SlideShare a Scribd company logo
1 of 27
Download to read offline
Wiktoria Dalach (She/her) @wdalach
Good Security is one
question away
🐝 🪱 🦋 🐞 🐜 🐌 🪰 🪲 🪳 🦟 🦗
👩💻 🤝 🔐
Nice-to-have
There is an in
fi
nite amount of
threats but…
…All of them can be assigned to
1 of 3 categories
Con
fi
dentiality, Integrity,
Availability
The CIA Triad
🤯
We want secrets to be secret
Con
f
identiality
We get what we expect
Integrity
We can always access the information
Availability
How is it helpful?
The Question
How can the CIA of this project
be broken?
Con
fi
dentiality:
- Who can see this resource?
- How do we store credentials?
- Do we log sensitive data?
Integrity:
- Who can create, update and remove a resource?
- Is there a way to see a malicious actor deleting all resources?
- What happens when malicious data is sent via a form?
Availability:
- Is this endpoint rate-limited?
- What happens when external product is down?
- How much time does a database migration take?
When should you do this?
Shi
ft
security le
f
Inject it!
How to implement
the CIA triad?
• Present it to your peers,
• Make it visible,
• Make it part of your process,
• Add it to doc templates:
• Solution Briefs,
• Enhancement Proposals,
• Request for Comments.
Movefastandbreakthings
is over
Thanks!
Find me in the internet:
wiktoriadalach.com

More Related Content

Similar to Good Security is one question away - Wiktoria Dalach

CyberSecurity - Future Risks, Zero Trust and the Optus Data Leak.pdf
CyberSecurity - Future Risks, Zero Trust and the Optus Data Leak.pdfCyberSecurity - Future Risks, Zero Trust and the Optus Data Leak.pdf
CyberSecurity - Future Risks, Zero Trust and the Optus Data Leak.pdf
Roger Qiu
 
Digi securitypres
Digi securitypresDigi securitypres
Digi securitypres
FairSay
 
CIA = Confidentiality of information, Integrity of information, Avai.pdf
CIA = Confidentiality of information, Integrity of information, Avai.pdfCIA = Confidentiality of information, Integrity of information, Avai.pdf
CIA = Confidentiality of information, Integrity of information, Avai.pdf
annaielectronicsvill
 
Running Head DATA BREACH .docx
Running Head DATA BREACH                                        .docxRunning Head DATA BREACH                                        .docx
Running Head DATA BREACH .docx
todd271
 

Similar to Good Security is one question away - Wiktoria Dalach (20)

"We Have Met the Enemy and He Is Us": The Role of the Human Factor in Protect...
"We Have Met the Enemy and He Is Us": The Role of the Human Factor in Protect..."We Have Met the Enemy and He Is Us": The Role of the Human Factor in Protect...
"We Have Met the Enemy and He Is Us": The Role of the Human Factor in Protect...
 
CLOUD SECURITY_CIA (1).pptx
CLOUD SECURITY_CIA (1).pptxCLOUD SECURITY_CIA (1).pptx
CLOUD SECURITY_CIA (1).pptx
 
Cyber Security Introduction.pptx
Cyber Security Introduction.pptxCyber Security Introduction.pptx
Cyber Security Introduction.pptx
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hacking
 
CyberSecurity - Future Risks, Zero Trust and the Optus Data Leak.pdf
CyberSecurity - Future Risks, Zero Trust and the Optus Data Leak.pdfCyberSecurity - Future Risks, Zero Trust and the Optus Data Leak.pdf
CyberSecurity - Future Risks, Zero Trust and the Optus Data Leak.pdf
 
Using Technology and People to Improve your Threat Resistance and Cyber Security
Using Technology and People to Improve your Threat Resistance and Cyber SecurityUsing Technology and People to Improve your Threat Resistance and Cyber Security
Using Technology and People to Improve your Threat Resistance and Cyber Security
 
