In Secure Web Applications

Slide Deck for San Antonio Web Developers Meetup

Transcript

1. In Secure Web Applications
2. Me Denny Headrick @dennythecoder denny.headrick@gmail.com
3. Me npm i denny
4. USAJOBS.GOV Search for 2210 || 1550
5. You
6. You It’s okay to answer more than once
7. You Front-End It’s okay to answer more than once
8. You Back-End It’s okay to answer more than once
9. You DBA It’s okay to answer more than once
10. You DBA It’s okay to answer more than once
11. You Environment It’s okay to answer more than once
12. Good News
13. Bad News
14. Bad News I was lying
15. About the OWASP Top 10 • Not a standard… OWASP Top 10 is an Awareness Document • Was probably 3rd or 4th OWASP project, after • Developers Guide • WebGoat • Maybe WebScarab ?? First developed in 2003 • 2003, 2004, 2007, 2010, 2013, 2017 Released 15
16. Availability
17. Availability
18. Availability
19. Availability
21. Delicious!
22. Top Ten Security Vulnerabilities
24. 10 – CSRF
25. Makes users do bad things
26. Makes users do bad things ..or annoying things
30. Disallow CORS
32. › Unique per user session
33. › Unique per user session › Large random value
34. › Unique per user session › Large random value › Generated by a cryptographically secure random number generator
37. 9 – Insufficient Logging and Monitoring
39. Logins
40. Logins It’s called a login for a reason
41. Transactions
42. Access Control Failures
44. If you don’t log, you’re in a fog
46. 8 – Using Components with Known Vulnerabilities
47. 143,000,000 People
48. Equifax
49. Throw it away
50. Routinely check
52. 7 – Insecure Deserialization
54. Cookies are a sometimes tool
55. Integrity Checks
56. Logging
57. Avoidance
59. 6 – XSS
64. Chrome
65. Firefox
66. Edge
67. IE
68. IE Shocking
71. http://ebay.com/link/?nav=webview&url=javascript:alert( document.cookie) https://ret2libc.wordpress.com/2016/01/11/a-tale-of-ebay-xss-and-shoddy-incident-response/
72. Trusted Frameworks
73. Escape Strings
74. HIGH FIVE
76. 5 – Security Misconfiguration
77. Turn off unnecessary features
78. Remove unnecessary software
79. Turn off detailed errors
81. Security through Obscurity is NOT Security
84. 4 – Broken Access Control
85. Prevent Caching
86. Deny by default
87. Prevent Path Traversal
89. 3 – Sensitive Data Exposure
90. HTTPS
91. HASH
92. Username Salt value String to be hashed Hashed value = SHA256 (Password + Salt value) user1 E1F53135FAE559C253 password123+E1F53135 E559C253 72AE25495A7981C40622D49F9 A52E4F1565C90F048F59027BD 9C8C8900D5C3D8 user2 F84B03D034B409D4E password123+84B03D0 34B409D4E B4B6603ABC670967E99C7E7F 1389E40CD16E78AD38EB1468 EC2AA1E62B8BED3A
94. Why did the dinosaurs die?
95. They tried to create their own encryption
97. 2 – Broken Authentication
98. MF Authentication
99. No Defaults
100. Limit failures
101. Same message for login failures
104. 1 - Injection
109. NoSQL?
111. Server-side validation
112. Parameterized Queries
113. Let’s check back in with Dave
115. Managing Risks
116. Any questions? You can find me at: @dennythecoder · denny.headrick@gmail.com