Nuclear powered software securty

Transcript

1. Nuclear Powered Software Security Chris Riley Dutch PHP Conference 2017 1
2. Introduction
3. Beware of lists 1
4. Nuclear safety 1By Avda (Own work) [CC BY-SA 3.0], via Wikimedia Commons 2
5. Nuclear bomb 1By United States Department of Energy [Public domain], via Wikimedia Commons 3
6. Nuclear power plant 1Emoscopes [GFDL, CC-BY-SA-3.0 or CC BY 2.5], via Wikimedia Commons 4
7. Fault Tree Analysis
8. Loss of cooling 5
9. Loss of power 6
10. Inhibit gate 7
11. E-Commerce 8
12. E-Commerce 9
13. How to use your diagram • Consider risk from each item 10
14. How to use your diagram • Consider risk from each item • Consider mitigations 10
15. How to use your diagram • Consider risk from each item • Consider mitigations • Not all mitigations will be technical 10
16. Defence in Depth
17. A big firewall 1By Tukulti65 (Own work) [CC BY-SA 4.0], via Wikimedia Commons 11
18. Everything is connected 11
19. Defense in depth 12
20. Database Access 13
21. Adding encryption 14
22. Zonal analysis
23. United Airlines Flight 232 1By Steve Fitzgerald [GFDL 1.2], via Wikimedia Commons 15
24. What can we learn from this? 15
25. Zonal analysis for security • Administrator passwords 16
26. Zonal analysis for security • Administrator passwords • Shared systems 16
27. Zonal analysis for security • Administrator passwords • Shared systems • Operating system vulnerabilities 16
28. Assume everything is open to the internet. 16
29. Zonal analysis for data • Look for data hotspots 17
30. Zonal analysis for data • Look for data hotspots • Focus on hotspots 17
31. Zonal analysis for data • Look for data hotspots • Focus on hotspots • Reduce data in hotspots 17
32. Failing safe
33. Chernobyl accident 1By Jason Minshull [Public domain], via Wikimedia Commons 18
34. Passive safety 1By Picoterawatt derivative work: OrbiterSpacethingy translation: Cryptex [CC0], via Wikimedia Commons 19
35. Failing secure 19
36. What happens when something goes wrong? 19
37. Conclusion
38. Identify undesirable outcomes 19
39. Layer your defences 19
40. Look out for single points of failure 19
41. Handle failures securely 19
42. Thanks • @giveupalready • https://github.com/carnage • https://carnage.github.io • https://joind.in/talk/92308 20