The presentation discusses the rise of the Anonymous group and its implications for PHP developers, emphasizing the importance of web security. It highlights that PHP is the most widely used server-side programming language and outlines potential security risks due to developer oversight. Resources for improving PHP security practices are also provided.

1. OWASP Day Kuala Lumpur
2011
Rise of the Planet of the
Anonymous
Errazudin Ishak
www.mimos.my © 2009 MIMOS Berhad. All Rights Reserved.

2. Rise of the Planet of the Anonymous
(and what you should do as a PHP
developer)
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

3. Agenda
• You
• Me
• Anonymous
• Why PHP
• PHP Security
• Resources
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

4. About You
Name :
Designation :
Day job :
Night job :
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

5. About Me
• Errazudin Ishak
• @errazudin
• Senior engineer @ Mimos Bhd Malaysia
• Focuses on web application development,
deployment, performance and stability.
• 2009 : foss.my , MyGOSSCON
• 2010 : Entp. PHP Techtalk, BarcampKL, PHP
Meetup, MOSC2010, PHP Northwest UK,
MyGOSSCON
• 2011 : INTAN Tech Update, Wordpress Conf. Asia,
Joomla! Day, MOSC
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

6. www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

7. www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

8. ANONYMOUS
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

9. Why so serious? – Joker 
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

10. News http://goo.gl/oVjqz
91
ATTACKED
76
RECOVERED
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

11. Internet
“…anonymous,
uncontrolled, always on,
and instantly accessible
from anywhere”
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

12. Evolution…
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

13. ..becomes revolution
http://evolutionofweb.appspot.com/
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

14. Does it apply here? (web security)
"Good programmers
write code, great
programmers reuse"
Defcon19
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

15. Web security
Completely secure system
is virtually impossible
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

16. Why?
RISK USABILITY
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

17. Agenda
• You
• Me
• Anonymous
• Why PHP
• PHP Security
• Resources
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

18. Why PHP?
“More internet
applications speak PHP
than any other”
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

19. Why PHP?
Usage of server-side programming languages
for websites
1% 1% 0%
4% 1%
PHP
22% ASP.NET
Java
ColdFusion
77%
Perl
Ruby
Python
Source : http://w3techs.com
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

20. Why PHP?
Usage of server-side programming languages
for websites
4% 1% 1% 0%
1%
PHP
22% ASP.NET
Java
ColdFusion
77%
Perl
Ruby
Python
Source : http://w3techs.com
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

21. PHP Secure?
User
Enterprise
PHP
Developer
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

22. PHP Secure?
PHP is not the culprit,
we (developer,sys
admin,architect) are.
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

23. Why PHP?
“People have to
understand their
systems well to know
where security issues
are likely to appear” Rasmus Lerdorf
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

24. Agenda
• You
• Me
• Anonymous
• Why PHP
• PHP Security
• Resources
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

25. PHP Security
Secure Ecosystem
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

26. PHP Security
Dev/prod environment
Up to date
Secure
Ecosystem, Secured network
Maintain it!
Access (Permissions)
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

27. PHP Security
Secure Operations
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

28. PHP Security
Human only
Secure User identitification
Operations,
also practice Role based actions
it!
Track/Audit trail
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

29. PHP Security
Secure Programming
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

30. PHP Security
Input validation
DB
Secure
Programming, XSS/CSRF/Session
practice it!
Access (Permissions)
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

31. PHP Security
“Security take an
ongoing effort and a lot
of little things instead of
one big one”
Cal Evans
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

32. Security. (Remember Risk – Usability)
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

33. Resources
• php|architect’s Guide to PHP Security http://goo.gl/cUxuB
• Pro PHP Security http://goo.gl/HGIkI
• Defcon 19 http://goo.gl/S8Qw4
• Artur Ejsmont’s blog http://goo.gl/HGUkg
• Php.net
• Zend.com
• Phpcoe.mimos.my
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.

34. THANK YOU
@errazudin
errazudin.ishak@mimos.my
errazudin.ishak@gmail.com
* All images, logos and data are the copyright of
their respective owners
www.mimos.my © 2011 MIMOS Berhad. All Rights Reserved.