Rails Security TL;DR

Presentation that I gave to the Ruby and Rails Melbourne meetup. Super condensed version of the Rails security training that I give.

I only had 20 minutes to give this which was definately not long enough to cover everything.

Transcript

1. Rails Security TL;DR @akampjes a@kampj.es
3. “No-one said it had to be secure”
5. Your boss will care (l8a) Compliance (PCI zzzzz) Cost savings
6. Because it’s fun and interesting
7. The Gartner Group estimates that 75% of attacks are at the web application layer, and found out: "that out of 300 audited sites, 97% are vulnerable to attack".
8. Security is really HARD
9. Github
11. CIA triad
12. Confidentiality Personal data Company data
13. Integrity Trustworthy Correct
14. Availability Uptime
15. Direct Object Reference
17. http://foo.com/page?invoice=12345
18. Computers are fast
19. Don’t write this code: raise "nope" unless order.user == current_user
20. Use pundit, cancan etc. https://www.ruby-toolbox. com/categories/rails_authorization
21. Bonus: Use UUID for pkeys 128bits == BIG
22. Mass Assignment
23. Mymodel.update(params)
24. Github
25. @key = PublicKey.find(params[:id]) @key.update(params[:public_key]) # Oh no! We passed public_key[user_id] of our victim!
26. <input value=USER_ID name=public_key[user_id]>
27. strong params attr_accessable
28. params.permit! :’(
29. Cross Site Scripting (XSS)
30. Running scripts on user’s computer
31. message posts, user comments, guest books, project titles, document names, search, urls, server headers, banner ads
32. <script>alert(1)</script>
33. Can do anything that the user can do
34. Old rails (2ish) you had to remember to escape. Each. Fucking. Input.
35. html_safe() raw() h()
36. SQL Injection
37. http://rails-sqli.org/
38. Sessions
39. Defaults to Cookiestore
40. SerializedObjects+HMAC (pre-rails4)
41. Sensitive data
42. Encrypt(SerializedObjects)+HMAC (rails4+)
43. Replay attack
44. No Server Side logout
45. Deserialisation Woes
46. Don’t use Cookiestore...
47. ...don’t trust data in session
48. Alternatives: CacheStore ActiveRecordStore MemCacheStore
49. Finally
50. “Don't put off until tomorrow what you can do today” Ben Franklin on updates
51. bundler-audit https://gemcanary.com/ https://gemnasium.com/
52. manual: Code Review automated: Brakeman
53. Test recovering from an incident
54. Moar resources
55. • http://guides.rubyonrails.org/security. html • https://www.owasp.org/index. php/Top_10_2013-Top_10 • http://railssecurity.com/ • http://www.happybearsoftware. com/rails-security-fundamentals • https://github.com/cktricky/railsgoat
56. Hire me to train your developers, yo
57. Contact me, questions, comments @akampjes a@kampj.es