Software Architecture and Clean Code Design in OOP

From this lecture you will learn:

• Where to find good tests to verify your knowledge

• How to get unlimited access to Learn IT application (only for my students from Udemy)

From this lecture you will learn:

• What are SOLID principles

• SOLID principles in OOP

• Single responsibility principle

From this lecture you will learn:

• Open / closed principle

• Code examples

From this lecture you will learn:

• Liskov substitution principle

• Code examples

From this lecture you will learn:

• Interface segregation principle

• Code examples

From this lecture you will learn:

• Dependency inversion principle

• Code examples

The Quiz covers content from the following lessons:

• SOLID principles overview & Single Responsibility Principle

• Open / Closed principle

• Liskov substitution principle

• Interface segregation principle

• Dependency inversion principle

• What is a clean architecture

• What is a coupling

• Types of a coupling

• What is a cohesion

• Types of a cohesion

• Benefits of Clean Architecture

• Plugin concept

• Why do we need clean architecture

• Advantages and disadvantages of clean architecture

• Tell, don’t ask principle

• How to apply ‘Tell don’t ask’ in real life

• What is data structures

• Objects VS Data structures

• Getters and Setters in objects

• When to use data structures

• What is Law of Demeter

• Goals

• Exception from law

• Pros & Cons

• Code Examples

• KISS Principle - Definition

• Variants of KISS in Software Development

• Key Concepts of KISS

• Why Use KISS Principle / Benefits

• How to Apply KISS Principle

• Case Studies of KISS Principle

• Code Examples of KISS Principle

• YAGNI Principle - Definition

• Why Use YAGNI Principle / Benefits

• How to Apply YAGNI

• Case Studies of YAGNI Principle

• Code Examples of YAGNI Principle

• YAGNI Principle VS KISS Principle - Key Differences

• DRY Principle - Definition

• Why Use DRY Principle / Benefits

• How to Apply DRY

• Contrasting Concepts - WET & AHA

• Case Studies of DRY Principle

• Code Examples of DRY Principle

• Problem statement

• Why do we need a good structure

• How to establish good code structure

• Factors to consider during the code grouping

• Cohesion Principles

• Common closure principle

• Common reuse principle

• Reuse-release equivalence principle

• Coupling principles

• Acyclic dependencies principle

• Stable dependencies principle

• Stable abstractions principle

• Package by layer

• Package by feature

• Conway's law

• How technical factors impact code structure

• Tools for code analysis

• Why do we need design patterns

• What are GoF patterns

• Key points of GoF patterns

• Creational Patterns: Overview

• Structural Patterns: Overview

• Behavioral Patterns: Overview

• Class & Object Patterns

• What patterns we are going to learn in this course

• Answers to most common questions of my students

• Singleton

• Prototype

• Factory Method

• Builder

• Abstract Factory

• Factory Method VS Abstract Factory

• Proxy

• Decorator

• Adapter

• Façade

• Comparative Analysis

• Bridge

• Flyweight

• Composite

• Strategy Pattern

• Command Pattern

• Strategy VS Command

• Template Method

• Iterator

• Chain of responsibility

• Visitor

• Visitor VS Decorator

• State

• Observer

• Memento

• Interpreter

• Mediator

From this lecture you will learn:
• What is TDD

• TDD Cycle - main steps of TDD iteration

• Three laws of TDD

• Test-first approach VS TDD

• Testing pyramid and TDD

• Defect cost increase

• Pros of using TDD

From this lecture you will learn:

• BDD and its history.

• TDD VS BDD

• Gherkin DSL

• How to create BDD scenarios

• How to apply BDD knowledge on practice for software developer

• Advantages and Disadvantages of BDD

• Acceptance test-driven development

• ATTD VS TDD VS BDD

In this lesson we will implement application with the help of TDD approach.

• Why we need databases

• Purposes & Advantages of databases

• Database VS DBMS

• Types of databases

• Relational databases

• Non-Relational databases

• Examples of relational, NoSQL and other databases

• Document-oriented databases

• Key-value storages

• Graph databases

• Wide column databases

• Object-oriented databases

• Hierarchical databases

• Time series databases

• Column-oriented databases

• Cloud databases

• Centralized and Distributed Databases

• Pros and cons of different types of database

• Overview of the most popular relational database management systems

• MySQL Overview

• Main Features of MySQL

• MySQL Server installation

• MySQL Workbench Installation

• MySQL Shell installation

• Creation of root user in MySQL

• Connecting MySQL Server to MySQL Workbench

• Windows Service for MySQL

• Basic terms (table, entity, attribute, tuple, record, etc)

