ontothiscourse. Understandthecurrentlyacceptedbestpracticesfor  supportingthemanysecurityneedsofdatabases. TT8150MasteringSecureSOA  Understandthevulnerabilitiesassociatedwithauthentication TT8600SecureSoftwareDesign  andauthorizationwithinthecontextofdatabasesand Additionaladvanced SecurityorSecureProgrammingtopics  databaseapplications Service‐OrientedAnalysisandDesign   UnderstandthedangersandmechanismsbehindCross‐Site WebServices–IntrothroughAdvanced Scripting(XSS)andInjectionattacks SoftwareEngineering,DesignorProjectManagementtracks Performbothstaticreviewsanddynamicdatabasetestingto uncovervulnerabilities Pleasenotealldevelopmentcoursesmayalsobeofferedinother Designanddevelopstrong,robustauthenticationand programminglanguagesortailoredtosuityourunique authorizationimplementations requirements.Pleasecontactusfordetails.Pleasecontactusfor  recommendednextstepstailoredtoyourlonger‐termeducation, UnderstandthefundamentalsofEncryptionaswellashowit canbeusedaspartofthedefensiveinfrastructurefordata projectordevelopmentobjectives. Delivery Environment: Tools to Use Thisclassis“technology‐centric”,designedtotrainattendeesin essentialsecuredatabaseskills,couplingthemostcurrent,effective Althoughthistrainingisskills‐centric,thiscoursecanbedelivered techniqueswiththesoundestindustrypractices. oneofavarietyofdatabaseproducts.Pleaseinquirefordetailsand Thecourseprovidesasolidfoundationinbasicterminologyand options. concepts,extendedandbuiltuponthroughouttheengagement. Studentswillexaminevariousrecognizedattacksagainstdataand Student Materials: What You’ll Receive databases.Processesandbestpracticesarediscussedand illustratedthroughbothdiscussionsandgroupactivities. Ourrobustcoursematerialsincludemuchmorethanasimple Copyright © 2009 Trivera Technologies LLC Worldwide.| CollaborativeIT Training, Mentoring & Courseware Services TT8820_Database_Security_STIG_20090803 | Page2www.triveratech.com |[e-mail]

TriveraTechnologiesBestDefense™ApplicationSecurityTrainingSeries slideshowpresentationhandout.Studentmaterialsincludea comprehensivehard‐copycoursemanual,completewithdetailed coursenotes,codesamples,diagramsandcurrentreference materials,alldirectlyrelatedtothecourseathand,indexedfor easeofuse.Step‐by‐steplabinstructionsandprojectdescriptions areclearlyillustratedandcommentedformaximumlearning. Inadditiontoeverythingstudentsneedforthecourse,thecourse includesworkshopdemonstrations;non‐restrictedworkshop software,APIs,documentation,technicaleducationpapers,and specificationsandtutorialspertinenttothetrainingcourse.Our coursekitsaredesignedtoserveasanexcellentanduseful referenceset,longafterweleaveyourclassroom. Optional Pre / PostTesting & Skills Assessment Weworkwithyoutoensurethatyourresourcesarewellspent. Throughourbasiccoursepre‐testingand/orpost‐course assessments,weensureyourteamisuptothechallengesthatthis courseoffers.Ourgoalistostructurethebestsolutiontoensure yourneedsaremet,whetherwecustomizethematerial,ordevise adifferenteducationalpathtoprepareforthiscourse. Pleasecontactusfordetailsaboutouronlinepreandposttest

Session:Foundation Misconceptions ‐ThrivingIndustryofIdentify Theft ‐DishonorRollofDataBreaches ‐TJX:AnatomyofaDisaster ‐Heartland:What?Again? SecurityConcepts ‐TerminologyandPlayers ‐Assets,Threats,andAttacks ‐OWASP ‐CWE/SANSTop25Programming Errors DISA’sSecurityTechnical ImplementationGuides(STIGS) ‐Purpose ‐Process ‐AreasCovered ‐Checklists ‐Scripts(SRRs) ‐Resources SecurityConcernsCommontoall DBMSs ‐Authentication ‐Authorization ‐Confidentiality ‐Integrity ‐Auditing ‐Replication,Federation,and Clustering ‐BackupandRecovery