I am the Cavalry (The Cavalry Is Us) Sourceconf September 2015
I am the Cavalry (The Cavalry Is Us) Sourceconf September 2015I am the Cavalry (The Cavalry Is Us) Sourceconf September 2015
I am the Cavalry (The Cavalry Is Us) Sourceconf September 2015
 
pbc_devsecops_eastereggs.2022oct06.jt.pptx
pbc_devsecops_eastereggs.2022oct06.jt.pptxpbc_devsecops_eastereggs.2022oct06.jt.pptx
pbc_devsecops_eastereggs.2022oct06.jt.pptx
 
Digi securitypres
Digi securitypresDigi securitypres
Digi securitypres
 
2015 Atlanta CHIME Lead Forum
2015 Atlanta CHIME Lead Forum2015 Atlanta CHIME Lead Forum
2015 Atlanta CHIME Lead Forum
 
2015 Atlanta CHIME Lead Forum
2015 Atlanta CHIME Lead Forum2015 Atlanta CHIME Lead Forum
2015 Atlanta CHIME Lead Forum
 
2015 Atlanta CHIME Lead Forum
2015 Atlanta CHIME Lead Forum 2015 Atlanta CHIME Lead Forum
2015 Atlanta CHIME Lead Forum
 
An Introduction To IT Security And Privacy In Libraries
 An Introduction To IT Security And Privacy In Libraries An Introduction To IT Security And Privacy In Libraries
An Introduction To IT Security And Privacy In Libraries
 
CIA = Confidentiality of information, Integrity of information, Avai.pdf
CIA = Confidentiality of information, Integrity of information, Avai.pdfCIA = Confidentiality of information, Integrity of information, Avai.pdf
CIA = Confidentiality of information, Integrity of information, Avai.pdf
 
Running Head DATA BREACH .docx
Running Head DATA BREACH                                        .docxRunning Head DATA BREACH                                        .docx
Running Head DATA BREACH .docx
 
Nexus User Conference DevOps "Table Stakes": The minimum required to play the...
Nexus User Conference DevOps "Table Stakes": The minimum required to play the...Nexus User Conference DevOps "Table Stakes": The minimum required to play the...
Nexus User Conference DevOps "Table Stakes": The minimum required to play the...
 
CYBER SECURITY WHAT IS IT AND WHAT YOU NEED TO KNOW.pdf
CYBER SECURITY WHAT IS IT AND WHAT YOU NEED TO KNOW.pdfCYBER SECURITY WHAT IS IT AND WHAT YOU NEED TO KNOW.pdf
CYBER SECURITY WHAT IS IT AND WHAT YOU NEED TO KNOW.pdf
 
Incident Response: How To Prepare
Incident Response: How To PrepareIncident Response: How To Prepare
Incident Response: How To Prepare
 
Ethical Hacking
Ethical HackingEthical Hacking
Ethical Hacking
 
How Malware Works
How Malware WorksHow Malware Works
How Malware Works
 

More from Wey Wey Web

More from Wey Wey Web (20)

Portable, secure, and lightweight: Wasm runtimes and their use-cases - Natali...
Portable, secure, and lightweight: Wasm runtimes and their use-cases - Natali...Portable, secure, and lightweight: Wasm runtimes and their use-cases - Natali...
Portable, secure, and lightweight: Wasm runtimes and their use-cases - Natali...
 
Auditing Design Systems for Accessibility - Anna E. Cook
Auditing Design Systems for Accessibility - Anna E. CookAuditing Design Systems for Accessibility - Anna E. Cook
Auditing Design Systems for Accessibility - Anna E. Cook
 
Adaptive Designs, Beyond Pixel Perfection - Stephanie Walter
Adaptive Designs, Beyond Pixel Perfection - Stephanie WalterAdaptive Designs, Beyond Pixel Perfection - Stephanie Walter
Adaptive Designs, Beyond Pixel Perfection - Stephanie Walter
 
Sharing is caring: what to know before you build a Research Repository - Juli...
Sharing is caring: what to know before you build a Research Repository - Juli...Sharing is caring: what to know before you build a Research Repository - Juli...
Sharing is caring: what to know before you build a Research Repository - Juli...
 
