Security First

JSConfEU 2013

Transcript

1. Security First
4. Thanks First
5. Hi, I’m Adam
6. Hi, I’m Adam @adam_baldwin @liftsecurity @nodesecurity
7. Hi, I’m Adam @evilpacket
9. andbang.com
10. andbang.com
13. Node Security Project nodesecurity.io
14. Security First
15. We’re Fucked
16. Nothing is 100% Secure.
19. Defender Attacker
20. Defender Attacker
22. Attacker Defender
23. Software is Hard
24. Software is full of opinions
26. Mobile First
27. Mobile First Content First
28. Mobile First Content First Offline First
29. Mobile First Content First Offline First SECURITY
30. Software is full of constraints
31. Security is one of those
32. Who’s responsible for security?
33. Who’s responsible for security? You are.
34. Why?
36. NSA Spent $25 million on ‘software vulnerabilities’ in 2013
37. Stay off the menu.
38. Litigation is coming.
39. Litigation is coming.
40. Enough Doom & Gloom already!
41. Enough Doom & Gloom already!
42. Something has to change
43. Let’s build a Security First culture
45. Why do we avoid security?
46. - Ignorance - Procrastination - Not Exciting work - Not Rewarded
47. Education Understand Vulnerabilities
48. The simple stuff still works.
50. Validation / Sanitization Crypto http://www.matasano.com/articles/crypto-challenges/ http://owasp.org
51. npm install all the things™
52. npm install coffeescript
53. so..ahhh. what else?
54. Process It’s not immutable
55. Community Bridge all the worlds http://blog.andyet.com/2013/09/11/shame-and-security
56. security.md
57. Homework. - Learn about 1 vuln - Audit some code - Teach a Friend
58. confwork? Talk to each other about security...
59. </PRESENTATION> @adam_baldwin | @LiftSecurity