Web App Security

Transcript

1. Don’t forget about Security In web applications
2. Cheers from Italy
3. Alessandro Classic Developer Saw Star Wars false true Saw Star Trek false true Gamer false true Drinks coffee false true Drinks beer true true Has beard true true ~2 meters tall true false
4. 73% Web application attacks accounted for 73% of all incidents says report
5. “At some point in the history of your company, you’re probably going to get hacked.” - Heather Adkins, director of security at Google “There are only two types of companies: those that have been hacked, and those that will be.” - Robert Mueller, FBI Director
6. OWASP Top 10 Most Critical Web Application Security Risks 1. Injection 2. Broken Authentication and Session Management 3. Cross-Site Scripting (XSS) 4. Insecure Direct Object References 5. Security Misconfiguration 6. Sensitive Data Exposure 7. Missing Function Level Access Control 8. Cross-Site Request Forgery (CSRF) 9. Using Components with Known Vulnerabilities 10. Unvalidated Redirects and Forwards
7. Application Security is ignored or underrated • Complex topic • Difficult to sell • “I never had any security incident” ™
8. “We have our own security system, and it has never been breached in more than 15 years” - oilandgasinternational.com
9. Oilandgasinternational.com, 10 minutes later
10. App level Security is developer responsibility
11. “I am secure by default” - Rails
12. “Show me the code” - anyone
13. One line of code… what can go wrong?
14. WARNING: Very advanced hacker skills > brew install sqlmap > sqlmap --dump --url= "http://localhost:3000/ilike_search?search_term=rails"
15. 5 minutes later… complete_database_dump.csv
17. gem install brakeman
18. gem install bundler-audit
19. How to be better at security • Have a black hoodie • Have basic security knowledge • Know some tools • Have a plan for responding to incidents • Have a security contact page
20. Bonus: Security is fun!!! • Hacking labs • Challenges • Capture the flag • Example: root-me.org