Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Holistic InfoSec For Web Developers

Holistic InfoSec For Web Developers

Write the wiki URL on the board:
https://github.com/binarymist/HolisticInfoSec-For-WebDevelopers/
http://bit.ly/1BaOPF1

##############################################################
Keep Calm
##############################################################

A security solution can not be automated.
Some small pieces can be once you've understood the specific landscape you're dealing with.

##############################################################
Cat and Mouse
##############################################################

The reason why security can't be automated is because it's a game of cat and mouse.
The attackers vs the protectors.

Smart human minds often working together vs the developer mind
which most of the time isn't even thinking about how their system can be broken.

It's like thinking that software architecture (which is one of the most complex activities known to man) can be automated.
That we can take the human element out of it entirely.

Yes we can try and automate small sections that are repeatable.

Machines can not be trusted to think like humans, because they're not.

##############################################################
Mouse with Red Helmet
##############################################################

Machines are best at performing mundane & repeatable jobs.
This is not where security fits into the picture.

##############################################################
Mouse Dropp...

Kim Carter

May 27, 2015
Tweet

More Decks by Kim Carter

Other Decks in Technology

Transcript

  1. Requirements or design defect found via Product Backlog Item (PBI)

    collaboration Length of Feedback Cycle Cost Requirements or design defect found in Test Conditions Workshop Programming or design defect found via Pair Programming Programming defect found via Continuous Integration Programming or design defect found via Test Driven Development (T(B)DD) Requirements or design defect found via Stakeholder Participation Defect found via pair Developer Testing Defect found via Independent Review Requirements defect found via traditional Acceptance Testing Programming or design defect found via Pair Review Design defect found via traditional System Testing Programming defect found via traditional System Testing Security defect found via traditional external Penetration Testing
  2. Requirements or design defect found via Product Backlog Item (PBI)

    collaboration Length of Feedback Cycle Cost Requirements or design defect found in Test Conditions Workshop Programming or design defect found via Pair Programming Programming defect found via Continuous Integration Programming or design defect found via Test Driven Development (T(B)DD) Requirements or design defect found via Stakeholder Participation Defect found via pair Developer Testing Defect found via Independent Review Requirements defect found via traditional Acceptance Testing Programming or design defect found via Pair Review Design defect found via traditional System Testing Programming defect found via traditional System Testing Security defect found via Security Test Driven Development (STDD)
  3. 5: Identify Risks? Test condition workshop... Given When Then There

    are no items in the shopping cart Customer clicks “Purchase” button for a book which is in stock 1 x book is added to shopping cart. Book is held - preventing selling it twice. “ Customer clicks “Purchase” button for a book which is not in stock Dialog with “Out of stock” message is displayed and offering customer option of putting book on back order.
  4. 5: Identify Risks? Given When Then There are no items

    in the shopping cart User tries to downgrade TLS and the HSTS header is not sent by the server User should be redirected (response 301 status code) to the HTTPS site from the server “ User tries to downgrade TLS and the HSTS header is sent by the server User should be redirected to the HTTPS site from the browser (no HTTP traffic for sslstrip to tamper with) Test condition workshop...
  5. 5: Identify Risks? Injection TLS Downgrade D-DOS? Easy to execute.

    Tricky to mitigate People in need of education
  6. 5: Identify Risks? Injection TLS Downgrade D-DOS? Easy to execute.

    Tricky to mitigate People in need of education Buffer Overflows
  7. 1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What

    risks does solution cause? 5: Costs and Trade-offs
  8. 1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What

    risks does solution cause? 5: Costs and Trade-offs
  9. 1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What

    risks does solution cause? 5: Costs and Trade-offs
  10. 5: Identify Risks? 2: Identify Risks Likelihood Threat Agent Factors

    • Skill level • Motive • Opportunity • Size
  11. 5: Identify Risks? 2: Identify Risks Likelihood Vulnerability Factors •

    Ease of discovery • Ease of exploit • Awareness • Intrusion detection
  12. 5: Identify Risks? 2: Identify Risks Impact Technical Factors •

    Loss of confidentiality • Loss of integrity • Loss of availability • Loss of accountability
  13. 5: Identify Risks? 2: Identify Risks Impact Business Factors •

    Financial damage • Reputation damage • Non-compliance • Privacy violation
  14. 1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What

    risks does solution cause? 5: Costs and Trade-offs
  15. 1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What

    risks does solution cause? 5: Costs and Trade-offs
  16. 1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What

    risks does solution cause? 5: Costs and Trade-offs
  17. 1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What

    risks does solution cause? 5: Costs and Trade-offs