Security design in web applications

Eda1654eec376ad5a305a3c6b47275e8?s=47 Jester
April 16, 2016
Technology
0
25

Security design in web applications

This is about Inner and Outer security in Web application

Eda1654eec376ad5a305a3c6b47275e8?s=128

Jester

April 16, 2016
Tweet

More Decks by Jester

See All by Jester
Eda1654eec376ad5a305a3c6b47275e8?s=48 jesterovskiy
0
40
Eda1654eec376ad5a305a3c6b47275e8?s=48 jesterovskiy
0
44

Other Decks in Technology

See All in Technology
88f4e84b94fe07cddbd9e6479d689192?s=48 soudai
0
270
3499a1d71fa70b8ee44816ca9e7329fe?s=48 bells17
5
860
C21becdee5cd08b34c7452276e64c1fe?s=48 yamamuteki
6
1.1k
1f745ff900e1be51aedae18cae76593c?s=48 kurochan
0
1.7k
Cd891a89dfec6ca7bd278b5f5bd87c90?s=48 tzkoba
1
400
79dcb04101764d7bf66f898dd446838e?s=48 tsukubachallenge
0
200
C7f4bfa6a378cf43c3475716d1992efe?s=48 ishizuka427
0
220
706ff501573a736401aa4de5adc88e05?s=48 nihonbuson
3
950
9e7a653ed313b3da4b263a772bfc5026?s=48 clustervr
0
270
5b392dc79d5b6d1dab580bf60e26fb7c?s=48 nitya
0
190
Cd6e67775ba3275c466e9927ede23080?s=48 nk35jk
2
880
Dd672f13e7e17714700544cb355cbaba?s=48 kyoshimoto
2
180

Featured

See All Featured
D36d2c1821af9249b69ff7f5ed60529b?s=48 tammielis
236
23k
1f74b13f1e5c6c69cb5d7fbaabb1e2cb?s=48 sferik
606
53k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
681
180k
812e1705ff0f8bc1bcf18587bde687d5?s=48 62gerente
581
190k
Ded01cdab114abe4ec13511e4c25b9bb?s=48 andyhume
60
2.4k
Eb8975af8e49e19e3dd6b6b84a542e26?s=48 qrush
282
18k
A0517b08532aec8ab2aae3f65d40ad86?s=48 hannesfritz
26
850
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
494
110k
20bfe76b3d6105641f879fe45cfc9272?s=48 bkeepers
319
53k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
142
19k
C620790ae5bf5b50c245b2e0ef95f338?s=48 deanohume
293
27k
Ae14cc4491ac334f9cd23f9f93b4305e?s=48 orderedlist
325
34k

Transcript

  1. Security design in web applications

  2. Aleksey Dashkevych RubyDev/SysAdmin twitter://dash_as facebook://aleksey.dashkevich github://jesterovskiy

  3. “software has been designed from the ground up to be

    secure” C.O. Secure by design

  4. Outer Security Inner Security

  5. Ideal Situation Real Life

  6. None
  7. None
  8. None

  9. User Outer Connection Application DB

  10. User

  11. Linux/OSX Firewall Secure PC White noise generator Ideal

  12. Keep password in mind or use pass saver Make password

    strong Change password each period of time Real Keep additional data (DOB, phone)

  13. Connection

  14. Cable VPN … Ideal

  15. SSL SSL updates SRP protocol Real …

  16. Application

  17. Pure HTML Static pages … Ideal

  18. CDN Authentification Authorization Real CRF, XSS

  19. DB

  20. Encryption Tape Drive backup Backup? … Ideal

  21. Backup! Access rights bcrypt/scrypt Real Salt + Verifier (SRP protocol)

  22. Inner Application

  23. Storing API keys in ENV variables Access rights CI Real

    Prod, Staging, Testing instances

  24. Test coverage Verify SSL security Real Check libs source code

    simplecov gem SSLLabs, DigiCert SSL Mutation testing mutant gem

  25. Make logs simply accessible Security headers Styleguide Real secureheaders gem

    rubocop gem Security Policy

  26. Thank You is hiring =)