Security design in web applications

Eda1654eec376ad5a305a3c6b47275e8?s=47 Jester
April 16, 2016
Technology
0
27

Security design in web applications

This is about Inner and Outer security in Web application

Eda1654eec376ad5a305a3c6b47275e8?s=128

Jester

April 16, 2016
Tweet

More Decks by Jester

See All by Jester
Eda1654eec376ad5a305a3c6b47275e8?s=48 jesterovskiy
0
43
Eda1654eec376ad5a305a3c6b47275e8?s=48 jesterovskiy
0
51

Other Decks in Technology

See All in Technology
3b02ffcc638b9cde6cb1bb458a926b15?s=48 yukiarrr
0
560
9e7a653ed313b3da4b263a772bfc5026?s=48 clustervr
0
180
Fc099d9851ad91908e0c16a70aa2ddc1?s=48 tikson
1
340
A97eee01397705443a72a48ce29d3e19?s=48 cybozuinsideout
0
280
Cc8a208e174943d1da814783841abd50?s=48 shinodogg
0
180
2ca9e6e68b43a796a8add2bcb9bbad2e?s=48 mizutani
0
310
40301c0affdf359eaca771713e22b71a?s=48 harshbothra
0
440
17d762ae166e66cab39e9b2e3df7d198?s=48 ysakashita
0
170
Ea29e2b19d11b48f867ae71d6a6de5df?s=48 opelab
1
260
74cec195bfb6cb5165256d88cb7fcf0f?s=48 miu_crescent
2
260
1d8947ec45ce78c83251f4d076abe329?s=48 rpabank
0
160
Ae03eb47606f4e0125268d39f8aebfad?s=48 ymmt2005
2
1.2k

Featured

See All Featured
A415db3ac9e9668acbc1fb36eead84ac?s=48 mthomps
37
2.2k
3d4519fd34b76fb265fc0237f3792bd4?s=48 danielanewman
197
19k
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
166
6.9k
5f2da528927a2ec9ba4fec2069cbc958?s=48 kneath
218
14k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
775
240k
B3ace07412a5178ea778e7eec161fc0a?s=48 jcasabona
7
470
9375a9529679f1b42b567a640d775e7d?s=48 schacon
144
6.5k
5f83ef806155b403c3393160ce51f955?s=48 jlugia
216
16k
027d1ebf66cc039a0bd3b55eeadbe75d?s=48 sachag
446
36k
Be9caeb9d4ef9944d151af909063ed6e?s=48 samlambert
236
9.8k
D47656e20ff5e42f125fc5ea0fd636c6?s=48 tmm1
61
7.5k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
682
180k

Transcript

  1. Security design in web applications

  2. Aleksey Dashkevych RubyDev/SysAdmin twitter://dash_as facebook://aleksey.dashkevich github://jesterovskiy

  3. “software has been designed from the ground up to be

    secure” C.O. Secure by design

  4. Outer Security Inner Security

  5. Ideal Situation Real Life

  6. None
  7. None
  8. None

  9. User Outer Connection Application DB

  10. User

  11. Linux/OSX Firewall Secure PC White noise generator Ideal

  12. Keep password in mind or use pass saver Make password

    strong Change password each period of time Real Keep additional data (DOB, phone)

  13. Connection

  14. Cable VPN … Ideal

  15. SSL SSL updates SRP protocol Real …

  16. Application

  17. Pure HTML Static pages … Ideal

  18. CDN Authentification Authorization Real CRF, XSS

  19. DB

  20. Encryption Tape Drive backup Backup? … Ideal

  21. Backup! Access rights bcrypt/scrypt Real Salt + Verifier (SRP protocol)

  22. Inner Application

  23. Storing API keys in ENV variables Access rights CI Real

    Prod, Staging, Testing instances

  24. Test coverage Verify SSL security Real Check libs source code

    simplecov gem SSLLabs, DigiCert SSL Mutation testing mutant gem

  25. Make logs simply accessible Security headers Styleguide Real secureheaders gem

    rubocop gem Security Policy

  26. Thank You is hiring =)