Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Security design in web applications

Eda1654eec376ad5a305a3c6b47275e8?s=47 Jester
April 16, 2016
Technology
0
46

Security design in web applications

This is about Inner and Outer security in Web application

Eda1654eec376ad5a305a3c6b47275e8?s=128

Jester

April 16, 2016
Tweet

More Decks by Jester

See All by Jester
Eda1654eec376ad5a305a3c6b47275e8?s=48 jesterovskiy
0
43
Eda1654eec376ad5a305a3c6b47275e8?s=48 jesterovskiy
0
64

Other Decks in Technology

See All in Technology
94870c02836167043f37f05ae1032690?s=48 tatsy
2
410
462feb0fe0493c40d55650da664e8773?s=48 clustervr
PRO
0
200
525442fc70ca92f82ae503f826956137?s=48 finengine
0
300
4ca55ec64603f424638409b6e0ee7e65?s=48 halhira
1
100
194f4e605d797dda7a64fd08734eff82?s=48 quickxp5
0
110
00101a1274d1f92977f4e442ef73be86?s=48 ahana
0
330
Cc49268bebed3e30cb943a9de7b6eb3a?s=48 lain21
12
5.1k
D069523c85d56ebf004c9695bca578c0?s=48 kenichimunezawa
0
810
Baf3de0f86a61c06c8fb9539d4958bf5?s=48 jozono
6
1.1k
1b9e2b135e11b80d5923db6bb250ffe7?s=48 daisukehirama41
1
310
7a54d6143169419fc6d4d9a0ff3056ea?s=48 maekawa123
0
460
Cd931bc05e7cee46b9a950a63e47ba4c?s=48 you
0
100

Featured

See All Featured
F29327647a9cff5c69618bae420792ea?s=48 tenderlove
53
3.5k
F68cb25ae3e5c2106997454b13b7737d?s=48 brad_frost
157
6.5k
D47656e20ff5e42f125fc5ea0fd636c6?s=48 tmm1
61
9.9k
E190023b66e2b8aa73a842b106920c93?s=48 zenorocha
296
40k
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
167
7.3k
027d1ebf66cc039a0bd3b55eeadbe75d?s=48 sachag
267
17k
F383c6a4dc55e331bbe2987b622cee6b?s=48 stephaniewalter
262
11k
E837d2996f52008ace055a08fbfff992?s=48 frogandcode
128
20k
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
146
19k
Af6a12710770ad9a7cfd08c97efd40d3?s=48 pedronauck
652
110k
64827b31aef81498662e8af4bd6d5157?s=48 jonrohan
1021
390k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
146
20k

Transcript

  1. Security design in web applications

  2. Aleksey Dashkevych RubyDev/SysAdmin twitter://dash_as facebook://aleksey.dashkevich github://jesterovskiy

  3. “software has been designed from the ground up to be

    secure” C.O. Secure by design

  4. Outer Security Inner Security

  5. Ideal Situation Real Life

  6. None
  7. None
  8. None

  9. User Outer Connection Application DB

  10. User

  11. Linux/OSX Firewall Secure PC White noise generator Ideal

  12. Keep password in mind or use pass saver Make password

    strong Change password each period of time Real Keep additional data (DOB, phone)

  13. Connection

  14. Cable VPN … Ideal

  15. SSL SSL updates SRP protocol Real …

  16. Application

  17. Pure HTML Static pages … Ideal

  18. CDN Authentification Authorization Real CRF, XSS

  19. DB

  20. Encryption Tape Drive backup Backup? … Ideal

  21. Backup! Access rights bcrypt/scrypt Real Salt + Verifier (SRP protocol)

  22. Inner Application

  23. Storing API keys in ENV variables Access rights CI Real

    Prod, Staging, Testing instances

  24. Test coverage Verify SSL security Real Check libs source code

    simplecov gem SSLLabs, DigiCert SSL Mutation testing mutant gem

  25. Make logs simply accessible Security headers Styleguide Real secureheaders gem

    rubocop gem Security Policy

  26. Thank You is hiring =)