Downloaded 19 times
Uploaded byAlison Gianotto
LonestarPHP 2014 Security Keynote
This document discusses security concepts and risks. It begins by defining what security is not, such as something that can be bolted on or outsourced. It then covers security principles like defense in depth, and risks to confidentiality, integrity and availability. Specific attacks like SQL injection and XSS are mentioned. Throughout, it emphasizes that all companies face risks and stresses the importance of prioritizing security as even small businesses can be targets.
More Related Content
Similar to LonestarPHP 2014 Security Keynote
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
LonestarPHP 2014 Security Keynote
- 1.
- 2. Alison Gianotto (aka“snipe”)WHO AM I? • Former agency CTO/CSO • Security & privacy advocate • 20 years in IT and so<ware development • Co-‐author of a few PHP/MySQL books • Survivor of more corporate audits than I care to remember • @snipeyhead on TwiJer 2 Lonestar PHP -‐ April 2014 -‐ #lsp14
- 3. WHAT SECURITY ISN’T 1Bolted on 2 Compliance 3 A Single Person 4 Outsourced 3 You don’t add it on at the end. You can be compliant and not secure. Just ask Target. Security is everyone’s responsibility. Throwing money at this problem won’t work. Lonestar PHP -‐ April 2014 -‐ #lsp14
- 4. WHAT SECURITY ISN’T 5An Appliance 6 Silver Bullet 7 Straightforward 4 Firewalls and IDS are part of the soluUon, but not the end. There is no one thing. Defence in depth maJers. Sort of. SomeUmes implemenUng security tools increases your aJack surface. Lonestar PHP -‐ April 2014 -‐ #lsp14 8 Done Security is where you start, not where you finish.
- 5. WHAT RISK ISN’T 1Stifling 2 Boring 3 Avoidable 5 Managing risk doesn’t have to hinder innovaUon Our job is finding creaUve soluUons to problems. This is one more tool. Risk isn’t inherently bad. Not understanding your risk is. Lonestar PHP -‐ April 2014 -‐ #lsp14 4 One Size Acceptable risk to your company may not be the same as someone else’s.
- 6. IT IS IMPOSSIBLETO ANTICIPATE EVERY RISK. 6 Lonestar PHP -‐ April 2014 -‐ #lsp14 Srsly.
- 7. DEFENSE IN DEPTHPROMISES 7 Lonestar PHP -‐ April 2014 -‐ #lsp14 • MiUgates single points of failure. (“Bus factor”) • Requires more effort on the part of the aJacker, theoreUcally exhausUng aJacker resources. Except...
- 8. DEFENSE IN DEPTHPROBLEMS 8 Lonestar PHP -‐ April 2014 -‐ #lsp14 • Larger, more complicated systems are harder to maintain. • Leads to more cracks for bad guys to poke at • More surfaces that can get be overlooked • The bad guys have nearly limitless resources. We don’t. • AJacks are commodiUzed now. Botnets for $2/hour.
- 9.
- 10. CONFIDENTIALITY IS ASET OF RULES THAT LIMITS ACCESS TO INFORMATION 10 Lonestar PHP -‐ April 2014 -‐ #lsp14
- 11. CONFIDENTIALITY EXAMPLES 11 Lonestar PHP -‐ April 2014 -‐ #lsp14 • Passwords. (boo!) • Data encrypUon (at rest and in transmission.) • Two-‐factor authenUcaUon/ biometrics. (Yay!) • Corporate VPN • IP WhitelisUng • SSH keys
- 12. CONFIDENTIALITY RISKS 12 Lonestar PHP -‐ April 2014 -‐ #lsp14 • No brute-‐force detecUon • No velng of how third-‐ party vendors use/store customer data • InformaUon leakage from login messages (Uming aJacks, etc.) • SQL injecUon • Privilege escalaUon leading to admin access • Passwords shared across websites • Improper disposal/ destrucUon of personal data • Lost/stolen devices
- 13. INTEGRITY IS THEASSURANCE THAT THE INFORMATION IS TRUSTWORTHY & ACCURATE. 13 Lonestar PHP -‐ April 2014 -‐ #lsp14
- 14. INTEGRITY RISKS 14 Lonestar PHP -‐ April 2014 -‐ #lsp14 • Data loss due to hardware failure (server crash!) • So<ware bug that unintenUonally deletes/ modifies data • Data alteraUon via authorized persons (human error) • Data alteraUon via unauthorized persons (hackers) • No backups or no way to verify the integrity of the backups you have • Third-‐party vendor with inadequate security
- 15. AVAILABILITY IS AGUARANTEE OF READY ACCESS TO THE INFO BY AUTHORIZED PEOPLE. 15 Lonestar PHP -‐ April 2014 -‐ #lsp14
- 16. AVAILABILITY RISKS 16 Lonestar PHP -‐ April 2014 -‐ #lsp14 • DDoS aJacks • Third-‐party service failures • Hardware failures • So<ware bugs • Untested so<ware patches • Natural disasters • Man-‐made disasters
- 17. THINK YOU’RE TOOSMALL TO BOTHER WITH? 17 Lonestar PHP -‐ April 2014 -‐ #lsp14 Think again.
