Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Bezpečnost webových aplikací

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for Jirka "Jurri" Jansa Jirka "Jurri" Jansa
June 06, 2019
Programming
260
0

Bezpečnost webových aplikací

Bezpečnost webových aplikací převážně pohledem OWASP.

Avatar for Jirka "Jurri" Jansa

Jirka "Jurri" Jansa

June 06, 2019

More Decks by Jirka "Jurri" Jansa

See All by Jirka "Jurri" Jansa
ChatGPT pro produktivitu
Avatar for Jirka "Jurri" Jansa jurri
0
78
TM Caffè: Github Copilot
Avatar for Jirka "Jurri" Jansa jurri
0
98
Interní DX: Kutil Tim v každém z nás
Avatar for Jirka "Jurri" Jansa jurri
0
180
Mob and Pair programming 2021 Edition (CZ)
Avatar for Jirka "Jurri" Jansa jurri
0
99
Hardware očima vývojáře aplikací (2021)
Avatar for Jirka "Jurri" Jansa jurri
0
89
Testujte svou pravou DB
Avatar for Jirka "Jurri" Jansa jurri
0
35

Other Decks in Programming

See All in Programming
APNsからLive Activityを開始する話
Avatar for Ryotaro Onoue yumnumm
0
170
Compiling a real-world CLI tool to native with Static Hermes
Avatar for Tzvetan Mikov tmikov2023
0
120
KiroのSpecで「五目並べ」を作ってみる
Avatar for Satoshi Kaneyasu satoshi256kbyte
1
380
機械に任せるテスト、人が見るテスト ⽣成AIで引き直した、運⽤保守フェーズの線引き
Avatar for KUSATAKE Daisuke dske104
0
190
當我們開始不讀 Code - AI Agent 時代，Code Review 與 Clean Code 還剩下什麼？
Avatar for James Wang jame2408
1
210
Findy - エンジニア向け会社紹介/Findy Company Deck
Avatar for Findy findyinc
6
400k
カツオ、ご期待ください
Avatar for saku_totomi suneo3476
0
190
dotNET_vulnclicker_intro.pdf
Avatar for Tomohiko Morita deka_morita
0
140
RAG の “R” を Swift で覗いてみる 〜「意味から探す」検索の仕組み〜
Avatar for Nao-RandD nao_randd
0
160
作れる、でも消せるか？──安全に「枯らして消す」機能削除術 / Drain, Then Delete
Avatar for chobishiba chobishiba
2
640
動作中のプログラムの中身をリアルタイムに覗く / Realtime Debugger for CSharp with Roslyn
Avatar for Prota prota
1
1.9k
UnityでSystem.Net.WebSocketsなWebSocketサーバが動かないのでUnity Monoのコードを覗いてみた / about implementing websocket server with unity mono
Avatar for にー兄さん drumath2237
1
610

Featured

See All Featured
Typedesign – Prime Four
Avatar for Hannes Fritz hannesfritz
42
3.2k
Performance Is Good for Brains [We Love Speed 2024]
Avatar for Tammy Everts tammyeverts
12
1.9k
KATA
Avatar for Megan Lloyd mclloyd
PRO
35
16k
How to optimise 3,500 product descriptions for ecommerce in one day using ChatGPT
Avatar for Katarina Dahlin katarinadahlin
PRO
3
3.9k
Efficient Content Optimization with Google Search Console & Apps Script
Avatar for Katarina Dahlin katarinadahlin
PRO
1
930
Imperfection Machines: The Place of Print at Facebook
Avatar for Scott Boms scottboms
270
14k
Claude Code どこまでも/ Claude Code Everywhere
Avatar for nwiizo nwiizo
68
59k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
Avatar for Morgane Peng morganepeng
133
20k
The innovator’s Mindset - 
Leading Through an Era of Exponential Change - McGill University 2025
Avatar for Jean-Marc De Jonghe jdejongh
PRO
1
380
Leveraging LLMs for student feedback in introductory data science courses - posit::conf(2025)
Avatar for Mine Cetinkaya-Rundel minecr
1
440
SERP Conf. Vienna - Web Accessibility: Optimizing for Inclusivity and SEO
Avatar for Sara Fernández Carmona sarafernandez
2
1.6k
StorybookのUI Testing Handbookを読んだ
Avatar for Shingo Yamazaki zakiyama
31
7k

Transcript

  1. Bezpečnost webových aplikací Jirka Jansa, 2019

  2. zranitelnosti infrastruktura, data, kód, lidi, firmy

  3. zranitelnosti kódu katalog CVE, CWE, skóre CVSS, databáze NVD https://nvd.nist.gov

  4. penetrační testy

  5. ethical hacking https://hackerone.com hacking

  6. red teaming

  7. prevence

  8. OWASP The Open Web Application Security Project https://owasp.org

  9. top 10 injekce, XSS, CSRF, rozbitá autentizace, protokol, citlivá data,

    ... https://github.com/OWASP/Top10 OWASP

  10. juice shop záměrně děravá aplikace http://owasp-juice.shop OWASP

  11. OWTF Offensive Web Testing Framework https://github.com/owtf/owtf OWASP

  12. ASVS The Application Security Verification Standard https://github.com/OWASP/ASVS OWASP

  13. dependency-check plugin pro maven, gradle, jenkins, sonarqube... https://github.com/jeremylong/DependencyCheck OWASP

  14. security guides testing, developer, code review, ... https://github.com/OWASP/OWASP-Testing-Guide-v5 OWASP

  15. cheatsheets https://github.com/OWASP/CheatSheetSeries OWASP

  16. SAMM Software Assurance Maturity Model https://owaspsamm.org OWASP

  17. legislativa především č. 181/2014 Sb. (kybernetický zákon) https://govcert.cz/cs/regulace-a-kontrola/legislativa

  18. rychlý návod… ...jak to alespoň nezkonit

  19. 1. infrastruktura automatizace, updates, ops vs. hotové řešení (cloud)

  20. 2. data bezpečné algoritmy, minimální práva

  21. 3. kód dependency-check, statická analýza, pentesty, ASVS

  22. 4. lidi školení, konference, prostor pro učení, red teaming

  23. 5. firmy SAMM

  24. jak moc, ne jestli je aplikace bezpečná?