A history on security and how to win the battle

Transcript

1. A history on security
   and how to win the battle...
   Joshua Thijssen
   

   View Slide

2. Channeling and restricting flow
   

   View Slide

3. Sometimes channels don’t listen
   

   View Slide

4. Fighting against ourselves
   

   View Slide

5. Security is a business value
   

   View Slide

6. Let others take care of security
   

   View Slide

7. History of (computer) security
   

   View Slide

8. Security in the “old days”
   

   View Slide

9. I wasn’t kidding when I said: “old days”
   

   View Slide

10. 5.25” high density disks
    

    View Slide

11. Copying was a breeze
    

    View Slide

12. Copy protection
    

    View Slide

13. Copy protection
    

    View Slide

14. Let’s try dongles
    

    View Slide

15. NOPE!
    

    View Slide

16. 07C0:0050
    07C00
    0050+
    07C50
    0000:7C50
    00000
    07C50+
    07C50
    007C:7490
    007C0
    07490+
    07C50
    8086 segmented memory layout
    segment reg. offset reg.
    << 4 +
    physical address
    16-bit 16-bit
    20-bit
    

    View Slide

17. 386 protected memory layout
    +
    descriptor
    directory entry page table entry
    physical address
    directory page offset
    cr3
    gdt / ldt
    page directory page table
    page frame
    linear address
    descriptor table
    selector offset
    32-bit
    16-bit
    

    View Slide

18. Ring 0
    Kernel
    Ring 1
    Device drivers
    Ring 2
    Device Drivers
    Ring 3
    Applications
    

    View Slide

19. Security today
    

    View Slide

20. The weakest link
    

    View Slide

21. Humans
    

    View Slide

22. it is much easier to trick someone into
    giving a password for a system than to
    spend the effort to crack into the system
    -- K. Mitnick
    

    View Slide

23. Raising awareness on browsers and users
    

    View Slide

24. It’s a trap!
    

    View Slide

25. We’re curious
    

    View Slide

26. People are resourceful
    

    View Slide

27. Weird hobby’s
    

    View Slide

28. Weird hobby’s
    

    View Slide

29. View Slide

30. View Slide

31. View Slide

32. View Slide

33. View Slide

34. View Slide

35. Magnetic card reader/writer: $ 250
    Parking costs per night: $40
    Free parking: priceless
    

    View Slide

36. How can we cure this problem?
    

    View Slide

37. We need to implement REAL security, not fake.
    

    View Slide

38. How do we win the war?
    How do we win the war?
    

    View Slide

39. If we as developers have to keep thinking
    about security, we will lose...
    

    View Slide

40. We need to deflect *EVERY* attack,
    They only need *ONE* to win...
    

    View Slide

41. 99.999% of all programmers are NOT trained or
    have the capability to identify security threats.
    The other 0.001% will not be able to identify
    them ALL OF THEM ALL THE TIME.
    

    View Slide

42. A day in the life of a PHP programmer...
    

    View Slide

43. $result = mysql_query('SELECT * FROM users WHERE username="'.$_GET['username'].'"');
    

    View Slide

44. You should use mysql_real_escape_string!
    

    View Slide

45. No, you shouldn’t!
    

    View Slide

46. You just put a developer who wasn’t aware
    of security issues, in charge of security...
    

    View Slide

47. Let others handle security
    (PDO)
    

    View Slide

48. There is no (quick) solution.
    but we have to change the way
    we deal with security radically,
    by not dealing with security...
    

    View Slide

49. Let others take care of security
    

    View Slide

50. Any questions (maximum 5)?
    

    View Slide

51. Find me on twitter: @jaytaph
    Find me for development and training: www.noxlogic.nl
    Find me on email: jthijssen@noxlogic.nl
    Find me for blogs: www.adayinthelifeof.nl
    Thank you!
    

    View Slide