Delivering Javascript to World+Dog
Black Hat USA 2017 Video https://youtu.be/37FDdXCFGX0 You've joined a startup building the next big enterprise unicorn. The product is delivered as javascript on all of your customers' websites. What could go wrong? The threat model of serving third party javascript all over the web will be reviewed. There's plenty of room for small engineering mistakes that lead to pwn-once, exploit everywhere fail. Strategies for focusing your SDL on these flaws will be discussed. Next, defenses in key points of the delivery architecture will be explored, from the SaaS platform to CDNs to browsers. Now for the money - what does it take to convince customers to serve your code? It's a big leap of faith for customers to trust you and your arbitrary javascript on their site. The deeper their pockets are, the higher they set the bar for you throughout your architecture. What do they expect in your SDL? Finally, how do you sell this in your organization? Going beyond SDL best practices, strategies for building a product & engineering culture of protecting javascript delivery will be shared.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Delivering Javascript to World+Dog
Similar to Delivering Javascript to World+Dog (20)
Recently uploaded
Recently uploaded (20)
Delivering Javascript to World+Dog
- 2. Background Enterprise SaaS Third party javascript Functional Spec Include JS on site, increase biz What could go wrong?
- 3. The Problem Javascript - delivering code + data in one Browser can’t always tell the difference 3rd party js - Hack once, pwn everywhere
- 5. Threat Model Pwn any of these to have your Gigya moment • Customer • App admin • App developer • AWS Admin • CDN developer or admin • CDN • DNS • Staging • Vuln in payload
- 6. Humans - the Weakest Link Even after you get your shizz together, your customers won’t
- 7. Humans - the Weakest Link Startup developers want to move fast, unencumbered by big company bureaucracy. They ship code daily. More access means less headaches getting their job done. Least Privilege Managing Secrets
- 8. Good- modern password best practices Better - 2FA Best - SAML SSO Enterprise SaaS Authentication
- 9. Safely Creating Business Value No custom js Output encode everything
- 10. Absolutely minimize attack surface Log, publish HMAC of builds HTTPS build fn HTTPS to stage bucket HTTPS to CDN Third Party Library Management Building and Staging
- 11. CDN HTTPS everywhere Minimize admins Logging Change Management SSO, 2FA
- 12. HTTPS everywhere Have a backup ready DNS CAA Secure DNS? DNS
- 13. TLS Cert Transparency Pinning Pinning Preload HTTP2 Server Push SHA-2 certs Update ciphersuites regularly
- 14. Browser Cookies, HTML5 Local Storage Data will be scrutinized and tampered with Integrity checks first Don’t store sensitive data
- 15. HTTP2 - no need to bundle Server Push Long lived connections Colliding with Performance Load first on page TLS latency TLS tuning Can’t break up javascript Can’t break up data
- 16. CSP Great idea Least worst, allow unsafe Hardly any customers ask for it CSPv3?
- 17. Subresource Integrity Integrity Check Static Ties your hands
- 18. Self Hosted Not sustainable Need rigorous agile release See server side
- 19. Bug Bounty What finds legit high severity bugs in the JS? $1000 Bounty - Nope $5000 Bounty - Nope $10000 Bounty - ? 10k/1 week of a $300/hr consultant? Yup
- 20. Availability Have backup: • DNS • CDN • Origin • Build • Configuration
- 22. For More @kylerandolph about.me/kylerandolph Like this? Optimizely is Hiring! optimizely.com/careers
- 23. TLS is essential Javascript integrity must be ensured end-to-end Don’t give your customers the opportunity to make insecure choices Black Hat Sound Bytes