A history on security and how to win the battle

Transcript

1. A history on security and how to win the battle... Joshua Thijssen
2. Channeling and restricting flow
3. Sometimes channels don’t listen
4. Fighting against ourselves
5. Security is a business value
6. Let others take care of security
7. History of (computer) security
8. Security in the “old days”
9. I wasn’t kidding when I said: “old days”
10. 5.25” high density disks
11. Copying was a breeze
12. Copy protection
13. Copy protection
14. Let’s try dongles
15. NOPE!
16. 07C0:0050 07C00 0050+ 07C50 0000:7C50 00000 07C50+ 07C50 007C:7490 007C0 07490+ 07C50 8086 segmented memory layout segment reg. offset reg. << 4 + physical address 16-bit 16-bit 20-bit
17. 386 protected memory layout + descriptor directory entry page table entry physical address directory page offset cr3 gdt / ldt page directory page table page frame linear address descriptor table selector offset 32-bit 16-bit
18. Ring 0 Kernel Ring 1 Device drivers Ring 2 Device Drivers Ring 3 Applications
19. Security today
20. The weakest link
21. Humans
22. it is much easier to trick someone into giving a password for a system than to spend the effort to crack into the system -- K. Mitnick
23. Raising awareness on browsers and users
24. It’s a trap!
25. We’re curious
26. People are resourceful
27. Weird hobby’s
28. Weird hobby’s
31. 00710033308171115011231111700000000000 00710022211101015511130102359000000000
32. 00710033308171115011231111700000000000 00710022211101015511130102359000000000
33. 00710022211101015511130102359000000000 00710033308171115011231111700000000000
35. Magnetic card reader/writer: $ 250 Parking costs per night: $40 Free parking: priceless
36. How can we cure this problem?
37. We need to implement REAL security, not fake.
38. How do we win the war? How do we win the war?
39. If we as developers have to keep thinking about security, we will lose...
40. We need to deflect *EVERY* attack, They only need *ONE* to win...
41. 99.999% of all programmers are NOT trained or have the capability to identify security threats. The other 0.001% will not be able to identify them ALL OF THEM ALL THE TIME.
42. A day in the life of a PHP programmer...
43. $result = mysql_query('SELECT * FROM users WHERE username="'.$_GET['username'].'"');
44. You should use mysql_real_escape_string!
45. No, you shouldn’t!
46. You just put a developer who wasn’t aware of security issues, in charge of security...
47. Let others handle security (PDO)
48. There is no (quick) solution. but we have to change the way we deal with security radically, by not dealing with security...
49. Let others take care of security
50. Any questions (maximum 5)?
51. Find me on twitter: @jaytaph Find me for development and training: www.noxlogic.nl Find me on email: jthijssen@noxlogic.nl Find me for blogs: www.adayinthelifeof.nl Thank you!