Continuous Security
Report
Equal ExpertsFollow
May. 24, 2016•0 likes•1,078 views
4 likes
Be the first to like this
Show More
views
Total views
0
On Slideshare
0
From embeds
0
Number of embeds
0
Check these out next
Continuous Security
May. 24, 2016•0 likes•1,078 views
4 likes
Be the first to like this
Show More
views
Total views
0
On Slideshare
0
From embeds
0
Number of embeds
0
Download to read offline
Report
Software
Talk given by Phil Parker (Partner at Equal Experts) at London Continuous Delivery Meetup hosted at Financial Times, Monday 23rd May, 2016.
Equal ExpertsFollow
Recommended
Continuous SecurityEqual Experts
3Pillar Global's Kit Unger and Alok Jain to Explore "How Customers Think" at ...3Pillar Global
Human is an amateur; the monkey is an expert. How to stop trying to secure yo...Vlad Styran
Logs: Understanding Them to Better Manage Your WordPress SiteSucuri
Challenges Building the WordPress REST API (API Strategy & Practice, Chicago ...andrewnacin
Prototyping Your Way to Better and Faster Outcomes 3Pillar Global
Continuous Security
- CONTINUOUS SECURITY THANK YOU!
- @parker0phil
- @parker0phil How do we achieve Security in a Continuous Delivery environment?
- @parker0phil 3. Continuous Delivery IS MORE secure!
- @parker0phil 2. Continuous Delivery IS MORE secure!
- @parker0phil 2. Continuous Delivery IS MORE secure!
- @parker0phil 2. Continuous Delivery IS MORE secure!
- @parker0phil 1. Continuous Delivery IS MORE secure! Mean Time to Detect (MTTD) Mean Time to Resolve (MTTR) RELEASE FIND VULN FIX VULN Attack Window MTTD MTTE
- @parker0phil Continuous Delivery IS MORE secure!
- @parker0phil 3. Thinking about Security
- @parker0phil 3. Thinking about Security
- @parker0phil 2. Thinking about Security Exploitability Impact
- @parker0phil 1. Thinking about Security 1. Rely on developers and testers more than security specialists. 2. Secure while we work more than after we’re done. 3. Implement features securely more than adding on security features. 4. Mitigate risks more than fix bugs.
- @parker0phil Thinking about Security
- @parker0phil Pet Hate #3
- @parker0phil Encoding Hashing Encryption Signing Pet Hate #2 b2JmdXNjYXRpb24= %3Cscript%3Ealert(0) %3C%2Fscript%3E Integrity + Non-repudiation Confidentiality
- @parker0phil Pet Hate #1
- @parker0phil Pet Hates!
- @parker0phil 3. Enumeration of Usernames
- @parker0phil 3. Enumeration of Usernames
- @parker0phil 2. Unvalidated Redirects ?queryString=param Cookie:value Persisted
- @parker0phil 2. Unvalidated Redirects ?queryString=param Cookie:value Persisted
- @parker0phil 1. Cross-Site Request Forgery (CSRF)
- @parker0phil BONUS. SelfXSS
- @parker0phil BONUS. SelfXSS
- @parker0phil My Favourite attacks!
- @parker0phil Continuous Delivery IS MORE secure How we achieve Security in a CD environment Mental Models for Security Pet Hates My Favourite attacks
- @parker0phil Security is HARD
- #DevSecOpsDevSecOps#DevSecOps
- CONTINUOUS SECURITY