Unlocking collaboration: A framework for developers and designers - Alicia Ca...
Unlocking collaboration: A framework for developers and designers - Alicia Ca...Unlocking collaboration: A framework for developers and designers - Alicia Ca...
Unlocking collaboration: A framework for developers and designers - Alicia Ca...
 
3 reasons to switch to OKLCH - Anton Lovchikov
3 reasons to switch to OKLCH - Anton Lovchikov3 reasons to switch to OKLCH - Anton Lovchikov
3 reasons to switch to OKLCH - Anton Lovchikov
 
ChatGPT and AI for web developers - Maximiliano Firtman
ChatGPT and AI for web developers - Maximiliano FirtmanChatGPT and AI for web developers - Maximiliano Firtman
ChatGPT and AI for web developers - Maximiliano Firtman
 
Declarative Design - Jeremy Keith - Wey Wey Wey 2023
Declarative Design - Jeremy Keith - Wey Wey Wey 2023Declarative Design - Jeremy Keith - Wey Wey Wey 2023
Declarative Design - Jeremy Keith - Wey Wey Wey 2023
 
Form follows emotion - Isabella De Cuppis
Form follows emotion - Isabella De CuppisForm follows emotion - Isabella De Cuppis
Form follows emotion - Isabella De Cuppis
 
UX for emerging tech - Josephine Scholtes
UX for emerging tech - Josephine ScholtesUX for emerging tech - Josephine Scholtes
UX for emerging tech - Josephine Scholtes
 
Collaborative software with State Machines - Laura Kalbag
Collaborative software with State Machines -  Laura KalbagCollaborative software with State Machines -  Laura Kalbag
Collaborative software with State Machines - Laura Kalbag
 
Lessons Learned from building Session Replay - Francesco Novy
Lessons Learned from building Session Replay - Francesco NovyLessons Learned from building Session Replay - Francesco Novy
Lessons Learned from building Session Replay - Francesco Novy
 
Let's get visual. Visual testing in your project - Ramona Schwering
Let's get visual. Visual testing in your project - Ramona SchweringLet's get visual. Visual testing in your project - Ramona Schwering
Let's get visual. Visual testing in your project - Ramona Schwering
 
Solving Common Web Component Problems - Simon MacDonald
Solving Common Web Component Problems - Simon MacDonaldSolving Common Web Component Problems - Simon MacDonald
Solving Common Web Component Problems - Simon MacDonald
 
The Future is Malleable - Aleksandra Sikora
The Future is Malleable - Aleksandra SikoraThe Future is Malleable - Aleksandra Sikora
The Future is Malleable - Aleksandra Sikora
 
Trending tools & methodologies for UX - Josephine Scholtes.pdf
Trending tools & methodologies for UX - Josephine Scholtes.pdfTrending tools & methodologies for UX - Josephine Scholtes.pdf
Trending tools & methodologies for UX - Josephine Scholtes.pdf
 
Decoding Web Accessibility through Testing - Anuradha Kumari
Decoding Web Accessibility through Testing  - Anuradha KumariDecoding Web Accessibility through Testing  - Anuradha Kumari
Decoding Web Accessibility through Testing - Anuradha Kumari
 
Dynamic CSS Secrets - Lea Verou
Dynamic CSS Secrets - Lea Verou Dynamic CSS Secrets - Lea Verou
Dynamic CSS Secrets - Lea Verou
 
The Misty Report - Douglas Crockford
The Misty Report - Douglas CrockfordThe Misty Report - Douglas Crockford
The Misty Report - Douglas Crockford
 
Web performance optimisations for the harsh conditions - Anna Migas
Web performance optimisations for the harsh conditions - Anna MigasWeb performance optimisations for the harsh conditions - Anna Migas
Web performance optimisations for the harsh conditions - Anna Migas
 

Recently uploaded

Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 

Recently uploaded (20)

Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 

Good Security is one question away - Wiktoria Dalach