Colchester Digital: Security & Identity - 2018

Colchester Digital meetup talk on Security and Identity in 2018

Transcript

1. Security & Identity - 2018 Luke Oliff 1
2. About me • Working in technology for 12+ years. • IT Management • Development Lead • Head of Development • R&D Content Engineer / Technical Writer 2
3. What is identity? Identity 3 /ʌɪˈdɛntɪti/ noun The fact of being who or what a person or thing is.
4. Every online experience involves identity 4
5. And then you login! 5 Who built that authentication process?
6. Is it going to be more robust than a provider? 6
7. Let’s look at some stats. 7
8. – 9.7 billion records lost or stolen since 2013 breachlevelindex.com (stats from 2017 summary)
9. – In 2017! 1000+ incidents involving 1.9BN records breachlevelindex.com (stats from 2017 summary)
10. – Costs average $3.62M per breach or $150 per record breachlevelindex.com (stats from 2017 summary)
11. – Only 4% of those were encrypted breachlevelindex.com (stats from 2017 summary)
12. – 60% of breaches linked to employees breachlevelindex.com (stats from 2017 summary)
13. – 75% of those were malicious, 25% accidental breachlevelindex.com (stats from 2017 summary)
14. Equifax, entirely preventable. 14 • Discovered March 2017 • Breached mid-May 2017 • Breached for 2 months • Sent victims to scam site • Didn’t secure systems
15. But, what about this year (2018)? 15
16. Who are Cambridge Analytica? 16
17. How is this relevant? Users discover that their data is exposed. 17
18. Breaches are really damaging. 1 in 20 UK users have deleted their Facebook accounts. 18
19. What can you do about it? 19 Don’t try and build identity management. Leave it to the experts.
20. Still want to build? 20 Vulnerability scans are available.
21. Still want to build? 21 Don’t store credentials in JavaScript.
22. Why isn’t every website https? How much does a certificate cost? 22
23. There are other tools in your toolbox HTTP Strict Transport Security 23
24. There are other tools in your toolbox X-XSS-Protection 24
25. There are other tools in your toolbox X-Frame-Options 25
26. There are other tools in your toolbox Content Security Policy 26
27. There are other tools in your toolbox Cookie Security 27
28. Conclusion Complacency is the enemy. 28 Review often. Never compromise. Prepare containment. Prepare contingency. Prepare communication.
29. – EOF