has always been broken. • OWASP TOP 10; 2013 • Injection • Broken Authentication and Session Management • Cross Site Scripting • Insecure Direct Object Reference • Security Misconfiguration • Sensitive Data Exposure • Missing Function Level Access Control • Cross Site Request Forgery • Using Components with Known Vulnerabilities • Unvalidated Redirects and Forwards
has always been broken. • OWASP TOP 10; 2017 • Injection • Broken Authentication • Sensitive Data Exposure • XML External Entities (XXE) • Broken Access Control • Security Misconfiguration • Cross Site Scripting • Insecure Deserialization • Using Components with Known Vulnerabilities • Insufficent Logging and Monitoring
development that reflects the implied cost of additional rework caused by choosing an easy solution now instead of using a better approach that would take longer. • If you end up going a different route, there’s less lost code (and therefore productivity) • If you end up keeping it, there is interest on that debt...
Broken Authentication • Sensitive Data Exposure • XML External Entities (XXE) • Broken Access Control • Security Misconfiguration • Cross Site Scripting • Insecure Deserialization • Using Components with Known Vulnerabilities • Insufficent Logging and Monitoring • OWASP TOP 10; 2004 • Unvalidated Input • Broken Access Control • Broken Authentication and Session Management • Cross Site Scripting • Buffer Overflow • Injection Flaws • Improper Error Handling • Insecure Storage • Application Denial of Service • Insecure Configuration Management • Code written in 2004 is suceptible to todays problems...
Entities (XXE) • Insecure Deserialization • Using Components with Known Vulnerabilities • Insufficent Logging and Monitoring • OWASP TOP 10; 2004 • Buffer Overflow • Application Denial of Service • Code written in 2004 is suceptible to todays problems...
A 2010 decision, for example, eBay Domestic Holdings Inc. v. Newmark, held that corporate directors are bound by "fiduciary duties and standards" which include "acting to promote the value of the corporation for the benefit of its stockholders."
– Chance of 10000+ record breach is 11% • $247,500 bet – Chance of 100000+ record breach is 0.5% • $1,250,000 bet – Chance of 1000000+ record breach is 0.25% • $5,620,000 bet
old • If someone used the same leverage to pressure you into giving them sex instead of your SSN it would be considered rape. - /u/Velostodon • Didn’t lose customers... Currently expanding their services to include selling your income and job title.
work. Any press is good press. – Victim Blaming • Skills Transfer – Same mistakes over and over – Ongoing traning - costs money. – Mentorship – costs short term productivity
NSA pays $1,000,000 – Companies often see hackers as mercanaries – Requires spending as much or more money than the attackers; or relying on your average hacker to ‘care’ – If working for the good guys was more profitable, this wouldn’t be an issue. * Secure boot firmware
NSA pays $1,000,000 – Companies often see hackers as mercanaries – Requires spending as much or more money than the attackers; or relying on your average hacker to ‘care’ – If working for the good guys was more profitable, this wouldn’t be an issue.
bad. But they affected people who had chosen to do business with these companies by buying books or airplane trips." - Wired – "Under the law of Georgia, where Equifax is incorporated, the state attorney general may file a lawsuit in state court to dissolve a corporation if the corporation "has continued to exceed or abuse the authority conferred upon it by law."
– Require them to meet standards or not recieve payouts. – Enforcement / Monitoring • Government “incentives” – Fines for breaches – Disclosure requirements – Compensation requirements – Data licensing
rushed, legislative solution, followed by standards bodies filling in the gaps. Companies who have prepared will be better off when it happens. This is only a matter of time.
evandentremont
ymtdzzz
happymana
syumai
usagimaru
maaretp
seike460
ivargrimstad
satoshi7190
tomohisa
naokihaba
tkikuc
matthewcrist
garrettdimon
smashingmag
eitanlees
aki_iinuma
keavy
reverentgeek
marktimemedia
mojombo
honnibal
notwaldorf
davidbonilla
![[redacted] didn’t care. • Technical Debt • Invesment vs reward](https://files.speakerdeck.com/presentations/a4296efe068043098c534f5e57a9930d/slide_26.jpg){kind=link}
![Questions? Comments? [email protected] https://github.com/evandentremont @[redacted]](https://files.speakerdeck.com/presentations/a4296efe068043098c534f5e57a9930d/slide_37.jpg){kind=link}