Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Introdução ao OWASP

3,546 views

Published on

Published in: Technology
  • DOWNLOAD THAT BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book that can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer that is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story That Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money That the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths that Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THAT BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book that can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer that is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story That Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money That the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths that Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THAT BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://urlzs.com/UABbn } ......................................................................................................................... Download Full EPUB Ebook here { https://urlzs.com/UABbn } ......................................................................................................................... Download Full doc Ebook here { https://urlzs.com/UABbn } ......................................................................................................................... Download PDF EBOOK here { https://urlzs.com/UABbn } ......................................................................................................................... Download EPUB Ebook here { https://urlzs.com/UABbn } ......................................................................................................................... Download doc Ebook here { https://urlzs.com/UABbn } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book that can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer that is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story That Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money That the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths that Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THAT BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://urlzs.com/UABbn } ......................................................................................................................... Download Full EPUB Ebook here { https://urlzs.com/UABbn } ......................................................................................................................... Download Full doc Ebook here { https://urlzs.com/UABbn } ......................................................................................................................... Download PDF EBOOK here { https://urlzs.com/UABbn } ......................................................................................................................... Download EPUB Ebook here { https://urlzs.com/UABbn } ......................................................................................................................... Download doc Ebook here { https://urlzs.com/UABbn } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book that can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer that is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story That Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money That the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths that Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • -- DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT -- ......................................................................................................................... ......................................................................................................................... Download FULL PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... (Unlimited)
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Be the first to like this

