A history on security and how to win the battle

Transcript

1. A history on security and how to win the battle... Joshua Thijssen
2. Channeling and restricting flow
3. Sometimes channels don’t listen
4. Failure is always an option
5. Security is a business value
6. Security is a business value
7. Security is a business value
8. Let others take care of security
9. Let others take care of security
10. History of (computer) security
11. Security in the “old days”
12. I wasn’t kidding when I said: “old days”
13. 5.25” high density disks
14. 5.25” high density disks
15. Copying was a breeze
16. Copy protection
17. Copy protection
18. Let’s try dongles
19. NOPE!
20. 8086 segmented memory layout
21. 8086 segmented memory layout segment reg. 16-bit
22. 8086 segmented memory layout segment reg. offset reg. 16-bit 16-bit
23. 8086 segmented memory layout segment reg. offset reg. physical address 16-bit 16-bit 20-bit
24. 8086 segmented memory layout segment reg. offset reg. << 4 physical address 16-bit 16-bit 20-bit
25. 8086 segmented memory layout segment reg. offset reg. << 4 + physical address 16-bit 16-bit 20-bit
26. 07C0:0050 07C00 0050+ 07C50 8086 segmented memory layout segment reg. offset reg. << 4 + physical address 16-bit 16-bit 20-bit
27. 07C0:0050 07C00 0050+ 07C50 0000:7C50 00000 07C50+ 07C50 8086 segmented memory layout segment reg. offset reg. << 4 + physical address 16-bit 16-bit 20-bit
28. 07C0:0050 07C00 0050+ 07C50 0000:7C50 00000 07C50+ 07C50 007C:7490 007C0 07490+ 07C50 8086 segmented memory layout segment reg. offset reg. << 4 + physical address 16-bit 16-bit 20-bit
29. 8086 segmented memory layout segment reg. offset reg. << 4 + physical address 16-bit 16-bit 20-bit
30. 386 protected memory layout + descriptor directory entry page table entry physical address directory page offset cr3 gdt / ldt page directory page table page frame linear address descriptor table selector offset 32-bit 16-bit
33. Ring 0 Kernel
34. Ring 0 Kernel Ring 1 Device drivers
35. Ring 0 Kernel Ring 1 Device drivers Ring 2 Device Drivers
36. Ring 0 Kernel Ring 1 Device drivers Ring 2 Device Drivers Ring 3 Applications
37. Security today
38. The weakest link
39. Humans
40. it is much easier to trick someone into giving a password for a system than to spend the effort to crack into the system -- K. Mitnick
41. Raising awareness on browsers
42. It’s a trap!
43. We’re curious
44. People are resourceful
45. Weird hobby’s
46. Weird hobby’s
47. 00710022211101015511130102359000000000
48. 00710033308171115011231111700000000000
49. 00710033308171115011231111700000000000 00710022211101015511130102359000000000
50. 00710033308171115011231111700000000000 00710022211101015511130102359000000000
51. 00710022211101015511130102359000000000 00710033308171115011231111700000000000
52. 00710044401011200001231122359000000000
54. Magnetic card reader/writer: $ 250
55. Magnetic card reader/writer: $ 250 Parking costs per night: $40
56. Magnetic card reader/writer: $ 250 Parking costs per night: $40 Free parking: priceless
57. How can we cure this problem?
58. We need to implement REAL security, not fake.
59. How do we win the war? How do we win the war?
60. If we as developers have to keep thinking about security, we will lose...
61. We need to deflect *EVERY* attack, They only need *ONE* to win...
62. 99.999% of all programmers are NOT trained or have the capability to identify security threats. The other 0.001% will not be able to identify them ALL OF THEM ALL THE TIME.
63. A day in the life of a PHP programmer...
64. $result = mysql_query('SELECT * FROM users WHERE username="'.$_GET['username'].'"');
65. You should use mysql_real_escape_string!
66. No, you shouldn’t!
67. You just put a developer who wasn’t aware of security issues, in charge of security...
68. Let others handle security (PDO)
69. There is no (quick) solution.
70. There is no (quick) solution. but we have to change the way we deal with security radically,
71. There is no (quick) solution. but we have to change the way we deal with security radically, by not dealing with security...
72. Let others take care of security
73. Any questions (maximum 5)?
74. Find me on twitter: @jaytaph Find me for development and training: www.noxlogic.nl Find me on email: jthijssen@noxlogic.nl Find me for blogs: www.adayinthelifeof.nl Thank you! http://joind.in/6853