- 18. WHY HACK? 18 Lonestar PHP -‐ April 2014 -‐ #lsp14 • To steal/sell idenUUes, credit card numbers, corporate secrets, military secrets • Fun, Excitement and/or Notoriety • PoliUcal (“HackUvism”) • Revenge • Blackhat SEO • ExtorUon/Ransomware
- 19. COMMON ATTACKS 19 Lonestar PHP -‐ April 2014 -‐ #lsp14 • Reflected XSS • Persistent XSS • CSRF • SQL InjecUon • Remote file inclusion • Local file inclusion/directory traversal • HosUng malware • Defacement for SEO (pharma, etc) • Privilege escalaUon
- 20. WHY MEEEEEEEEEEEE?? 20 Lonestar PHP -‐ April 2014 -‐ #lsp14 • Users re-‐use passwords across websites • Watering hole aJack • Low-‐hanging fruit • Assumed fewer defenses • To gain more informaUon on users to execute spear-‐ phishing aJacks • Because you are vulnerable. Period.
- 21. IN 2013, 61%OF REPORTED ATTACKS TARGETED SMALL AND MEDIUM BUSINESSES, UP FROM 50% IN 2012. 21 Lonestar PHP -‐ April 2014 -‐ #lsp14 Source: Symantec Internet Security Threat Report 2014 :: Volume 19, Published April 2014
- 22. 1 2 43 REFLECTEDXSS SOCIAL ENGINEERING XSS SESSION HIJACK PWNED 22 Lonestar PHP -‐ April 2014 -‐ #lsp14
- 23. 77% OF LEGITIMATEWEBSITES HAD EXPLOITABLE VULNERABILITIES. 1-IN-8 HAD A CRITICAL VULNERABILITY. 23 Lonestar PHP -‐ April 2014 -‐ #lsp14 Source: Symantec Internet Security Threat Report 2014 :: Volume 19, Published April 2014
- 24. MEGA BREACHES: RESULTINGIN PERSONAL DETAILS OF >= 10 MILLION IDENTITIES EXPOSED IN AN INDIVIDUAL INCIDENT. 24 Lonestar PHP -‐ April 2014 -‐ #lsp14
- 25. THERE WERE EIGHTIN 2013, COMPARED WITH ONLY ONE IN 2012. 25 Lonestar PHP -‐ April 2014 -‐ #lsp14 Source: Symantec Internet Security Threat Report 2014 :: Volume 19, Published April 2014 +700%
- 26. OCT 2013: ADOBE EXPOSEDCUSTOMER DATA, DEBIT/ CREDIT CARD NUMBERS, SOURCE IMPACTED: 152 MILLION USERS 26 Lonestar PHP -‐ April 2014 -‐ #lsp14 Source: Symantec Internet Security Threat Report 2014 :: Volume 19, Published April 2014
- 27. DEC 2013: TARGET EXPOSEDCUSTOMER DATA, DEBIT/ CREDIT CARD NUMBERS, PINS IMPACTED: 110 MILLION USERS 27 Lonestar PHP -‐ April 2014 -‐ #lsp14 Source: Symantec Internet Security Threat Report 2014 :: Volume 19, Published April 2014
- 28. BREACHGrowth • credit card info • birth dates • government ID numbers • home addresses • medical records • phone numbers • financial informa9on • email addresses • login • passwords Data Stolen 28 Lonestar PHP -‐ April 2014 -‐ #lsp14 232 552 0 100 200 300 400 500 600 2011 2013 Iden99es Stolen by Year (in Millions) Source: Symantec Internet Security Threat Report 2014 :: Volume 19, Published April 2014
- 29. 190,000 464,000 570,000 2011 2012 2013 ATTACKS 29 Source: Symantec Internet Security Threat Report 2014 :: Volume 19, Published April 2014 Per Day Lonestar PHP -‐ April 2014 -‐ #lsp14
- 30. APPSEC STRATEGY PICK TWO 30 COMPLETELY BONED COMPLETELY BONED COMPLETELY BONED Lonestar PHP -‐ April 2014 -‐ #lsp14
- 31. CREATING A RISKMATRIX 31 Lonestar PHP -‐ April 2014 -‐ #lsp14 • Type • Third-‐Party • Dataflow diagram ID • DescripUon • Triggering AcUon • Consequence of Service Failure • Risk of Failure • User Impact • Method used for monitoring this risk • Efforts to MiUgate in Case of Failure • Contact info Grab a starter template here! hJp://snipe.ly/risk_matrix
- 32. 29 THINGS YOUCAN START DOING TODAY. 32 Lonestar PHP -‐ April 2014 -‐ #lsp14 Dooo eeeeeet.