assessmentservices,custommanagedtrainingplansforone studentoryourentireorganization,orourcustomonlinetraining programmanagementsystemformonitoringthecoursesor progresswhileskillingyourstudentsofallexperiencelevels.  Bridging the Gap: Collaborative Mentoring Services Ourteamoftechnicalexpertsisalsoavailableforvariousproject assistanceservicestohelpyourteamapplytheirnewly‐learned classroomskillstotheirreal‐worldprojectinameaningful,practical way,rightafterthetrainingends. Ourcustomcollaborativementoringprogramsintegratewithor extendyourteam’sclassroomtrainingexperience,tohelpbring theseskillsintoexisting(orinherited)legacyprojects,intonew projects,ortosimplykeepyourstudentssharptheminbetween projects.Ourprogramscanbehighlyinvolvedandclosely integratedwithyourprojecttimelinesorgroupdevelopment efforts,orcanbelessinvolved,servingsimplyasanoverarching educationalframeworkor‘spotcheck’tokeepyourgroupskills movingforwardinbetweenprojectsorwaitingforprojectsto begin.Pleasecontactusfordetailsaboutthisexcitingcustom service.

Workshop Topics Covered ‐OS,Application,andNetwork Components Defensive Principles ‐SecurityIsALifecycleIssue ‐MinimizeAttackSurface ‐ManageResources ‐ApplicationStates ‐Compartmentalize ‐DefenseInDepth‐Layered Defense ‐ConsiderAllApplicationStates ‐NotTrustingTheUntrusted ‐SecurityDefectMitigation ‐LeverageExperience Reality ‐Recent,RelevantIncidents ‐FindSecurityDefectsInDBMSs Session:TopDatabaseSecurity Vulnerabilities UnvalidatedInput ‐SourcesofUntrustedInput ‐TrustBoundaries ‐DesigningandImplementing Defenses BrokenAuthentication ‐QualityofPasswords ‐ProtectionofPasswords ‐HashingPasswords ‐ProtectingAuthenticationAssets ‐SystemAccountManagement

‐UserAccountManagement BrokenAccessControl ‐GainingElevatedPrivileges ‐CompartmentalizationBasedon LevelofPrivilege ‐SpecialPrivilegesProvidedby DatabaseandSystems ‐ProtectingSpecialRoles CrossSiteScripting(XSS/CSRF)Flaws ‐WhatandHow ‐RoleofDatabasesinEnabling XSS ‐DesigningandImplementing Defenses Injection Flaws ‐WhatandHow ‐SQL,PL/SQL,XML,andOthers ‐StoredProcedures ‐BufferOverflows ‐DesigningandImplementing Defenses ErrorHandlingandInformation Leakage ‐WhatandHow ‐FourDimensionsofError Response ‐ProperErrorHandlingDesign InsecureHandling ‐DataatRest ‐DatainMotion ‐Encryption

Copyright © 2009 Trivera Technologies LLC Worldwide.| CollaborativeIT Training, Mentoring & Courseware Services TT8820_Database_Security_STIG_20090803 | Page3www.triveratech.com |[e-mail]

