Application Security: What your developers don't know can hurt you

Transcript

1. Application Security
   What your developers
   don't know can hurt you
   Joe Kuemerle
   www.kuemerle.com
   @jkuemerle
   

   View Slide

2. @jkuemerle / www.kuemerle.com
   Joe Kuemerle
   • Developer at BookingBuilder Technologies
   • Over 15 years of development experience with a
   broad range of technologies
   • Focused on application and data security, coding
   best practices and regulatory compliance
   • Presenter at community, regional and national
   events.
   

   View Slide

3. @jkuemerle / www.kuemerle.com
   How did Mr. Boddy
   get hacked?
   

   View Slide

4. @jkuemerle / www.kuemerle.com
   Source:
   Web Hacking Incident Database
   http://tinyurl.com/AppAttackStats
   

   View Slide

5. @jkuemerle / www.kuemerle.com
   

   View Slide

6. @jkuemerle / www.kuemerle.com
   

   View Slide

7. @jkuemerle / www.kuemerle.com
   

   View Slide

8. @jkuemerle / www.kuemerle.com
   

   View Slide

9. @jkuemerle / www.kuemerle.com
   https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
   http://wpl.codeplex.com
   

   View Slide

10. @jkuemerle / www.kuemerle.com
    

    View Slide

11. @jkuemerle / www.kuemerle.com
    

    View Slide

12. @jkuemerle / www.kuemerle.com
    

    View Slide

13. @jkuemerle / www.kuemerle.com
    

    View Slide

14. @jkuemerle / www.kuemerle.com
    

    View Slide

15. @jkuemerle / www.kuemerle.com
    *
    

    View Slide

16. @jkuemerle / www.kuemerle.com
    

    View Slide

17. @jkuemerle / www.kuemerle.com
    Spoofing
    Tampering
    Repudiation
    Information Disclosure
    Denial of Service
    Elevation of Privilege
    

    View Slide

18. @jkuemerle / www.kuemerle.com
    

    View Slide

19. @jkuemerle / www.kuemerle.com
    

    View Slide

20. @jkuemerle / www.kuemerle.com
    

    View Slide

21. @jkuemerle / www.kuemerle.com
    References
    • http://www.troyhunt.com
    o http://www.troyhunt.com/2011/12/free-ebook-owasp-top-10-for-net.html
    • http://www.owasp.org
    o http://www.youtube.com/user/AppsecTutorialSeries?feature=watch
    • http://www.microsoft.com/security/sdl/default.aspx
    • http://blogs.msdn.com/b/sdl
    • http://bsimm.com
    • http://www.amazon.com/Writing-Secure-Second-
    Michael-Howard/dp/0735617228
    • http://www.google.com/reader/bundle/user%2F11
    910239077358858577%2Fbundle%2FSecurity
    

    View Slide

22. @jkuemerle / www.kuemerle.com
    Tools
    • http://wpl.codeplex.com
    • http://www.backtrack-linux.org
    • http://www.microsoft.com/download/en/details.as
    px?displaylang=en&id=14719 (Threat Model
    designer)
    • http://www.microsoft.com/download/en/details.as
    px?displaylang=en&id=21769 (File fuzzer)
    • WebGoat.NET
    o https://github.com/sempf/WebGoat.NET
    o https://github.com/jkuemerle/WebGoat.NET
    

    View Slide

23. @jkuemerle / www.kuemerle.com
    Photo Credits
    • http://www.flickr.com/photos/pcoin/4629410478
    • http://www.flickr.com/photos/ekreitschmann/3296628124
    • http://www.flickr.com/photos/quinnanya/3333961881
    • http://www.flickr.com/photos/pcambra/3347911070
    • http://www.flickr.com/photos/superamit/2491512156
    • http://www.flickr.com/photos/terrio/5710831966
    • http://www.flickr.com/photos/cliffnordman/6131349171
    • http://www.flickr.com/photos/suckamc/4075609940
    • http://www.flickr.com/photos/alan-light/211186811
    • http://www.flickr.com/photos/marksteele/3766525250
    • http://www.flickr.com/photos/petithiboux/4062233946
    • http://www.flickr.com/photos/theevilmightyf/1496413769
    • http://www.flickr.com/photos/cookylamoo/5059188603
    • http://www.flickr.com/photos/phploveme/2911722148
    

    View Slide

24. @jkuemerle / www.kuemerle.com
    http://speakerrate.com/jkuemerle
    

    View Slide