• Database VS Schema

• Primary key

• How to choose primary key

• Simple VS compound primary key

• Natural VS surrogate primary key

• Alternate key

• Foreign key

• Relationship

• Types of relationships

• One-to-many relationship

• Many-to-many relationship

• One-to-one relationship

• MySQL Workbench interface

• Create schema

• Naming convention

• Character set

• Collation

• Create table

• Singular VS Plural for table names

• MySQL Storage Engines

• Which storage engine to choose

• Data types

• Column Properties

• Data model

• Database model

• Why data modelling is important

• Database design

• Data context

• Conceptual data model

• Logical data model

• Physical data model

• Referential Integrity

• Consequences of broken referential integrity

• Cascade Operations

• Foreign key constraint

• Remove foreign key constraint

• Data consistency

• Data integrity

• Data quality

• Data validity

• What are indexes

• Lookup table

• Why we need indexes

• What does indexing do

• Index types

• Primary index (dense and sparse)

• Secondary index

• Clustering index

• Multilevel index

• B-tree

• How to create and remove indexes in database

• Advantages of indexing

• Disadvantages of indexing

• Data Anomalies

• Insertion anomaly

• Update anomaly

• Deletion anomaly

• Dependency theory

• Normalization

• Normal forms with Examples

• Denormalization

• Problem statement

• What is DAO pattern

• DAO pattern elements

• DAO pattern sequence diagram

• What is DTO

• DAO live demo example

• MVC Pattern: Overview

• Controller

• Model

• View

• Advantages and Disadvantages

• MVC code examples

• Layered Architecture overview

• Why we need Layered Architecture

• Closed Layer concept

• Layers of Isolation

• Open Layer concept

• Code example of Layered Architecture

• Sinkhole anti-pattern

• Layered Architecture and Monolithic Architecture

• Advantages and Disadvantages of Layered Architecture

During this exam task we will improve our existing online shop to make it work with the relational database. Implementation should consider DAO pattern and building proper relationships between tables in the database and creating all necessary SQL statements to extract data required for business operations.

• Review Exam task

• Overview of the expected result

From Task #1 till Task #7 (inclusively)

From Task #8 till Task #13 (inclusively)

From Task #14 till Task #16 (inclusively)

• What is connection pool

• How does connection pool work

• Benefits of connection pool

• Different options how to integrate connection pool in the app

• Apache DBCP

• C3P0

• Hikari CP

• How to calculate required size of the connection pool

• Advantages of Tomcat Connection Pool

• JNDI: What it is and when to use

• Tomcat Connection Pool

• What is OWASP

• What is OWASP Top 10

• Why OWASP Top 10 is important

• OWASP Top 10 2021

• What is Common Weakness Enumeration (CWE)

• What are Common Vulnerabilities and Exposures (CVE)

• What is the Common Vulnerability Scoring System (CVSS)

• OWASP Top 10 2017 VS OWASP 2021

• What is Access Control

• Authorization VS Authentication

• Types of Access Control

• OAuth (Overview)

• JWT (Overview)

• What is Broken Access Control

• Impact

• Insecure ID Vulnerability

• Path Traversal Vulnerability

• Poison Null Bytes Attack

• Safelisting

• Client Caching Vulnerability

• Violation of the principle of least privilege

• Elevation of privilege

• Review Roles Management Approach

• How to prevent (including design solutions)

• Example of Attack Scenarios

• Cryptographic Failures: Overview

• The most common root causes

• Comparative analysis between OWASP Top 10 2017 & 2021

• Notable Common Weakness Enumerations

• Types of cryptographic failures

• Personal data VS Sensitive data

• Types of sensitive data

• Cryptographic Failure vs. Data Breach

• What leads to cryptographic failures

• Example of attack scenraios

• SQL Injections

• TLS & SSL

• HTTPS VS HTTP

• Enabling HTTPS on Tomcat web server

• Example of attack scenraios

• Password encryption practical exercise

• Passwords hashing

• Salted passwords

• Hashing algorithms (MD5, SHA, PBKDF2, BCrypt, and SCrypt)

• How to prevent cryptographic failures

• Injection Risk Category: Overview

• Fuzzing

• Notable Common Weakness Enumerations (CWEs)

