Security Patterns 2012

Transcript

1. Security Patterns mehr als nur Authentifizierung und Autorisierung Mike Wiesner mwiesner@vmware.com
3. Application Security?
4. Enterprise Java = Spring Spring + Security = Spring Security
5. Authentication Authorization
6. Fertig?
7. • Injection • Cross-Site Scripting (XSS) • Broken Authentication and Session Management • Insecure Direct Object References • Cross-Site Request Forgery (CSRF) • Security Misconfiguration • Insecure Cryptographic Storage • Failure to Restrict URL Access • Insufficient Transport Layer Protection • Unvalidated Redirects and Forwards OWASP Top Ten
8. Security ist ein Prozess
9. select * from users where user = 'user' and password = '' or '1' = '1' Login BBI Webserver Client Database ' or '1' = '1 user SQL Injection
10. XML Processing
11. fromFile newOrderXml download box downloadSecured boxSecured
12. Alle noch wach?
13. Demo Time!
14. Input Validation
15. JSR-303: Bean Validation public class Address { @NotNull @Length(max=30) private String addressline1; @Length(max=30) private String addressline2; }
16. Trust Zones
18. OWASP Top Ten • Injection • Cross-Site Scripting (XSS) • Broken Authentication and Session Management • Insecure Direct Object References • Cross-Site Request Forgery (CSRF) • Security Misconfiguration • Insecure Cryptographic Storage • Failure to Restrict URL Access • Insufficient Transport Layer Protection • Unvalidated Redirects and Forwards
19. Demo Time!
20. Security Misconfiguration • Eingesetzte Frameworks kennen • Eingesetze Frameworks dokumentieren • Prozess bei Security Bugs in Frameworks • Frameworks “verstecken”
21. OWASP Top Ten • Injection • Cross-Site Scripting (XSS) • Broken Authentication and Session Management • Insecure Direct Object References • Cross-Site Request Forgery (CSRF) • Security Misconfiguration • Insecure Cryptographic Storage • Failure to Restrict URL Access • Insufficient Transport Layer Protection • Unvalidated Redirects and Forwards
22. Fertig?
23. Encoding Problems Internet Tomcat Browser File- System ../ %C0%AE%C0%AE%C0%AF
24. Defense in Depth
25. Fazit • Application Security ist ein Prozess • Jeder Entwickler muss die Grundlagen kennen • Darf nicht die Innovation stoppen • Frameworks können dabei helfen, • aber nicht alle Probleme lösen!
26. Mike Wiesner mwiesner@vmware.com http://bit.ly/SECPATTERN12