Make It Fixable (Sikkert NOK 2017)

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

@pati_gallardo

Make it Fixable
Living with Risk
Patricia Aas
Sikkert NOK 2017
@pati_gallardo

Who am I? @pati_gallardo

Patricia Aas
Programmer - mainly in C++ and Java
Currently : Vivaldi Technologies
Previously : Cisco Systems, Knowit, Oper...

Security is Hard @pati_gallardo

Just Remember :
- You live in the real world
- Take one step at a time
- Make a Plan @pati_gallardo

You Need A Security
“Hotline”
security@example.com
Symbiotic relationship
Be polite
Be grateful
Be professional
Be efficie...

Everybody's An Expert
@pati_gallardo

- They Are. Really. - @pati_gallardo

1. Unable to Roll Out Fixes
2. No Control over Dependencies
3. The Team is Gone
4. It’s in Our Code
5. My Boss Made Me Do ...

Unable to Roll Out Fixes @pati_gallardo
1

Unable to
Roll out Fixes
- Relying on User Updates
- Unable to Build
- Unable to Deploy
- Regression Fear
- No Issue Track...

Internet of Things
Toys: My Friend Cayla, i-Que Intelligent
Robots, Hello Barbie
Mirai: Botnets created with IOT
devices, ...

Fix : Ship It!
Holy Grail : Auto Update
Code
- Get the Code
- Use Version Control
- Keep Build Environment
- Write Integra...

Internet of Things
- Auto-update
- Different default passwords
- Unboxing security
“Shelfware”
- Get maintenance contract
...

No Control over Dependencies @pati_gallardo
2

No Control over
Dependencies
- Too Many Dependencies
- Frameworks are Abandoned
- Libraries Disappear
- Insecure Platform ...

Stagefright
Bugs in the multimedia library on
Android
Heartbleed
Bug in openssl
Left-Pad
Developer unpublished a mini-Js l...

Fix: Control It!
Goal : Dependency Control
Be conservative
- Is it needed?
- Do you understand it?
Be cautious
- Audit you...

Stagefright
Workaround in apps calling into
stagefright
Heartbleed
Control over production environment
Left-Pad
Removing u...

The Team is Gone @pati_gallardo
3

The Team Is Gone
- Team were consultants
- They were downsized
- The job was outsourced
- “Bus factor”
- “Binary blob”
- A...

“Public Sector”
- Leaves the code with subcontractor
- No build environment
- Third-party access to production
environment...

Fix : Own It!
Goal : Regain Control
Take it on yourselves
- Build competence in-house
- Fork, take control
- “Barely Suffi...

Fix : Own It!
“Public Sector”
- Backsourcing - Bring back work
previously outsourced
Abandoned frameworks
- Replace with e...

Use It!
@pati_gallardo

It’s in Our Code @pati_gallardo
4

It’s in Our Code
- Injection
- Exploited crash etc
- Debug code in production
- Server compromised
- Outdated platform
- I...

REMA 1000 Æ App
- Reporter: Hallvard Nygård (@hallny)
- All user data could be retrieved
- Badly handled report
- “Bug” (L...

Fix : Live It!
Goal : Prevent & Cure
Prevent
- Sanitize your input
- Send crash reports
- Code review + tests
- Review ser...

Browsers are very experienced
- And therefore boring ;)
gitlab.com
- “rm -rf”
- Sysadmin maintenance
- Cascading errors as...

My Boss Made Me Do It @pati_gallardo
5

My Boss Made Me Do It
The Feature
is the Bug
How?
- Security Problem
- Privacy Problem
- Unethical
- Illegal
@pati_gallardo

Capcom's Street Fighter V
- Installed a driver
- “anti-crack solution”
“...disables supervisor-mode execution
protection a...

Fix : Protect It!
Goal : Protect your user
Prevent : Protect your team
- Workers rights
- Build trust
Cure : Protect your ...

Statoil
- Internal reports of security
incidents after outsourcing
- Only public after serious IRL
incidents
Nødnett
- Tra...

Ship It, Control It, Own It, Live It
Protect It
@pati_gallardo

- You need a Security Hotline
- You Have to Ship
- You Can’t do This Alone
Recap
@pati_gallardo

Designing the User Experience of Security @pati_gallardo
6

The Users Won’t Read
Error blindness
- Most users will mentally erase
permanent error notifiers - they
won’t read
“Just cl...

Fix : Less is More
Don’t leave it to the user
- Just do the right thing, you don’t
have to ask
Have good defaults
- Make s...

They Trust You
With Personal information
- They trust you to protect them from
both hackers and governments
With Data
- Th...

Fix : Be Trustworthy
Only store what you have to
- Try to use end-to-end encryption,
so that even you don’t have access.
E...

Everyone Is An Expert @pati_gallardo

1. Unable to Roll Out Fixes
2. No Control over Dependencies
3. The Team is Gone
4. It’s in Our Code
5. My Boss Made Me Do ...

Protect Your User - Be a Force For Good
@pati_gallardo

The Spaces We Create Online Are REAL
@pati_gallardo

Make Everyone Feel Safe To Be Themselves
@pati_gallardo

Make it Fixable
Living with Risk
Patricia Aas, Vivaldi Technologies
@pati_gallardo
Photos from pixabay.com - CC0 Creative ...

Some
Vivaldi
Swag!
@pati_gallardo

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1030405 views
Storytelling For The Web: Integrate... by Chiara Aliotta 941265 views
Artificial Intelligence, Data and C... by OECD Directorate ... 859475 views
How to Leverage AI to Boost Employe... by SocialHRCamp 360179 views
2024 State of Marketing Report – by... by Marius Sescu 204862 views
Everything You Need To Know About C... by Expeed Software 225716 views

View on Slideshare

1 of 50 Ad

View on Slideshare

1 of 50 Ad