The GIAC Web Application Defender (GWEB) certification is designed for professionals seeking to master web application security. It validates your ability to handle common web application errors, understand authentication and access control, and implement robust security measures.
Who Should Pursue GWEB?
- Application developers
- Application security analysts or managers
- Application architects
- Penetration testers
- Security professionals
- Auditors
- Employees of PCI-compliant organizations
Key Areas Covered
- Access Control: Understand and mitigate access control attacks.
- AJAX Technologies: Secure applications using AJAX.
- Authentication: Implement and test secure web authentication.
- Cross Origin Policy Attacks: Prevent attacks circumventing single origin policy.
- CSRF: Mitigate Cross-Site Request Forgery attacks.
- Encryption: Protect sensitive data in transit and storage.
- File Upload and Defense: Handle file uploads and incident response.
- Input Validation: Prevent SQL injection, XSS, and other input-related flaws.
- Modern Frameworks and Serialization: Address security in REST, Java frameworks, and serialization.
- Session Security: Secure session tokens and cookies.
- Web Architecture and Configuration: Secure servers and services hosting web applications.
- Web Services Security: Protect Service-Oriented Architecture components.
Exam Format
- Proctored Exam: Remote or onsite proctoring.
- 75 Questions: 3 hours to complete.
- Passing Score: 68%
- Activation: Exam attempts are activated upon approval and payment, with 120 days to complete.
Additional Resources
- Training: Live or OnDemand options available.
- Practical Experience: Essential for mastering certification skills.
- Practice Tests: Simulate real exams to gauge preparation.
- Study Methods: Leverage various resources for comprehensive preparation.
Certification Benefits
- PCI DSS Compliance: Helps meet PCI DSS 6.5 requirements.
- Risk Reduction: Protect company reputation by mitigating security risks.
- Efficiency: Integrate security early in the development lifecycle to save resources.
Prepare for a successful career in web application security with the GWEB certification. Register now to validate your skills and safeguard your organization’s web applications.
Difficulty: 2 out of 5.
Employer paid for the training. I would NEVER pay out of pocket for this course (or perhaps any SANS course). There just isn't enough value.
I'm a software dev, so perhaps my expectations were off. Much of the content wasn't relevant given current development standards. I spent as much time setting up the labs as I did solving them. The whole VM environment setup just seemed like a bit much for someone taking this as a one-off course.
Maybe all SANS courses are like this, but it was 85% death by PowerPoint. I think I could have tabbed the books and passed the exam and saved myself 5.5 days of lecture.
