Holistic InfoSec For Web Developers

Slide 1

Slide 1 text

Holistic InfoSec IoT Physical People Mobile Cloud VPS Network Web App Web App for Web Developers

Slide 2

Slide 2 text

No content

Slide 3

Slide 3 text

5: Identify Risks?

Slide 4

Slide 4 text

5: Identify Risks?

Slide 5

Slide 5 text

5: Identify Risks?

Slide 6

Slide 6 text

5: Identify Risks?

Slide 7

Slide 7 text

5: Identify Risks? Defence in Depth

Slide 8

Slide 8 text

5: Identify Risks? Security Thinking Up-front

Slide 9

Slide 9 text

5: Identify Risks?

Slide 10

Slide 10 text

5: Identify Risks?

Slide 11

Slide 11 text

Requirements or design defect found via Product Backlog Item (PBI) collaboration Length of Feedback Cycle Cost Requirements or design defect found in Test Conditions Workshop Programming or design defect found via Pair Programming Programming defect found via Continuous Integration Programming or design defect found via Test Driven Development (T(B)DD) Requirements or design defect found via Stakeholder Participation Defect found via pair Developer Testing Defect found via Independent Review Requirements defect found via traditional Acceptance Testing Programming or design defect found via Pair Review Design defect found via traditional System Testing Programming defect found via traditional System Testing Security defect found via traditional external Penetration Testing

Slide 12

Slide 12 text

Slide 13

Slide 13 text

5: Identify Risks?

Slide 14

Slide 14 text

5: Identify Risks? But increasing quality has to be expensive right?

Slide 15

Slide 15 text

5: Identify Risks? Nope!

Slide 16

Slide 16 text

5: Identify Risks? Test condition workshop...

Slide 17

Slide 17 text

5: Identify Risks? Test condition workshop... Given When Then There are no items in the shopping cart Customer clicks “Purchase” button for a book which is in stock 1 x book is added to shopping cart. Book is held - preventing selling it twice. “ Customer clicks “Purchase” button for a book which is not in stock Dialog with “Out of stock” message is displayed and offering customer option of putting book on back order.

Slide 18

Slide 18 text

5: Identify Risks? Given When Then There are no items in the shopping cart User tries to downgrade TLS and the HSTS header is not sent by the server User should be redirected (response 301 status code) to the HTTPS site from the server “ User tries to downgrade TLS and the HSTS header is sent by the server User should be redirected to the HTTPS site from the browser (no HTTP traffic for sslstrip to tamper with) Test condition workshop...

Slide 19

Slide 19 text

5: Identify Risks? Injection TLS Downgrade D-DOS? Easy to execute. Tricky to mitigate People in need of education

Slide 20

Slide 20 text

5: Identify Risks? Q/A $

Slide 21

Slide 21 text

5: Identify Risks?

Slide 22

Slide 22 text

5: Identify Risks?

Slide 23

Slide 23 text

5: Identify Risks? People App IoT Mobile VPS Network Cloud Physical

Slide 24

Slide 24 text

5: Identify Risks? Injection TLS Downgrade D-DOS? Easy to execute. Tricky to mitigate People in need of education Buffer Overflows

Slide 25

Slide 25 text

5: Identify Risks? IoT Physical People Mobile Cloud VPS Network Web App

Slide 26

Slide 26 text

1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What risks does solution cause? 5: Costs and Trade-offs

Slide 27

Slide 27 text

5: Identify Risks? https://github.com/binarymist/ HolisticInfoSec-For-WebDevelopers/ wiki

Slide 28

Slide 28 text

1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What risks does solution cause? 5: Costs and Trade-offs

Slide 29

Slide 29 text

5: Identify Risks? 1: Asset Identification

Slide 30

Slide 30 text

1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What risks does solution cause? 5: Costs and Trade-offs

Slide 31

Slide 31 text

5: Identify Risks? 2: Identify Risks

Slide 32

Slide 32 text

5: Identify Risks? 2: Identify Risks Dependency

Slide 33

Slide 33 text

5: Identify Risks? 2: Identify Risks Likelihood Threat Agent Factors ● Skill level ● Motive ● Opportunity ● Size

Slide 34

Slide 34 text

5: Identify Risks? 2: Identify Risks Likelihood Vulnerability Factors ● Ease of discovery ● Ease of exploit ● Awareness ● Intrusion detection

Slide 35

Slide 35 text

5: Identify Risks? 2: Identify Risks Impact Technical Factors ● Loss of confidentiality ● Loss of integrity ● Loss of availability ● Loss of accountability

Slide 36

Slide 36 text

5: Identify Risks? 2: Identify Risks Impact Business Factors ● Financial damage ● Reputation damage ● Non-compliance ● Privacy violation

Slide 37

Slide 37 text

5: Identify Risks? 2: Identify Risks Risk = Likelihood * Impact

Slide 38

Slide 38 text

2: Identify Risks

Slide 39

Slide 39 text

1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What risks does solution cause? 5: Costs and Trade-offs

Slide 40

Slide 40 text

No content

Slide 41

Slide 41 text

3: Countermeasures Break Your System

Slide 42

Slide 42 text

1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What risks does solution cause? 5: Costs and Trade-offs

Slide 43

Slide 43 text

● Avoid Commercial ● Use Public-Domain 4: Risks that solution causes

Slide 44

Slide 44 text

4: Risks that solution causes New Mitigated

Slide 45

Slide 45 text

1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What risks does solution cause? 5: Costs and Trade-offs

Slide 46

Slide 46 text

5: Costs and Trade-offs Establish Value Loss of Convenience

Slide 47

Slide 47 text

5: Costs and Trade-offs

Slide 48

Slide 48 text

1: Asset Identification 2: Identify Risks 3: Countermeasures 4: What risks does solution cause? 5: Costs and Trade-offs