OWASP Top 10:2025 – Web Application Security

Deskripsi

Pelatihan OWASP Top 10:2025 – Web Application Security dirancang untuk memberikan pemahaman praktis mengenai risiko keamanan aplikasi web yang paling kritis berdasarkan OWASP Top 10:2025.

Peserta akan mempelajari konsep vulnerability, attack scenario, teknik identifikasi, impact assessment, serta rekomendasi mitigasi dari setiap kategori OWASP Top 10. Pelatihan juga dilengkapi dengan studi kasus dan praktik pengujian keamanan aplikasi web.

OWASP Top 10 merupakan dokumen awareness yang digunakan sebagai salah satu dasar untuk meningkatkan keamanan aplikasi dan secure software development lifecycle.

Target Peserta

Web Developer
Software Engineer
QA / Software Tester
Security Engineer
Penetration Tester
DevOps Engineer
System Analyst
IT Security Professional
Mahasiswa dan pemula di bidang Application Security

Prasyarat

Peserta disarankan memiliki pemahaman dasar mengenai:

HTTP dan HTTPS
Web application
HTML, JavaScript, dan REST API
Basic database dan SQL
Basic Linux command line

Materi Pelatihan

Module 1 – Introduction to Application Security

Konsep Application Security
Web application attack surface
Vulnerability, threat, risk, dan impact
Secure Software Development Lifecycle
OWASP dan OWASP Top 10
Cara menggunakan OWASP Top 10 sebagai baseline security awareness

Module 2 – A01:2025 Broken Access Control

Authentication vs Authorization
Horizontal privilege escalation
Vertical privilege escalation
IDOR / BOLA
Missing function-level authorization
Access control bypass
Mitigation dan secure authorization design

Module 3 – A02:2025 Security Misconfiguration

Default configuration
Exposed administrative interface
Debug mode
Improper security headers
Directory listing
Error message information disclosure
Cloud dan server misconfiguration
Secure configuration management

Module 4 – A03:2025 Software Supply Chain Failures

Third-party dependencies
Open-source components
Dependency vulnerabilities
Package management security
Software Bill of Materials (SBOM)
Dependency scanning
Supply-chain attack
Secure software supply chain

Module 5 – A04:2025 Cryptographic Failures

Encryption vs hashing
Sensitive data exposure
Weak cryptographic algorithms
Password storage
TLS/HTTPS
Key management
Secrets management
Secure cryptographic implementation

Module 6 – A05:2025 Injection

SQL Injection
Command Injection
Cross-Site Scripting (XSS)
LDAP Injection
NoSQL Injection
Injection attack flow
Parameterized queries
Input validation
Output encoding

Module 7 – A06:2025 Insecure Design

Secure by Design
Threat modeling
Attack surface analysis
Business logic vulnerabilities
Abuse cases
Security requirements
Secure architecture
Defense-in-depth

Module 8 – A07:2025 Authentication Failures

Authentication weaknesses
Brute force
Credential stuffing
Password policy
Session management
Multi-factor authentication
Password reset security
Account lockout and rate limiting

Module 9 – A08:2025 Software or Data Integrity Failures

Software integrity
Data integrity
Insecure deserialization
CI/CD security
Untrusted software updates
Code signing
Integrity verification
Secure deployment pipeline

Module 10 – A09:2025 Security Logging and Alerting Failures

Security logging
Audit trails
Security monitoring
Detection and alerting
Failed authentication monitoring
Suspicious activity detection
Log integrity
SIEM integration
Incident response

Module 11 – A10:2025 Mishandling of Exceptional Conditions

Improper error handling
Unexpected application states
Fail-open vs fail-closed
Exception handling
Information leakage through errors
Resource exhaustion
Secure error handling
Resilience and defensive programming

Practical Lab

Peserta akan melakukan hands-on security testing pada vulnerable web application.

Practical exercise meliputi:

Identifikasi Broken Access Control
Testing authentication mechanism
SQL Injection testing
XSS testing
Security misconfiguration assessment
Dependency vulnerability assessment
Session security testing
Security logging assessment
Error handling assessment
Penyusunan vulnerability finding

Tools yang Digunakan

Burp Suite
OWASP ZAP
Nmap
Browser Developer Tools
cURL
SQLMap
Nikto
Dependency Scanner

Learning Outcomes

Setelah menyelesaikan pelatihan, peserta diharapkan mampu:

Memahami OWASP Top 10:2025
Mengidentifikasi vulnerability pada aplikasi web
Memahami attack vector dan potential impact
Melakukan basic security testing
Menentukan severity vulnerability
Memberikan rekomendasi remediation
Menerapkan secure coding principle
Memahami application security dari sisi developer maupun security tester

Durasi

2 Hari / 14 Jam

Day 1

Introduction to Application Security
A01 Broken Access Control
A02 Security Misconfiguration
A03 Software Supply Chain Failures
A04 Cryptographic Failures
A05 Injection
Hands-on Lab

Day 2

A06 Insecure Design
A07 Authentication Failures
A08 Software or Data Integrity Failures
A09 Security Logging and Alerting Failures
A10 Mishandling of Exceptional Conditions
Web Security Assessment Lab
Final Assessment

Metode Pembelajaran

Instructor-led training
Presentation
Case study
Demonstration
Hands-on laboratory
Vulnerability assessment
Group discussion
Final assessment

Sertifikat

Peserta yang menyelesaikan seluruh sesi pelatihan dan final assessment akan mendapatkan Certificate of Completion.

Level

Intermediate

Kategori

Cybersecurity / Application Security / Web Security

Referensi

OWASP Foundation – OWASP Top 10:2025.

Versi terbaru OWASP Top 10:2025 terdiri dari: A01 Broken Access Control, A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging and Alerting Failures, dan A10 Mishandling of Exceptional Conditions.