Adam Baldwin talks about Node.js security in the enterprise for Node Day 2014 hosted at PayPal

1. Node.js Security in
the Enterprise

2. Hi, I’m Adam

5. Node Security Project

6. @adam_baldwin
@liftsecurity
@nodesecurity
@evilpacket

7. Node.js Security in
the Enterprise

8. Enterprise Security in 3 min
Protect what makes you money
Availability is security
Measure & Iterate
It's not about the vulnerability
You will screw it up anyway

9. What this talk is about
Being informed & Prepared
!
The node security landscape
!
It's all node's fault

10. Communication

11. Understand what the
enterprise cares about,
then do better.

12. The enterprise should
understand you and do
better.

13. Gathering Intel

14. nodejs-sec announcements
https://groups.google.com/forum/#!forum/nodejs-sec

15. Node Security Project

16. Advisories

17. Understanding the
node.js security
landscape

19. The Enterprise
is responsible
for what you
require()

20. Technical Controls

21. Linting
npm install precommit-hook

22. Test Cases
You do this right?

23. npm shrinkwrap
POST
/validate/shrinkwrap
GET
/validate/:module_name/:version

24. npm shrinkwrap example
curl -X POST https://nodesecurity.io/
validate/shrinkwrap -d @npmshrinkwrap.json -H "content-type:
application/json"

25. retire.js
Scan a web app or node app for
use of vulnerable JavaScript
libraries and/or node modules.
http://bekk.github.io/retire.js/

26. What is the greatest
vulnerability that you have
in the enterprise?

27. Is it one of the ....
OWASP Top 10?

28. Every Developer on
your team.

29. Peer Review

30. Peer Review

31. Peer Review

32. Peer Review

33. Blame Node.
It's just how we do things.™

34. </PRESENTATION>
@adam_baldwin | @LiftSecurity