Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Security for Startups - ChicagoRuby/1871

Security for Startups - ChicagoRuby/1871

Presented at ChicagoRuby and 1871 on 6/4/2014

John Downey

June 04, 2014

More Decks by John Downey

Other Decks in Technology


  1. PROTECT DEVICES UP FRONT • Password/passcode is an important first

    step • Full disk encryption • Imperceptible slowdown on newer devices • FileVault on OS X • BitLocker on Windows
  2. HAVE A PLAN • What is the procedure when a

    device is lost? • Who do you email/call? • Spell it specifically • Turn off access to remote services
  3. FIND THE DEVICE • File a police report • Need

    the serial number (device inventory) • Sometimes they turn back up • Use remote find/wipe services • Find my iPhone • Prey
  4. • People will reuse passwords • Password managers can help

    this • Need to build it into the company culture
  5. TEAM SHARED PASSWORDS • No silver bullet • Try not

    to do it • Our current solution • KeePassX file on Dropbox • Change them all when someone leaves
  6. TWO-FACTOR AUTH • Turn on two-factor everywhere • Enforce it

    at the system level if possible • Google Apps, Dropbox, GitHub
  7. • Use botnets and amplifiers to flood traffic • Increasingly

    likely as popularity grows • Major launch dates • Often preceded by a ransom note • Digital extortion
  8. • Don’t bother paying the extortion money • Enlist a

    DDoS protection company • CloudFlare • Akamai/Prolexic • Put protection in place before attack
  9. TOP 10 • Entire presentation in itself • Covers the

    top 10 attack vectors for web apps • SQL Injection • Cross-site scripting (XSS) • Cross-site request forgery (CSRF)
  10. WEBGOAT • Intentionally vulnerable app • Guide you through various

    common exploits • Java, .NET, Ruby, Python • iOS
  11. • Data at rest • Use GPG/PGP • Data in

    motion • Use TLS/SSL, SSH, or VPN
  12. • Where is your data kept? • Do they publish

    their security practices? • What could happen if they were breached?
  13. SECURITY PAGE • Put a link in the footer •

    Provide a dedicated email address • [email protected] • Welcome researchers to report bugs • Spell out exactly what they will get • Hall of fame is a good start
  14. RESPONSE PLAN • Make it someone’s job to watch and

    respond • Respond as soon as you see it • Give an initial timeline for a response (24 hours) • Investigate • Ask for reproduction details
  15. VULNERABILITY WAS FOUND • Respond to reporter with confirmation •

    Establish a new timeline for a fix • Confirm with reporter when fixed in production • Expect them to publish their findings
  16. FALSE POSITIVES • Automated vulnerability scanners produce noise • You

    will get bad reports • Respond to every report • Explain why you do not agree it is a vulnerability
  17. INVENTORY • What applications are running? • In every environment

    • What frameworks/libraries do they use? • What servers are running?
  18. NOTIFICATIONS • Use tools like bundle-audit to watch dependencies •

    Sign up for mailing lists • Most Linux distros have a list • oss-security for general announcements • Hook it up to PagerDuty
  19. PATCH PARTY • Someone needs to coordinate/own the process •

    Assign owners to each app or server • Google Spreadsheet is great for this • Make sure you cover every environment

    account • Every account can have API access • Accounts can be protected with two-factor
  21. SECURITY GROUPS • Provide logical separation for servers • Great

    first level firewall • Only assignable at instance creation • Think about it up front
  22. PCI-DSS • Not intended to be a boogeyman • Every

    business that takes credit cards • Self-assesment process until you get large • Quarterly vulnerability scans
  23. • Assess what happened • Hire a forensics consultant •

    Work with authorities • Patch the holes • Determine your legal obligations • Unfortunately may involve lawyers
  24. NOTIFY THE PUBLIC • Might want to hire a PR

    firm • Setup a dedicated information site • Email your users as soon as possible • Clear instructions, all the information