![@darkmsph1t
the common refrain
“That’s handled somewhere
else
[downstream/upstream/some
other made up place]”
“Is this really that big of a
problem? What’s the
likelihood that anyone will
ever find this?”
“Where does it say we have
to do that?”](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommended
Recommended
More Related Content
Similar to Building Secure By Default Nodejs Applications
Similar to Building Secure By Default Nodejs Applications (20)
Recently uploaded
Recently uploaded (20)
Building Secure By Default Nodejs Applications
- 1. @darkmsph1t o n e s i z e f i t s m e BUILDING SECURE-BY-DEFAULT NODEJS APPLICATIONS yolonda smith AKA: What I did this summer while all the other kids were outside playing
- 2. @darkmsph1t the common refrain “That’s handled somewhere else [downstream/upstream/some other made up place]” “Is this really that big of a problem? What’s the likelihood that anyone will ever find this?” “Where does it say we have to do that?”
- 3. @darkmsph1t
- 4. @darkmsph1t t h e c h a l l e n g e CAN I FOLLOW MY OWN ADVICE?
- 5. @darkmsph1t rules of engagement 1. Assume limited-knowledge or background in security 2. Tech stack used should offer (relatively) low barrier to entry and yet… • Widely used in production environment I’m familiar with 3. Final application must implement security guidance from a well-known framework (e.g. NIST, OWASP)
- 6. @darkmsph1t key requirements build “security” in from the very beginning contextualized to application flexible enough to adjust to app changes cover all the bases provide everything needed to build an application which is ‘secure by default’
- 7. @darkmsph1t ___ ___ _ ___ _____ _ _ _ / __| | _ /_ |_ |_ _| /_ | | | ___ __ | _/ / _ | / | | / _ | .` | |___| |___/ |_ | /_/ _ |_ |_ |_| /_ / _ |_ | _| IN T R ODUCING
- 8. @darkmsph1t what is it? • node app deployed as an npm cli module • Delivers policy (security.json) & boilerplate code/middleware for immediate use • Built-in support: • Redis • MongoDB • Firebase && local authentication • Synk => application dependency vulnerabilities • mocha-chai => unit testing • Coveralls => test coverage • TravisCI-ready
- 9. @darkmsph1t concept of operations CACHE DATABASE SESSIONS SECURITY HEADERS FORMS CONNECTION SECRETS CLIENT ACCESS CONTROL CSP CACHE CORS APP DEPENDENCIES
- 10. @darkmsph1t
- 11. @darkmsph1t • Shouldn’t need domain expertise needed to get basics done • Security things for other security people • Security with the application not around the application
- 12. @darkmsph1t d e m o n s t r a t i o n YOU CAN PLAY TOO! node npm git* Your fave text editor/IDEterminal
- 13. @darkmsph1t npm init -y Optional : git init
- 14. @darkmsph1t npm install -g spartan-shield yarn add spartan-shield
- 16. @darkmsph1t p r a c t i c a l e x a m p l e NEUTRALIZING DIGITAL SKIMMERS WITH _SPARTAN
- 18. @darkmsph1t what are the options? 1. JSONP…please, God, no… 2. Regenerate js for every page load • Shorten cache period 3. Minimize the amount of 3P javascript running on sensitive pages 4. Limit the context where 3P javascript can run (e.g. sandbox) and what permissions it has (CORS) 5. Track changes in javascript that we do allow • Make sure we know when failures occur
- 19. @darkmsph1t what did we get done? CACHE SESSIONS SECURITY HEADERS FORMS CONNECTION SECRETS CLIENT ACCESS CONTROL CSP CACHE CORS APP DEPENDENCIES DATABASE
- 21. @darkmsph1t what’s next? 1. (More) testing, refactor & documentation 2. Desktop (Electron) app && REST API 3. Introduction of audit through RBAC • Track policy changes • Very basic fuzzing & code-audit 4. Port boilerplate to other languages • GO, Spring, Ruby top priorities
- 22. @darkmsph1t unsolicited advice 1. DO know what you have, understand its value and watch it a. This includes infrastructure 2. DON’T rely on the pen-test to catch all of the security issues 3. DO devote at least one sprint/epic on secure design & code review 4. DO make sure that you have a means of detecting attempts to circumvent your controls
- 23. @darkmsph1t q u e s t i o n s
- 24. @darkmsph1t o n e s i z e f i t s m e BUILDING SECURE-BY-DEFAULT NODEJS APPLICATIONS @darkmsph1t darkmsph1t.github.io darkmsph1t@gmail.com
- 25. @darkmsph1t • All things skimmer: • https://otx.alienvault.com/pulse/5ba3c739f1b1ed67ed7764c1 • https://gwillem.gitlab.io/tag/skimming/ • https://gwillem.gitlab.io/2018/09/18/abs-cbn.com-hacked/ resources & references