Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Bezpečnost webových aplikací

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for Jirka "Jurri" Jansa Jirka "Jurri" Jansa
June 06, 2019
Programming
0
250

Bezpečnost webových aplikací

Bezpečnost webových aplikací převážně pohledem OWASP.

Avatar for Jirka "Jurri" Jansa

Jirka "Jurri" Jansa

June 06, 2019
Tweet

More Decks by Jirka "Jurri" Jansa

See All by Jirka "Jurri" Jansa
ChatGPT pro produktivitu
Avatar for Jirka "Jurri" Jansa jurri
0
55
TM Caffè: Github Copilot
Avatar for Jirka "Jurri" Jansa jurri
0
53
Interní DX: Kutil Tim v každém z nás
Avatar for Jirka "Jurri" Jansa jurri
0
170
Mob and Pair programming 2021 Edition (CZ)
Avatar for Jirka "Jurri" Jansa jurri
0
85
Hardware očima vývojáře aplikací (2021)
Avatar for Jirka "Jurri" Jansa jurri
0
72
Testujte svou pravou DB
Avatar for Jirka "Jurri" Jansa jurri
0
31

Other Decks in Programming

See All in Programming
LLM Observabilityによる 対話型音声AIアプリケーションの安定運用
Avatar for Hiroyuki Moriya gekko0114
2
430
AWS re:Invent 2025参加 直前 Seattle-Tacoma Airport(SEA)におけるハードウェア紛失インシデントLT
Avatar for tetutetu214 tetutetu214
2
120
ノイジーネイバー問題を解決する 公平なキューイング
Avatar for Shoichi Ochi occhi
0
110
要求定義・仕様記述・設計・検証の手引き - 理論から学ぶ明確で統一された成果物定義
Avatar for Kuniwak orgachem
PRO
1
160
Raku Raku Notion 20260128
Avatar for hareyaka hareyakayuruyaka
0
340
CSC307 Lecture 07
Avatar for Javier Gonzalez-Sanchez javiergs
PRO
1
550
Fluid Templating in TYPO3 14
Avatar for Simon Praetorius s2b
0
130
CSC307 Lecture 09
Avatar for Javier Gonzalez-Sanchez javiergs
PRO
1
840
AI Agent の開発と運用を支える Durable Execution #AgentsInProd
Avatar for izumin5210 izumin5210
7
2.3k
izumin5210のプロポーザルのネタ探し #tskaigi_msup
Avatar for izumin5210 izumin5210
1
130
AIエージェントのキホンから学ぶ「エージェンティックコーディング」実践入門
Avatar for Masahiro Nishimi masahiro_nishimi
5
470
責任感のあるCloudWatchアラームを設計しよう
Avatar for アキキー akihisaikeda
3
180

Featured

See All Featured
Claude Code のすすめ
Avatar for schroneko schroneko
67
210k
How to audit for AI Accessibility on your Front & Back End
Avatar for davetheseo davetheseo
0
180
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
57
14k
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
47
7.9k
How to Ace a Technical Interview
Avatar for Jacob Kaplan-Moss jacobian
281
24k
Design in an AI World
Avatar for tapps tapps
0
140
Navigating the Design Leadership Dip - Product Design Week Design Leaders+ Conference 2024
Avatar for Andy Polaine apolaine
0
180
The Anti-SEO Checklist Checklist. Pubcon Cyber Week
Avatar for Ryan Jones ryanjones
0
69
The Web Performance Landscape in 2024 [PerfNow 2024]
Avatar for Tammy Everts tammyeverts
12
1k
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
128
17k
Bridging the Design Gap: How Collaborative Modelling removes blockers to flow between stakeholders and teams @FastFlow conf
Avatar for Kenny Baas-Schwegler baasie
0
450
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
14k

Transcript

  1. Bezpečnost webových aplikací Jirka Jansa, 2019

  2. zranitelnosti infrastruktura, data, kód, lidi, firmy

  3. zranitelnosti kódu katalog CVE, CWE, skóre CVSS, databáze NVD https://nvd.nist.gov

  4. penetrační testy

  5. ethical hacking https://hackerone.com hacking

  6. red teaming

  7. prevence

  8. OWASP The Open Web Application Security Project https://owasp.org

  9. top 10 injekce, XSS, CSRF, rozbitá autentizace, protokol, citlivá data,

    ... https://github.com/OWASP/Top10 OWASP

  10. juice shop záměrně děravá aplikace http://owasp-juice.shop OWASP

  11. OWTF Offensive Web Testing Framework https://github.com/owtf/owtf OWASP

  12. ASVS The Application Security Verification Standard https://github.com/OWASP/ASVS OWASP

  13. dependency-check plugin pro maven, gradle, jenkins, sonarqube... https://github.com/jeremylong/DependencyCheck OWASP

  14. security guides testing, developer, code review, ... https://github.com/OWASP/OWASP-Testing-Guide-v5 OWASP

  15. cheatsheets https://github.com/OWASP/CheatSheetSeries OWASP

  16. SAMM Software Assurance Maturity Model https://owaspsamm.org OWASP

  17. legislativa především č. 181/2014 Sb. (kybernetický zákon) https://govcert.cz/cs/regulace-a-kontrola/legislativa

  18. rychlý návod… ...jak to alespoň nezkonit

  19. 1. infrastruktura automatizace, updates, ops vs. hotové řešení (cloud)

  20. 2. data bezpečné algoritmy, minimální práva

  21. 3. kód dependency-check, statická analýza, pentesty, ASVS

  22. 4. lidi školení, konference, prostor pro učení, red teaming

  23. 5. firmy SAMM

  24. jak moc, ne jestli je aplikace bezpečná?