PHP & The secure development lifecycle

Loading...

Flash Player 9 (or above) is needed to view presentations.
We have detected that you do not have it on your computer. To install it, go here.

0 comments

Post a comment

    Post a comment
    Embed Video
    Edit your comment Cancel

    2 Favorites

    PHP & The secure development lifecycle - Presentation Transcript

    1. PHP & The Secure Application Development Life-cycle “The art of building secure PHPyramids”
      • Robert van der Linde
      • Santa Clara, 16 september 2008
    2. Who’s that dude?
      • Robert van der Linde
      • 5 years of PHP experience
      • Team lead PaSS-PHP
      • Sogeti’s PHP training coordinator
      • Zend Certified Engineer
    3. Secure PHPyramids
    4. What is a secure application?
      • An application is secure if does exactly what is expected at all times
      Design Implementation
    5. So what do we do?
      • Applications are information
      • Threats are everywhere
      • Creating secure applications need a standardized approach
      • There is tooling available to help you
    6. Application === Information Integrity Availability Confidentiality Information security
    7. Where do you implement security?
    8. Where do threats come from?
      • Conciously
    9. Where do threats come from?
      • Unconsciously
    10. Approach
    11. Requirements
    12. Test plans
      • Training
      • Awareness
      • Outside-the-box thinking
      • Codified security test plans
      • Tools
        • OWASP WebScarab
        • Ratproxy
        • NTO Spider
    13. Test results
      • Review with programmers
      • Reporting and analysis
      • End goal: clean bill of health
    14. Code
      • Owasp PHP top 5
        • Remote code execution
        • Cross site scripting
        • SQL Injection
        • PHP Configuration
        • File system attacks
      • Best practices
        • Whitelisting vs. blacklisting
        • Filter input, escape output
        • Keep errors to yourself
    15. Feedback
      • Consciously handle found issues
      • Praise, not prey
      • Handle proactively
    16. The key to all this
      • Awareness
    17. Implementation at Sogeti
      • PaSS (Pro-active Security Strategy)
      • Workgroup per expertise
        • PHP
        • Design
        • Testing
        • Etc.
      • Added value
    18. Tooling example Finally.... some code!
    19. Setting it up
    20. The result
    21. Working with the result
    22. What’s next?
      • Logging attacks
        • File
        • MySQL
        • Email
      • Reporting and analysis
    23. Thank you for watching
      • Referenties:
        • www.php.net
        • www.owasp.com
        • www.php-ids.org
        • www.sogeti.nl
        • www.zend.com
      • Contact:
      • E: [email_address] IM: [email_address] Skype: linderob Blog: http://php.linde002.nl/

    + guestaaf017guestaaf017, 2 years ago

    custom

    1543 views, 2 favs, 2 embeds more stats

    Slides from the zendcon'08 presentation "PHP & The more

    More info about this document

    © All Rights Reserved

    Go to text version

    • Total Views 1543
      • 1536 on SlideShare
      • 7 from embeds
    • Comments 0
    • Favorites 2
    • Downloads 138
    Most viewed embeds
    • 6 views on http://mysandbox.tvetph.net
    • 1 views on http://php.linde002.nl

    more

    All embeds
    • 6 views on http://mysandbox.tvetph.net
    • 1 views on http://php.linde002.nl

    less

    Flagged as inappropriate Flag as inappropriate
    Flag as inappropriate

    Select your reason for flagging this presentation as inappropriate. If needed, use the feedback form to let us know more details.

    Cancel
    File a copyright complaint
    Having problems? Go to our helpdesk?

    Categories