- 33. 33 Lonestar PHP -‐ April 2014 -‐ #lsp14 1. Start every project risk-‐first. 2. Start using a risk matrix for every major project or product. 3. Build a clear inventory of surface areas and their value. Get stakeholders involved. 4. Make sure you understand what happens when third-‐ party services fail or behave unexpectedly. 29 THINGS TO DO TODAY
- 34. 34 Lonestar PHP -‐ April 2014 -‐ #lsp14 5. Trust your gut. If something doesn’t look right, it probably isn’t. 6. Keep your systems as simple as possible. Document them. 7. Favor self-‐documenUng systems so that code, systems and docs don't fall out of sync. 8. Increased transparency reduces risk across departments. Consider devops. 29 THINGS TO DO TODAY
- 35. 35 Lonestar PHP -‐ April 2014 -‐ #lsp14 9. Don't abstract code/systems if you don’t have to. Premature opUmizaUon is the devil. Build light and refactor as needed. 10. Get to know your users’ behavior. Use tools like Google AnalyUcs and heat-‐mapping to understand what users do on your site. Be suspicious if it changes for no apparent reason. 29 THINGS TO DO TODAY
- 36. 36 Lonestar PHP -‐ April 2014 -‐ #lsp14 11. Automate EVERYTHING (Chef, Vagrant, Ansible, Salt, Fabric, etc.) 12. Log (almost!) EVERYTHING. Know where your logs are. Use a central logging server if at all possible. 13. Always employ the principles of “least privilege.” 14. Give preference to vendors that integrate with your AD/ OD/LDAP. 29 THINGS TO DO TODAY
- 37. 37 Lonestar PHP -‐ April 2014 -‐ #lsp14 15. Create a reliable data backup plan and TEST IT. (MORE THAN ONCE.) 16. Create a Business ConUnuity Plan. 17. Create an Incident Response Plan. Test it. 18. Create a Disaster Recovery Plan. TEST IT. (Seriously.) 19. Get your team to parUcipate in at least one CTF every year. 29 THINGS TO DO TODAY
- 38. 29 THINGS TODO TODAY 38 Lonestar PHP -‐ April 2014 -‐ #lsp14 20. Strip specific messaging from login forms. 21. Use solid password+salUng like bcrypt. 22. Implement brute-‐force prevenUon for all login systems. 23. Encrypt everything, where feasible. 24. Only collect the data that you absolutely need. 25. Implement two-‐factor authenUcaUon. It’s easier than you think.
- 39. 29 THINGS TODO TODAY 39 Lonestar PHP -‐ April 2014 -‐ #lsp14 26. Supress debugging and server informaUon (PHP versions, Apache versions) 27. Leverage framework CSRF protecUon and data saniUzaUon/validaUon. 28. Perform regular penetraUon tests and vulnerability assessments 29. Become a passionate security ambassador for your users and co-‐workers.
- 40. CAPTURE ALL THEFLAGS! 40 Lonestar PHP -‐ April 2014 -‐ #lsp14 • NotSoSecure CTF: hJp://cx.notsosecure.com • Security Shepherd: hJps://www.owasp.org/index.php/ OWASP_Security_Shepherd • hJp://hax.tor.hu/ • hJps://pwn0.com/ • hJp://www.smashthestack.org/ • hJp://www.hellboundhackers.org/ • hJp://www.overthewire.org/wargames/ • hJp://counterhack.net/Counter_Hack/Challenges.html • hJp://www.hackthissite.org/ • hJp://exploit-‐exercises.com/ • hJp://vulnhub.com/
- 41. Alison Gianotto (aka“snipe”)THANK YOU! • @snipeyhead on TwiJer • snipe@snipe.net 41 Lonestar PHP -‐ April 2014 -‐ #lsp14