Slide 1
Slide 1 text
there is no silver bullet
Henri Watson
Slide 2
Slide 2 text
Which
vulnerabili.es
commonly
affect
web
applica.ons
in
the
Dominican
Republic?
Slide 3
Slide 3 text
No
HTTPS
Slide 4
Slide 4 text
Using
HTTPS
won’t
cost
you
an
arm
and
a
leg.
Slide 5
Slide 5 text
The
current
proposal
for
HTTP/2.0
requires
TLS.
Slide 6
Slide 6 text
If
you
decide
to
use
HTTPS,
also
use
Strict-‐Transport-‐Security
and
ssllabs.com/ssltest
Slide 7
Slide 7 text
SQL
Injec.ons
Slide 8
Slide 8 text
GET
/tracker?order=12345”;
DROP
TABLE
orders;-‐-‐
SELECT
*
FROM
orders
WHERE
order
=
“12345”;
DROP
TABLE
orders;-‐-‐”
AND
status
=
“pending”
Request
from
the
client
to
the
server
Request
from
the
webserver
to
the
database
Slide 9
Slide 9 text
No content
Slide 10
Slide 10 text
No content
Slide 11
Slide 11 text
No content
Slide 12
Slide 12 text
Authen.ca.on
Implementa.on
Mistakes
Slide 13
Slide 13 text
No content
Slide 14
Slide 14 text
No content
Slide 15
Slide 15 text
Cross-‐Site
Scrip.ng
(XSS)
Slide 16
Slide 16 text
GET
/hi?name=
Hello,
!
Request
from
the
client
to
the
server
Reply
from
the
server
to
the
client
Slide 17
Slide 17 text
Content-‐Security-‐Policy
Slide 18
Slide 18 text
Exposure
of
Sensi.ve
Data
Slide 19
Slide 19 text
No content
Slide 20
Slide 20 text
Using
Components
With
Known
Vulnerabili.es
Slide 21
Slide 21 text
Mailing
Lists
• bugtraq
hep://www.securityfocus.com/archive/1
• debian-‐security-‐announce
heps://lists.debian.org/debian-‐security-‐announce/
• fulldisclosure
hep://nmap.org/mailman/lis.nfo/fulldisclosure
Slide 22
Slide 22 text
Mailing
Lists
• [email protected]
heps://hepd.apache.org/lists.html#hep-‐announce
• nginx-‐announce
hep://mailman.nginx.org/mailman/lis.nfo/nginx-‐
announce
• php-‐announce
hep://php.net/mailing-‐lists.php
Slide 23
Slide 23 text
No content
Slide 24
Slide 24 text
Customer
Service
Slide 25
Slide 25 text
No content
Slide 26
Slide 26 text
Why
is
there
no
“silver
bullet”?
Slide 27
Slide 27 text
Informa.on
security
is
a
constant
investment.
Slide 28
Slide 28 text
Heartbleed
Slide 29
Slide 29 text
By
placing
your
users’
informa.on
at
risk,
you
also
risk
ruining
your
company’s
reputa.on.
Slide 30
Slide 30 text
Thanks!
@henriwatson
[email protected]
heps://henriwatson.com/talks/silverbullet