• Impact

• Comparison of Injection in OWASP Top 10 2021 and 2017

• Injection Types

• Command Injection

• Cross Site Scripting

• Types of Cross Site Scripting

• SQL Injection

• JPA Injection

• NoSQL Injection

• XML: XPath Injection

• Log Injection

• How to prevent injection vulnerabilities

• Input Validation: Goals

• Input Validation: Strategies

• Input Validation: Techniques

• Insecure Design Overview

• Insecure Design VS Insecure Implementation

• Shift left security approach

• Notable CWEs

• What is secure design

• Threat Modeling

• Goal of threat modeling

• Threat Modeling Manifesto: Overview

• Threat Modeling Manifesto: Values

• Threat Modeling Manifesto: Principles

• Build a secure design process

• Business impact analysis

• Working with threat register

• Security controls

• Security design document

• Secure Design Process Metrics

• Example of Attacks

• How to prevent

• Overview

• Potential Impact

• Notable CWEs

• Security Misconfiguration in OWASP Top 10 2021 VS 2017

• Types of security misconfiguration

• Examples of real-life attacks

• Federated Architecture

• Security Hardening

• Zero Trust Security Model

• NIST 800-207

• Defense in Depth

• NIST 800-123

• Best Practices for System Hardening

• Example of Attacks - Demo

• How to prevent

• Overview

• Risk Factors

• Why it is hard to update outdated components

• Notable CWEs

• How attackers use vulnerable components

• Real-life example

• OWASP Top 10 2021 VS 2017

• Demo of dependency check plugin

• Vulnerability scanners

• How to prevent

• Overview

• Potential Impact

• Notable CWEs

• OWASP Top 10 2017 VS 2021

• How attackers exploit authentication failures

• Session fixation

• Cross-Site Request Forgery (CSRF)

• Execution After Redirect (EAR)

• Risk factors

• Multi-factor authentication (MFA)

• Review of different factors

• Session ID Entropy

• Examples of Attacks

• Credential stuffing

• Brute force access

• Session hijacking

• How to prevent

• Overview

• Potential impact review

• Common Weakness Enumerations

• OWASP Top 10 2017 VS 2021

• Examples of Attacks

• How to prevent

• What is logging and logs

• Overview of Security Logging and Monitoring Failures Category

• Potential Impact

• Risk Factors

• Challenges

• Log Management Tools

• Libraries for Logging in Java

• Notable Common Weakness Enumerations

• OWASP Top 10 2017 VS 2021

• Attack Examples

• How to Prevent

• Overview

• Trust relationships

• Risk factors

• Potential impact

• Types of SSRF

• OWASP Top 10 2017 VS 2021

• Capital One Incident: Overview

• SSRF Java Example

• Examples of Attacks

• How to prevent

Code examples demo: Problem & Solution - Online Shop Example

• Enforcing robust authorization mechanisms

• Continuous testing and validation of authorization logic

• Using Random Universally Unique Identifiers (UUIDs)

• Implementation considerations when integrating UUIDs into API ecosystems

• Securing the Business Logic Layer

• Implementing Zero-Trust Security Model

• How zero-trust principles mitigate BOLA vulnerabilities.

• Understanding Broken Authentication - Definition

• Common Misconceptions about API Authentication

• Authentication Mechanisms and Their Vulnerabilities

• Ease of detecting authentication issues with current methodologies.

• Connection with OWASP Top 10 Broken Access Control

• Distinguishing Between Authentication and Access Control

• How Broken Authentication Can Lead to Broken Access Control

• Examples of Interconnected Vulnerabilities and Exploits

• Causes of Broken Authentication

• Types of Attacks

• Technical Factors Contributing to Vulnerabilities

• Automated Attacks

• Poor Standards and Practices

• Lack of Protection Mechanisms

• Misimplementation of Authentication Mechanisms

• Case Studies

• Lessons Learned from Case Studies

• Impact and Consequences of Broken Authentication Vulnerabilities

• Best Practices for Mitigating Broken Authentication

• OAuth VS Open ID

• Real Life Code Example - Demo of Problem and Solution

• Timing Attacks and How to Avoid Them

• Online Shop: Practical Example Source Code Review

• Practical Example Source Code Review - Problem & Solution

• Definition and explanation of BFLA

• Difference between BFLA and Broken Object Level Authorization

• Root Causes of BFLA

• Attack Scenarios and Examples

• Potential Consequences of BFLA

• How to Detect BFLA

• Prevention Techniques for BFLA

Practical Example Source Code Review - Problem & Solution

• Definition of Unrestricted Access to Sensitive Business Flows

• Importance of understanding this vulnerability

• How UASBF differs from other API vulnerabilities

• How attackers exploit UASBF

• Common Scenarios and Examples

• Examples of Business Logic Abuse

• Challenges in detection and protection

• How to Address These Challenges

• Potential impacts on businesses

• Case Study Analysis

• Real-Life Example: Airline Ticketing Abuse

• Prevention and Mitigation - Business Layer

• Prevention and Mitigation - Engineering Layer

• Testing for UASBF

• Best Practices

• Definition and significance of API inventory management

• Common challenges in maintaining API inventories

• The role of proper inventory management in API security

• Discussion of Key Risks:

  • Exploitation of Vulnerabilities

  • Amplification of Risks

  • Cross-Compatibility Issues

• Real-World Examples of Security Breaches Due to Poor Inventory Management

• Legacy APIs and Their Challenges

• The Balance Between Backward Compatibility and Security

• Strategies for Effective API Inventory Management