From 0 to 0xdeadbeef - security mistakes that will haunt your startup

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

From 0 to 0xDEADBEEF:
The security mistakes that will haunt your startup
@diogomonica

Agenda
List of mistakes that are painful to remediate
‣TLS
‣Web Security
‣Passwords
‣Infrastructure
‣Corporate Environment...

Target audience
‣Companies just starting up or in their initial growth phase
‣Every company will hit these issues at some ...

Real Security
Engineers Ship

TLS Mistakes

Not having TLS
from day 1
‣There is no reason to have HTTP endpoints
•Most TLS performance issues are a myth
‣One HTTP lin...

SSLv3 enabled
‣There are essentially no legitimate clients without TLS support
•No, IE6 on SP2 is not a legitimate client
...

Crappy certiﬁcates
‣Choose a good issuer
•If you have an app you will be pinning to it
‣Make sure you are not using MD5 or...

Lack of security
headers
‣Even if you are 100% https, the ﬁrst connection is still vulnerable
•The HSTS header ﬁxes that
‣...

Not keeping up to
date w/ attacks
https://www.ssllabs.com/ssltest/

Web Security Mistakes

Everything under
the same domain
‣Use a completely different domain for all trusted activity
•Example: trustedsite.com VS ...

Cookie scoping as
an afterthought
‣The site blog.diogomonica.com can set cookies with scope diogomonica.com
•Cookie Steali...

Not enabling CSP
in reporting mode
‣The objective is to eventually enable CSP in enforce mode
•Helps track the addition of...

Internal admin
dashboard as part
of the same app
‣Applications usually start off by having admin dashboard built-in
•Acces...

Logging blacklists
‣Logging should work in a white-list model
‣Very easy to end up with PII or other sensitive information...

Password Mistakes

Checking-in secrets
‣Build a secret-distribution story early
•People commit AWS credentials to github repositories all the...

Sharing passwords
around
‣Laptops get stolen/lost all the time
•Full-disk encryption won’t save you against DMA Attacks
•L...

Hashing passwords
‣Use bcrypt
‣Use bcrypt
‣Use bcrypt
http://codahale.com/how-to-safely-store-a-password/

Infrastructure Mistakes

Not making your
application
deployment nimble
‣Run all your applications in containers*
•Allows you to update the underlyi...

Production access
without 2FA
‣Create choke-points for production access
•SSH access should require TOTP token through a B...

Trust from the
corporate network
‣Corporate network should have no trust relations with production (or minimal
trust)
SSH ...

No centralized
logging
‣Create a new service/application check-list for with two items:
•Enable centralized logging
•Ensur...

Not having root
use as an alertable
event
‣#people with the root password should be < #ﬁngers in your hand
‣Log all uses o...

HTTP for your S2S
communication
‣All S2S communication should be HTTPS
Datacenter
Front-end
Server
Back-end
Server
Applica...

Corporate Environment Mistakes

Not having a self-
service check-list
‣Create a self-service security check-list with the following items:
•Download, inst...

Summary
‣There are security issues that every company will eventually have to deal with
‣Some mistakes will be a lot more ...

Q&A
@diogomonica

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

Share
Email

An IDS for browser hijacking by Diogo Mónica 1031 views
Leveraging Honest Users: Stealth Co... by Diogo Mónica 860 views
PhD Thesis Diogo Mónica by Diogo Mónica 1425 views
WiFiHop - mitigating the Evil twin ... by Diogo Mónica 1868 views
Observable Non-Sybil Quorums Constr... by Diogo Mónica 920 views
MultiPath TCP - The path to multipath by Diogo Mónica 7978 views

Top clipped slide

1 of 31 Ad

1 of 31 Ad