Strengthening Java Apps: Best Practices in Secure Coding for Java Developers
summary
Covers concrete risks and defenses: shows how dependency confusion and typosquatting let external jars slip into Maven builds (CI, Jenkins, Docker, SBOMs), cites repeated real-world waves causing “tens of thousands” of infections, points out the problematic default of checking outside repos. Recommends specific scanners (SonarQube, SpotBugs, Snyk), mutation testing over line coverage for safety, and runtime protections like RASP. Demonstrates stealth techniques—hex blobs, small commits, unicode bidi attacks—and contrasts static, dynamic, interactive testing and EPSS/CVSS use for prioritization.
AI-written summary · about
chapters (20)
- 0:00Introduction to secure coding
- 1:05Supply chain security overview
- 3:18Secure coding focus areas
- 8:39Salsa project explained
- 11:10OASP cheat sheet insights
- 14:06Input validation best practices
- 16:33Infection methods explained
- 20:04Dependency confusion attacks
- 23:38Typo squatting risks
- 25:25Malicious package threats
- 26:09Code obfuscation techniques
- 28:57Unicode attack vectors
- 30:43Secure payload examples
- 32:30Information leakage risks
- 35:00Application security testing
- 36:25CWE and CVSS explained
- 37:50Penetration testing importance
- 38:54TDD and security testing
- 39:57AI attack vectors overview
- 44:11Core attack vector management
related talks
52mShield your #Java Code Practical Guides for Trusted Software
48mThe Hidden Security Hazards in Your Java Stack
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application
49mAn overview of available opensource tools to secure your Java code
56mHow to avoid vulnerabilities and adopt security best practices?
54mSecure Software Development
49mThe Anatomy of Java Vulnerabilities
38mMother Nature vs Java – the security face off