Introdução ao OWASP

  1. 1. OWASP: Introdução Carlos Serrão OWASP Portugal ISCTE/DCTI/Adetti/NetMuST Abril, 2009 carlos.serrao@iscte.pt carlos.j.serrao@gmail.com OWASP Copyright © 2004 - The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License. The OWASP Foundation http://www.owasp.org
  2. 2. O que é o OWASP?  Open Web Application Security Project  Promove o desenvolvimento seguro de software  Orientado para o desenvolvimento de serviços baseados na web  Focado principalmente em aspectos de desenvolvimento do que em web-design  Um fórum aberto para discussão  Um recurso gratuito e livre para qualquer equipa de desenvolvimento OWASP 2
  3. 3. O Que é OWASP?  Open Web Application Security Project an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted  Promover o desenvolvimento seguro  Auxiliar a tomada de decisão quanto ao risco  Oferecer recursos gratuitos  Promover a contribuição e partilha de informação OWASP 3
  4. 4. O que é o OWASP?  Open Web Application Security Project  Organização sem fins lucrativos, orientada para esforço voluntário   Todos os membros são voluntários   Todo o trabalho é “doado” por patrocinadores  Oferecer recursos livres para a comunidade   Publicações, Artigos, Normas   Software de Testes e de Formação   Chapters Locais & Mailing Lists  Suportada através de patrocínios   Suporte de empresas através de patrocínios financeiros ou de projectos   Patrocínios pessoais por parte dos membros OWASP 4
  5. 5. Organização do OWASP OWASP OWASP OWASP Governance Conferences OWASP Wiki OWASP OWASP Foundation (501c3) Tools OWASP Chapter Leaders OWASP Lists Board of Operations Technical Board of Directors OWASP OWASP Director Director Advisors Books (Williams, Wichers, Project Brennan, Cruz, and (McNamee) (Casey) Deleersnyder) Leaders OWASP Community OWASP
  6. 6. O que é o OWASP?  O que oferece?  Publicações   OWASP Top 10   OWASP Guide to Building Secure Web Applications  Software WebGoat   WebScarab   oLabs Projects   .NET Projects    Chapters Locais   Orientação das comunidades locais OWASP 6
  7. 7. OWASP Ferramentas e Tecnologias •  Vulnerability •  Penetration •  ESAPI Scanners Testing Tools •  Static Analysis •  Code Review Tools Tools •  Fuzzing Automated Manual Security Security Security Architecture Verification Verification •  AppSec Libraries •  Reporting Tools •  Flawed Apps •  ESAPI Reference •  Learning Implementation Environments •  Guards and •  Live CD Filters •  SiteGenerator Secure AppSec AppSec Coding Management Education OWASP 7
  8. 8. Publicações OWASP  Características Comuns  Todas as publicações OWASP estão disponíveis para download gratuíto em http://www.owasp.org  Todas as publicações são licenciadas em GNU “Lesser” GNU Public License (LGPL), ou em GNU Free Documentation License (GFDL)  Documentação “viva”   Actualizada sempre que necessário   Projectos evolutivos  As publicações do OWASP são o resultado de trabalho cooperativo entre os membros OWASP 8
  9. 9. Publicações OWASP – OWASP Top 10  Top 10 Web Application Security Vulnerabilities  Uma lista dos 10 aspectos de segurança mais críticos  Actualizado numa base annual  Crescente aceitação pela indústria   Federal Trade Commission (US Gov)   US Defense Information Systems Agency   VISA (Cardholder Information Security Program)  Está a ser adoptado como um standard de segurança para aplicações web OWASP 9
  10. 10. Publicações OWASP - OWASP Top 10  Top 10 (versão 2004)  A1. Unvalidated Input  A2. Broken Access Controls  A3. Broken Authentication and Session Management  A4. Cross Site Scripting Flaws  A5. Buffer Overflows  A6. Injection Flaws  A7. Improper Error Handling  A8. Insecure Storage  A9. Denial of Service  A10. Insecure Configuration Management OWASP 10
  11. 11. Publicações OWASP - OWASP Top 10  Top 10 (versão 2007)  A1. Cross Site Scripting (XSS)  A2. Injection Flaws  A3. Malicious File Execution  A4. Insecure Direct Object Reference  A5. Cross Site Request Forgery (CSRF)  A6. Information Leakage and Improper Error Handling  A7. Broken Authentication and Session Management  A8. Insecure Cryptographic Storage  A9. Insecure Communications  A10. Failure to Restrict URL Access OWASP 11
  12. 12. Publicações OWASP - OWASP Guide  Guia para o Desenvolvimento Seguro de Web Apps  Oferece um conjunto de linhas gerais para o desenvolvimento de software seguro   Introdução à segurança em geral   Introdução à segurança aplicacional   Discute áreas-chave de implementação –  Arquitectura –  Autenticação –  Gestão de Sessões –  Controlo de Acesso e Autorização –  Registo de Eventos –  Validação de Dados  Em contínuo desenvolvimento OWASP 12
  13. 13. Publicações OWASP – Projectos em Curso  Projectos em Curso  Projecto de Métricas & Medidas   Tenta desenvolver um conjunto de métricas de segurança que podem ser usadas para suportar decisões críticas de negócio  Projecto de Testes   Tenta produzir uma framework de “boas práticas”   Tenta produzir uma framework de testes de “baixo nível” que permite identificar certos aspectos  AppSec Faq   FAQ para programadores que se foca em segurança aplicacional   Oferece respostas a questões sobre segurança aplicacional OWASP 13
  14. 14. Software OWASP  Características Comuns  Todo o software OWASP é oferecido e pode ser obtido em http://www.owasp.org  O software está licenciado com uma licença GNU “Lesser” GNU Public License (LGPL)  Projectos Activos   Actualizados sempre que necessário   Projectos em curso   Multiplos programadores a contribuirem e a menterem  O software OWASP pode ser descarregado livremente e pode ser usado por indivíduos e empresas OWASP 14
  15. 15. Software OWASP - WebGoat  WebGoat  Essencialmente é uma aplicação de treino  Oferece   Uma ferramenta educacional usada para ensinar e aprender sobre segurança aplicacional   Uma ferramenta para testar ferrementas de segurança  O que é?   Uma aplicação web J2EE disposta em diversas “Lições de Segurança”   Baseado no Tomcat e no JDK 1.5   Orientada para o ension –  Fácil de usar –  Ilustra cenários credíveis –  Ensina ataques realistas e soluções viáveis OWASP 15
  16. 16. Software OWASP - WebGoat  WebGoat – O que se pode aprender?  Um número crescente de ataques e de soluções Cross Site Scripting   SQL Injection Attacks   Thread Safety   Field & Parameter Manipulation   Session Hijacking and Management   Weak Authentication Mechanisms   Mais ataques vão sendo adicionados    Obter a ferramenta   http://www.owasp.org/software/webgoat.html   Descarregar, descomprimir, e executar OWASP 16
  17. 17. Software OWASP - WebScarab  WebScarab  Uma framework para analizar tráfego HTTP/HTTPS  Escrito em Java  Múltiplas utilizações   Programador: fazer o debug das trocas entre o cliente e servidor   Analista de Segurança: analiza o tráfego e identifica vulnerabilidades  Ferramenta técnica Focada em programadores de software   Arquitectura extensível de plug-ins   Open source; de fácil expansão   Poderosa    Obter a ferramenta   http://www.owasp.org/software/webscarab.html OWASP 17
  18. 18. OWASP Summer of Code – SoC 2009  Projectos inovadores  Alcançar qualidade para publicação  6 ferramentas/ 7 documentação  Investimentos:  Autumm of Code 2006   9 projetos / US$20K  Spring of Code 2007   21 projetos / US$117K  Summer of Code 2008   33 projetos / US$126K OWASP 18
  19. 19. Chapters locais da OWASP  Desenvolvimento de comunidades  Os Chapters locais proporcionam oportunidades para os membros OWASP poderem partilhar ideias e aprender mais sobre segurança da informação  Aberto a *TODOS*  Oferecer um fórum para discussão de assuntos em contextos locais/regionais  Oferecer o local para convidados poderem apresentar novas ideias e projectos OWASP 19
  20. 20. Chapters locais da OWASP OWASP 20
  21. 21. OWASP em Números  420.000 page views por mês  230 GB de download por mês  4.618 utilizadores do wiki  200 actualizações por dia  124 capítulos (chapters)  16.000 membros nas mailings lists  48 projectos de ferramentas e documentos  100 membros individuais  48 membros corporativos/educacionais  2 empregados OWASP 21
  22. 22. Chapters Locais da OWASP  O que oferecem?  Reuniões regulares  Mailing Lists  Apresentações e Grupos  Ambientes independentes do vendedor  Fóruns de discussão aberta OWASP 22
  23. 23. Chapters Locais da OWASP  O que oferecem?  Como contribuir?   Através das ML, reuniões e dos grupos de discussão   Os membros são encorajados a levantarem questões   Os membros são encorajados a participar em projectos OWASP –  Contribuir para projectos existentes –  Propor novos projectos –  Lançar novas iniciativas   O Chapter Local deve trabalhar no sentido de manter a organização como um recurso livre, aberto e orientado tecnicamente para o público em geral e para os membros OWASP 23
  24. 24. OWASP  Patrocínios OWASP 24
  25. 25. Perguntas e Respostas carlos.serrao@iscte.pt http://www.owasp.org/index.php/Portuguese OWASP 25

×