Security is not a feature‼️

Security is not a feature !" Security is not a
feature ‼ - @ianaya89 1

! Nacho Anaya ! @ianaya89 • ! Lead OSS Engineer
@ChecklyHQ • " Ambassador @Auth0 • # Streaming @ianaya89 Security is not a feature ‼ - @ianaya89 2

! Security is not a feature ‼ - @ianaya89 3

!" Security is not a feature ‼ - @ianaya89 4

"There are two types of companies: those that have been
hacked, and those who don't know they have been hacked." John T. Chambers Security is not a feature ‼ - @ianaya89 5

Security is not a feature ‼ - @ianaya89 8

! ~11.3 Billons informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks Security is not a feature ‼
- @ianaya89 12

! ... ! Uneven Competition Security is not a feature
‼ - @ianaya89 15

! Lose Money Security is not a feature ‼ -
@ianaya89 17

! Lose Trust Security is not a feature ‼ -
@ianaya89 18

✍ Culture • ! Training • " Politics • ⏱
Time • $ Money % Security is not a feature ‼ - @ianaya89 20

"If you spend more on coffee than on IT security,
you will be hacked. What's more, you deserve to be hacked" Richard A. Clarke Security is not a feature ‼ - @ianaya89 21

! " Invest! Security is not a feature ‼ -
@ianaya89 22

! Systemic Thinking Security is not a feature ‼ -
@ianaya89 24

! Vulnerabilities Security is not a feature ‼ - @ianaya89
25

"Vulnerabilities are like ants, they are everywhere" Nacho Anaya Security
is not a feature ‼ - @ianaya89 26

Heartbleed Security is not a feature ‼ - @ianaya89 27

! Web is Complex Security is not a feature ‼
- @ianaya89 29

! HTTP/S - WebSockets - DNS - TCP FTP -
IPv4 - IPv6 - SSH- ASCII - IRC Security is not a feature ‼ - @ianaya89 30

! Browsers too Security is not a feature ‼ -
@ianaya89 31

! HTML - CSS - JS Security is not a

! DOM - Geolocation - Multimedia Fetch - Web Sockets
- Storage Security is not a feature ‼ - @ianaya89 33

! The Solution Security is not a feature ‼ -
@ianaya89 35

! No perfect solution Security is not a feature ‼
- @ianaya89 36

! But we can be ready Security is not a

! Security is not "nice to have" Security is not
a feature ‼ - @ianaya89 39

! Security is by default Security is not a feature
‼ - @ianaya89 40

! Assume the worst Security is not a feature ‼
- @ianaya89 41

ALWAYS Security is not a feature ‼ - @ianaya89 42

! Your app is your bestie Security is not a

! Input vectors Security is not a feature ‼ -
@ianaya89 44

! Query String - URL Path - Request Body -
Cookies Request Headers - Form Fields - File Inputs Emails - Web Socket - Browser Storage - Hooks Security is not a feature ‼ - @ianaya89 45

⚠ Never trust your users Security is not a feature
‼ - @ianaya89 46

! HTTPS ! 2021 Security is not a feature ‼
- @ianaya89 48

⬇ LTS Security is not a feature ‼ - @ianaya89
50

Dependencies Security is not a feature ‼ - @ianaya89 51

! "Your code is not your code, but their bugs
are your bugs." Nacho Anaya Security is not a feature ‼ - @ianaya89 53

! eslint-scope eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes Security is not a feature ‼ -
@ianaya89 54

! SQL / No-SQL Injection Security is not a feature
‼ - @ianaya89 58

! SQL / No-SQL Injection • ‼ Server Side Validation
• " Sanitize queries • # ORM / ODM Security is not a feature ‼ - @ianaya89 61

! XSS Security is not a feature ‼ - @ianaya89
62

! XSS • ‼ Server Side Validation • " Sanitize
inputs • # HTML encoding • $ Frameworks • % HTTP Secure Response Headers Security is not a feature ‼ - @ianaya89 64

! XSS Headers - HSTS - HPKP - X-Frame-Options -
X-XSS-Protection - X-Content-Type-Options - Referrer-Policy - Expect-CT - Content-Security-Policy ! Secure Headers Security is not a feature ‼ - @ianaya89 65

! DoS Security is not a feature ‼ - @ianaya89
66

! DoS • ⌛ Rate Limiting • ❌ Error handling
• # Explicit Crashes • $ Exponential Regex • % IP Banning Security is not a feature ‼ - @ianaya89 68

! Sessions & Tokens Security is not a feature ‼
- @ianaya89 69

! Sessions & Tokens • ⏱ Expirable • " Allow
List or Deny List • # OAUTH - OpenID • $ Single Sign On Security is not a feature ‼ - @ianaya89 70

! Passwords Security is not a feature ‼ - @ianaya89
71

Time to crack Security is not a feature ‼ -
@ianaya89 72

! Passwords • ! hash + salt (bcrypt) • "
Strong Passwords (Entropy) • # 2FA / MFA Security is not a feature ‼ - @ianaya89 73

! " Have I been pawned? https://haveibeenpwned.com Security is not

! " Have I been pawned? ! API & DB

! Dev Passwords & Secrets • ! CI • "
Dev Tools • # Cloud • $ Keys - Tokens - Secrets Security is not a feature ‼ - @ianaya89 77

! Dev Passwords & Secrets • Blackbox • Keybase •
GPG • Password Managers • Secret Manager (AWS) • MFA ! Security is not a feature ‼ - @ianaya89 78

! Cookies Security is not a feature ‼ - @ianaya89
79

! " Cookies Flags • httpOnly • secure • SameSite

! ↩ Cookies Scoping • domain • path • expires

! Logging & Monitoring Security is not a feature ‼
- @ianaya89 82

! " Logging & Monitoring • ! Monitoring: datadog /
new relic • " Errors: sentry / bugsnag • # Logs: papertrail / loggly • $ Status: checkly / pingdom Security is not a feature ‼ - @ianaya89 83

! Sensitive Data Security is not a feature ‼ -
@ianaya89 84

! OWASP Top 10 owasp.org Security is not a feature
‼ - @ianaya89 87

! WebGoat $ docker pull webgoat/webgoat-8.0 $ docker run -p
8080:8080 -t webgoat/webgoat-8.0 Security is not a feature ‼ - @ianaya89 88

! Take Away Security is not a feature ‼ -
@ianaya89 89

! Start taking care Security is not a feature ‼
- @ianaya89 91

! Thanks! ! Questions? ! @ianaya89 Security is not a

Security is not a feature‼️

Security is not a feature‼️

More Decks by Ignacio Anaya

Other Decks in Programming

Featured

Transcript