Surviving Your Next Data Breach

It happens even to tech giants: they get hacked, and client databases get leaked. Let’s look at what data is the most sensitive and what steps we can take to protect it, while still keeping all of the user experience intact. Come see why most web applications do passwords and credit card information wrong.

Transcript

1. @afilina Surviving Your Next Data Breach php[tek], Atlanta - May 24, 2017
2. You will get hacked
3. It Happens • Dropbox • Adobe • LinkedIn • Yahoo! 68 million 152 million 164 million 1.2 billion
4. Anna Filina • Project rescue expert • Dev, trainer, speaker
5. Way to Get Breached • Hackers • Employees • $5 consultants
6. $5 consultants?!
9. Don't use server passwords Use SSH keys
10. Zero-out development data
11. Background security checks
12. Sensitive Data • Passwords • Credit cards • Social security numbers • Current locations • IP addresses • ...
13. Getting Ready for the Breach • Store less • Make stolen data useless • Post-breach procedures
14. Store less sensitive data
15. $5,000 - $100,000 per month
16. But... recurring billing!
18. Vault Credit card Token Amount + token App Payment gateway User
19. **** **** **** 0123
20. Sessions!
22. Vault Credit card Token Amount + token App Payment gateway User
23. **** **** **** 0123 Edit
24. Implementation Effort? • ~5 hours • Includes reading documentation
25. Alternative Storage • Comments
26. Please charge half on 
 4111 1111 1111 1111 
 (06/17) and the other half on
 4012 8888 8888 1881
 (10/19)
27. Passwords • No plaintext. • No hash.
28. Rainbow tables!
29. How do They Work? • Create string permutations • Compute hashes • Steal password hashes • Look up in table
30. Collisions • They are rare • Pick the shortest and more obvious • Can just try all matches on a site
31. Rainbow tables can be downloaded
32. What Then? • Salted hash • Repeated hashing
33. Repeated Hashing +salt + hashing Hash Password Hash +salt + hashing x20,000
34. bcrypt
35. Password Policy • Don't limit number and type of characters • Harder to generate rainbow tables • Also prevents brute force
36. Security Questions • Known by a wide group of people • You're storing more private data • Security questions on other sites
37. Response plan
38. Example Procedure • Log out. • Mark as compromised (is_dirty=1). • Force 2nd factor auth. • Force password change. • Mark as not compromised.
39. 2FA • 1-time code (e-mail, SMS) • Time-synchronized 1-time password
40. Next Steps • What else do you not need? • E-mails?
41. Let's protect private data
42. @afilina afilina.com