TriveraTechnologiesBestDefense™ApplicationSecurityTrainingSeries ‐CompartmentalizationBasedonPracticesBestPractices  LevelofPrivilege EnclaveBoundaryDefensesGenericDatabaseChecksand  ‐BackupsandArchives ContinuityofService Procedures  ‐ConnectionStringsandHigh  ‐DefendingBackup/RestorationSQLServerChecksandProcedures ValueServer‐SideCredentials Assets(Optional) ‐DesigningandImplementing  ‐DataandSoftwareBackups ‐InstallationChecks Defenses  ‐TrustedRecovery ‐DatabaseChecks   InsecureManagementof VulnerabilityandIncidentOracleChecksandProcedures Configuration Management(Optional) ‐InitialInstallation ‐DatabaseAutomatedChecks ‐PatchManagement Session:SecureSoftwareDevelopment‐DatabaseInterviewChecks ‐ServerHardening (SSD)‐DatabaseManualChecks ‐OperatingSystemHardening SSDProcessOverview  ‐DatabaseVerifyChecks ‐ConnectionHardening Asset,Boundary,andVulnerability  ‐HomeAutomatedChecks ‐ReplicationHardening Identification  ‐HomeInterviewChecks ‐BestPractices  ‐HomeManualChecks Process,Design,andCodeReviews DirectObjectAccess  ‐HomeVerifyChecks ApplyingProcessesandPractices ‐WhatandHow   PracticalApplicationoftheChecklists ConfigurationSpecificationand ‐RoleofDatabasesinEnabling Compliance Access  __________________________________ SoftwareandDataBaselines ‐HighRiskPracticestoAvoid TestingasLifecycleProcess Needmoredetails?Pleasenotethata TestingPlanningandDocumentation Session:STIGDatabaseSecurity moredetailedoutlineofthecoursetable TestingToolsAndProcesses Requirements ofcontents,listsoflabexercisesand ‐Principles IdentificationandAuthentication projectdescriptionsisavailable.Please ‐Reviews ‐GroupandIndividual [e-mail] ‐Testing ‐KeyManagementPractices forinfo. ‐Tools ‐TokenandCertificatesPractices StaticandDynamicAnalysis Enclave/ComputingEnvironmentNeedcourseware?Thiscourseisfully TestingPractices ‐AuditingMechanicsandBestcustomizable,andalsoavailablefor ‐AuthenticationTesting Practiceslicensewithcompletesupportforqualified ‐DataValidationTesting ‐DataChangesandControlsorganizations.Pleasecontact ‐DenialOfServiceTesting ‐[e-mail]. ‐PrivilegeManagement Session:DatabaseChecklists ‐AdditionalControlsand ChecklistOverview,Conventions,and _____________________________________________________________________________________________________________________ Why Work With Trivera Technologies? Whetheryouareaprojectleaderchoosingatrainingproviderorcoursetobringtoyourteam,oranorganizationoraninstructorlookingto potentiallylicenseorusecoursematerialstotrainyourownteam,orastudentlookingforanexciting,targetedtrainingclasstoattendorto recommendtoyourcolleagues‐OursinglefocusistomakeYOURtrainingeventorexperienceasuccess.Here’swhychoosingTrivera TechnologiesasyourITsecurityeducationresourcetakestheriskrightoutofyourdecisionmakingprocess… Weprovideasolidsecure,design,codingandimplementationfoundation.Studentswilllearnhowtocode,use(andreuse!)essential secureJavaprogramminganddesignskillsandconceptsproperly,usingbestcodingpractices,groundingthemforadvancedcurriculum,and willbepreparedfordesigningandimplementingsolutions.Studentswilllearntheimportanceofdevelopingwell‐defendedapplications. Ourcoursesarefocused‐no"fluff"included.Weoffermorethana“laundrylist”approachtoteaching.Alllessonshaveclearobjectives, arefundamentaltocoresecureapplicationdevelopmentanddesignpractices,andarereinforcedbyhands‐onlabsandsolidpractical examples.Eachlessonhasperformancedrivenobjectivesthatensurestudentswilllearntechnologiesandskillscoretofundamentalserver‐ sideapplicationdesign–nothingmore,nothingless. Ourmaterialsarecomprehensive,andcurrent.Ourcomprehensivemanualsincludenotonlyahardcopyofthecoursepresentation,but alsodetailedreferencenotes,pertinentdiagramsandcharts,currentlistsofsuggestedonlineresourcesandarticles,andoftentechnical tutorialsorwhitepapersgearedtothetopicsathand.Ourdedicatedcoursedevelopmentteamkeepseverythingascurrentaspossiblewith bothindustrytrendsandsoftwareeditionstoensureyourteamisgettingthemostcurrentinformationavailable. Wefoster"LearningbyDoing".Progressivelabsaredesignedinsuchawaythatstudentsgetafirmgrasponfundamentalskillswhilethey worktowarddesigningacompleteapplication.Alllabsaretake‐home,andallsolutioncodeispresentedinaneasytouseself‐studyformat

Copyright © 2009 Trivera Technologies LLC Worldwide.| CollaborativeIT Training, Mentoring & Courseware Services TT8820_Database_Security_STIG_20090803 | Page4www.triveratech.com |[e-mail]