Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Nuclear powered software securty
Search
carnage
July 01, 2017
Technology
0
360
Nuclear powered software securty
carnage
July 01, 2017
Tweet
Share
More Decks by carnage
See All by carnage
Object re-orientation
carnage
2
440
Event Driven Development
carnage
0
520
More Secrets of Cryptography
carnage
0
350
Microservices vs The distributed monolith
carnage
1
2.1k
Passwords and how to handle them
carnage
0
300
A storm is brewing
carnage
0
85
The secrets of cryptography
carnage
0
130
The secrets of cryptography
carnage
0
130
You attended talk: An introduction to event sourcing (short)
carnage
0
560
Other Decks in Technology
See All in Technology
フロントエンド・オブザーバビリティを支える要素技術を学ぼう
sadnessojisan
2
190
なぜクラウドサービスで Web コンソールを提供するのか
shuta13
4
2k
2024年のナビゲーション・フォーカス対応:Composeでキーボード・ナビゲーションをサポートしよう
tahia910
0
110
『GRANBLUE FANTASY Relink』キャラクターの魅力を支えるリグ・シミュレーション制作事例
cygames
0
110
効果的なオンコール対応と障害対応
ryuichi1208
6
3.1k
LINEヤフーのフロントエンド組織・体制の紹介
lycorp_recruit_jp
1
1.2k
Analytics-Backed App Widget Development - Served with Jetpack Glance
miyabigouji
0
590
JEP 480: Structured Concurrency
aya_ebata
0
130
とあるOSSを継続可能にするための取り組みについて / OSS Refactoring Process
bun913
1
200
事前準備が肝!AI活用のための業務改革
layerx
PRO
1
380
Privacy Sandbox on Android / DroidKaigi 2024
7pairs
1
260
「自動テストのプラクティスを効果的に学ぶためのカードゲーム」 ( #sqip2024 )
teyamagu
PRO
2
180
Featured
See All Featured
RailsConf 2023
tenderlove
28
810
GraphQLとの向き合い方2022年版
quramy
43
13k
How GitHub (no longer) Works
holman
310
140k
Code Reviewing Like a Champion
maltzj
517
39k
Building Flexible Design Systems
yeseniaperezcruz
325
38k
Producing Creativity
orderedlist
PRO
340
39k
Dealing with People You Can't Stand - Big Design 2015
cassininazir
363
22k
YesSQL, Process and Tooling at Scale
rocio
167
14k
Design by the Numbers
sachag
277
19k
What’s in a name? Adding method to the madness
productmarketing
PRO
21
3k
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
28
8.9k
Ruby is Unlike a Banana
tanoku
96
11k
Transcript
Nuclear Powered Software Security Chris Riley Dutch PHP Conference 2017
1
Introduction
Beware of lists 1
Nuclear safety 1By Avda (Own work) [CC BY-SA 3.0], via
Wikimedia Commons 2
Nuclear bomb 1By United States Department of Energy [Public domain],
via Wikimedia Commons 3
Nuclear power plant 1Emoscopes [GFDL, CC-BY-SA-3.0 or CC BY 2.5],
via Wikimedia Commons 4
Fault Tree Analysis
Loss of cooling 5
Loss of power 6
Inhibit gate 7
E-Commerce 8
E-Commerce 9
How to use your diagram • Consider risk from each
item 10
How to use your diagram • Consider risk from each
item • Consider mitigations 10
How to use your diagram • Consider risk from each
item • Consider mitigations • Not all mitigations will be technical 10
Defence in Depth
A big firewall 1By Tukulti65 (Own work) [CC BY-SA 4.0],
via Wikimedia Commons 11
Everything is connected 11
Defense in depth 12
Database Access 13
Adding encryption 14
Zonal analysis
United Airlines Flight 232 1By Steve Fitzgerald [GFDL 1.2], via
Wikimedia Commons 15
What can we learn from this? 15
Zonal analysis for security • Administrator passwords 16
Zonal analysis for security • Administrator passwords • Shared systems
16
Zonal analysis for security • Administrator passwords • Shared systems
• Operating system vulnerabilities 16
Assume everything is open to the internet. 16
Zonal analysis for data • Look for data hotspots 17
Zonal analysis for data • Look for data hotspots •
Focus on hotspots 17
Zonal analysis for data • Look for data hotspots •
Focus on hotspots • Reduce data in hotspots 17
Failing safe
Chernobyl accident 1By Jason Minshull [Public domain], via Wikimedia Commons
18
Passive safety 1By Picoterawatt derivative work: OrbiterSpacethingy translation: Cryptex [CC0],
via Wikimedia Commons 19
Failing secure 19
What happens when something goes wrong? 19
Conclusion
Identify undesirable outcomes 19
Layer your defences 19
Look out for single points of failure 19
Handle failures securely 19
Thanks • @giveupalready • https://github.com/carnage • https://carnage.github.io • https://joind.in/talk/92308 20