Websites these days strive to get your attention in the hopes that you will stick around long enough to buy a product or two from them. But, not all websites take security as seriously as they should. I have seen websites for financial services organizations that only permitted a 4 character password, ones that would expose customer data with a simple trick. These are just some examples that I’ve been through in which I will highlight the errors that can happen when deploying a site. I will provide examples of poor implementations, code errors discuss how security can be better deployed.

1. Se7en Deadly Sins
of Websecurity
Dave Lewis, Global Advisory CISO
November 21st, 2018

2. Please Allow Me To Introduce
Myself..

3. #WHOAMI
Dave Lewis, Global Advisory CISO

10. ZTN

11. ZTN It’s On Fire Yo!

13. Castles Don’t Scale

14. Don’t trust something just
because it’s on the
“inside” of your firewall

15. Lessons
From History
The sack of Rome in 410 AD

16. Remember when you
only had to outrun
the other hiker?

17. Now there’s more
than enough bear to
go around

18. The Flaming Sword of Justice

19. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Erosion of Trust
PSYOPS, forgery,
civil unrest
Overly broad collection,
reselling, profiling, manipulation
Fake news Data misuse Breaches
Failure to protect legitimately
collected data; bad stewardship

20. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
How can this become
an attack system?

21. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Integrity
Attacks
Subtle or overt corruption
of data to cause failure or simply
undermine trust
Accusing
the Breach
Because it’s really hard
to prove a negative

22. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Defending against
denial of trust attacks.

23. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Being able
to trust
ourselves
Earning
trust from others

24. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• Honesty
• Transparency
• Predictability
• Capability
• Willingness to correct mistakes
• Accountability
Earning Trust Through:

25. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Remember
“Trustworthy Computing”?

26. Data Breaches

27. Attackers: Choose Your Own Adventure

29. Injection
● Any user provided data input can
potentially be an injection point.

30. Sanitize Your Inputs

31. Cardsystems

33. XP_CMDSHELL

34. Example SQL Statement
SELECT ProductName, ProductDescription
FROM Products
WHERE ProductNumber = ProductNumber

35. SQL Query
SELECT ProductName, ProductDescription
FROM Products
WHERE ProductNumber = 123

36. SQL Injection
SELECT ProductName, ProductDescription
FROM Products
WHERE ItemNumber = 123 OR 1=1

37. SQL Attack
http://www.example.tld/store/foo.asp?itemid=123; DROP TABLE USERS
SELECT ProductName, ProductDescription
FROM Products
WHERE ItemNumber = 123; DROP TABLE USERS

38. XSS
● Cross Site Scripting
● Problem exists where proper
validation is missing.
● Attackers can execute scripts,
deface websites or redirect users.

39. Types of XSS ● Reflected XSS
● Stored XSS
● DOM XSS

40. “><SCRIPT>ALERT(‘OWNED’)</SCRIPT>

42. Fixing XSS
● Using frameworks like Ruby on Rails
or React JS which automatically
escape XSS
● Applying context-sensitive encoding
when modifying the browser
document on the client side acts
against DOM XSS.
● Enabling a Content Security Policy
(CSP) is a defense-in-depth
mitigating control against XSS.

43. HTTPS://WWW.OWASP.ORG/INDEX.PHP/
XSS_(CROSS_SITE_SCRIPTING)_PREVENTIO
N_CHEAT_SHEET

44. Configuration
● Security configuration errors lead to
numerous security exposures.

53. HAMMER TO SPREAD BUTTER

54. Geofencing

55. Geofencing Meets GDPR

56. Authentication
● Passwords have come to the end of
their epoch.

58. Is the password…password?

59. No!! Now go away, or I shall taunt you a second time!

64. A Better Way Forward

65. Webauthn

66. Broken
Access
● Low hanging fruit for the attackers

67. What’s Open In Berlin?

68. 34,721,946

69. Meanwhile, In Berlin
1,911,726

70. The Summer of Breach 2012

71. Been There…

72. TWO YEARS AGO…

73. …AND NOW

74. Security Debt: Shared Hosting
275 packages can be updated.
233 updates are security updates.

75. Bastion Hosts

76. From DMZ To The Soft Chewy Centre

77. Known Bad
● Deprecated Libraries
● Roll your own encryption (just no)

78. Checking For Vulnerabilities

79. Web Shells

80. 19.5%
Of CVEs in 2016 were easily
detected low-complexity
vulnerabilities
Year
NumberofCVEs
Total number of CVEs
Number of CVEs low complexity

81. WPScan.org

82. pyfiscan

83. The Authentications Must Flow

85. Logging
● No, really.

86. Summary
● Injection flaws
● XSS
● Configuration
● Authentication
● Broken Access
● Known Bad libraries and software
● Logging

87. Danke Schon!
gattaca@duo.com
@gattaca
www.duo.com