Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Security design in web applications

Eda1654eec376ad5a305a3c6b47275e8?s=47 Jester
April 16, 2016
Technology
0
38

Security design in web applications

This is about Inner and Outer security in Web application

Eda1654eec376ad5a305a3c6b47275e8?s=128

Jester

April 16, 2016
Tweet

More Decks by Jester

See All by Jester
Eda1654eec376ad5a305a3c6b47275e8?s=48 jesterovskiy
0
43
Eda1654eec376ad5a305a3c6b47275e8?s=48 jesterovskiy
0
58

Other Decks in Technology

See All in Technology
F082484f19b518225501fafa28d05b93?s=48 greymd
0
630
79c9f45e8a3cd4bfa9d7292adb3a6dc0?s=48 kraj
0
5.4k
24606216ae4bbee28494552cb71cc220?s=48 yosshi_
3
350
36bb9dcd778d2a9621d44e92425d0907?s=48 hhiroshell
7
470
0e20ab5db11ca70d818a4f10bfea9c9c?s=48 ymas0315
0
180
Cd823abda454a7a2065fe6fe273ae84b?s=48 viva_tweet_x
5
2.7k
6aa82ed11ae69672aca9bff7e25d1044?s=48 yutamakotaro
1
190
0d29d155ce5c5a93ed46363626da3ea7?s=48 ocise
1
970
Deb41fbc059f796a9eb3109ffed6c84d?s=48 toshinoritakai
1
210
0d29d155ce5c5a93ed46363626da3ea7?s=48 ocise
0
170
D683c1df0b6584c3f1e279ef6c8c04f9?s=48 layerx
1
940
19fc8f6113c5c3d86e6176362ff29479?s=48 kanaugust
PRO
0
110

Featured

See All Featured
1177e050db6bafe62885362edf6e3537?s=48 lauravandoore
11
1.3k
Eb8975af8e49e19e3dd6b6b84a542e26?s=48 qrush
285
18k
0bce06bd06ee7a2c4f5500f25dcf7f18?s=48 paulrobertlloyd
71
1.4k
433acaea1012b25d97ae66da9b998dad?s=48 malarkey
119
16k
Bfd6b681ec6e8c9bef82ff0521c364f7?s=48 kastner
54
1.9k
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
223
47k
F29327647a9cff5c69618bae420792ea?s=48 tenderlove
52
3.4k
F68cb25ae3e5c2106997454b13b7737d?s=48 brad_frost
156
6.4k
E837d2996f52008ace055a08fbfff992?s=48 frogandcode
127
20k
78b475797a14c84799063c7cd073962f?s=48 holman
288
130k
5f2da528927a2ec9ba4fec2069cbc958?s=48 kneath
219
15k
E14f55d3f939977cecbf51b64ff6f861?s=48 keithpitt
401
20k

Transcript

  1. Security design in web applications

  2. Aleksey Dashkevych RubyDev/SysAdmin twitter://dash_as facebook://aleksey.dashkevich github://jesterovskiy

  3. “software has been designed from the ground up to be

    secure” C.O. Secure by design

  4. Outer Security Inner Security

  5. Ideal Situation Real Life

  6. None
  7. None
  8. None

  9. User Outer Connection Application DB

  10. User

  11. Linux/OSX Firewall Secure PC White noise generator Ideal

  12. Keep password in mind or use pass saver Make password

    strong Change password each period of time Real Keep additional data (DOB, phone)

  13. Connection

  14. Cable VPN … Ideal

  15. SSL SSL updates SRP protocol Real …

  16. Application

  17. Pure HTML Static pages … Ideal

  18. CDN Authentification Authorization Real CRF, XSS

  19. DB

  20. Encryption Tape Drive backup Backup? … Ideal

  21. Backup! Access rights bcrypt/scrypt Real Salt + Verifier (SRP protocol)

  22. Inner Application

  23. Storing API keys in ENV variables Access rights CI Real

    Prod, Staging, Testing instances

  24. Test coverage Verify SSL security Real Check libs source code

    simplecov gem SSLLabs, DigiCert SSL Mutation testing mutant gem

  25. Make logs simply accessible Security headers Styleguide Real secureheaders gem

    rubocop gem Security Policy

  26. Thank You is hiring =)