From Dev to Security Rey Bango (@reybango) AppSec is hard Credit: - PowerPoint PPT Presentation

May 18, 2023 •291 likes •763 views

From Dev to Security Rey Bango (@reybango) AppSec is hard Credit: https://imgur.com/user/PipePistoleer Implicit trust On average, each Web application that Positive Technologies inspected contained 33 vulnerabilities . Of those, six were high-

From Dev to Security Rey Bango (@reybango)
AppSec is hard
Credit: https://imgur.com/user/PipePistoleer
Implicit trust
On average, each Web application that Positive Technologies inspected contained 33 vulnerabilities . Of those, six were high- severity flaws, compared to just two the prior year. More than two-thirds of the apps (67%) contained critical vulnerabilities such as insufficient authorization errors, arbitrary file upload, path traversal, and SQL injection flaws . https://www.darkreading.com/vulnerabilities---threats/web-apps-are-becoming-less-secure/
VeraCode polled 400 app developers from the UK, US and Germany and found just 52% update these components when a new vulnerability is announced . The research revealed that 83% of respondents use either commercial and/or open source components, with an average of 73 used per application. Some 71 vulnerabilities per application are introduced on average through use of third-party components , with only 23% of respondents claiming they test for bugs in components at every release . https://www.darkreading.com/vulnerabilities---threats/web-apps-are-becoming-less-secure/
Web apps & APIs are the new attack endpoints
https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
Credit: Tanya Janca, Cloud Security Advocate at MSFT
Security Champions
Practice makes permanent
OWASP Juice Shop https://www.owasp.org/index.php/OWASP_Juice_Shop_Project
Damn Vulnerable Web Application (DVWA) http://www.dvwa.co.uk
OWASP DevSlop Project https://www.owasp.org/index.php/OWASP_DevSlop_Project
Automate Security
Credit: WhiteSource.com
Build a strong network
Tanya Janca @ shehackspurple
Look for non-traditional talent
Do the right thing

Download Presentation

Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann & Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday & Friday, 9:00 10:30 William Stallings

670 views • 19 slides

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides

Project Plan VIN-Verse The Capstone Experience Team Urban Science Rachel Grunder Aakash

Project Plan VIN-Verse The Capstone Experience Team Urban Science Rachel Grunder Aakash Bhargava Gabriel Heikes Jacob Lawler Department of Computer Science and Engineering Michigan State University Fall 2018 From Students to

447 views • 12 slides

Ar Arch chitectu tural An Analysi sis f s for or Security ( y (AAF AAFS) S) Jungwoo

Ar Arch chitectu tural An Analysi sis f s for or Security ( y (AAF AAFS) S) Jungwoo Ryoo and Priya Anand, Penn State University Rick Kazman, SEI/University of Hawaii To appear in IEEE Security and Privacy Arch chitectu ctural al

394 views • 20 slides

Senior Phase Course Choice Information Evening Thursday 30th January 2020 Purpose of evening

Senior Phase Course Choice Information Evening Thursday 30th January 2020 Purpose of evening To provide information on: curriculum rationale and structure pathways through curriculum course choice process support available

772 views • 21 slides

Curriculum for Excellence in Kings Park Secondary School Information Evening for Parents

Curriculum for Excellence in Kings Park Secondary School Information Evening for Parents Monday 12 December 2011 Our Intentions for This Evening 1. You will know the main features of Curriculum for Excellence. 2. You will know where to find

612 views • 31 slides

Tim imur Burg rgano anov Sa Sam Em Emond Lawre rence nce Weetma man Whats in a name?

Second Year Trading in Space Group Project Tim imur Burg rgano anov Sa Sam Em Emond Lawre rence nce Weetma man Whats in a name? tra raf ffi fic n. n. (i) The commercial exchange of goods; trade. (ii) Illegal or

502 views • 16 slides

OpenCRVS An open and standards based solution for CRVS CRVS systems are not delivering on their

OpenCRVS An open and standards based solution for CRVS CRVS systems are not delivering on their promise to extend coverage, automate processes and share data: Under-investment in foundational registers Vendor lock-in and high maintenance

388 views • 14 slides

1 Give some examples of Sounds in everyday life. -Speech -Ultrasound machine used to break up

1 Give some examples of Sounds in everyday life. -Speech -Ultrasound machine used to break up kidney stones or destroy tumors -Ultrasound pregnancy -feel a sonic boom 2 ::When the boundary of a Wave are fixed, there will be a transmiDed wave,

451 views • 20 slides

Project 16HS3: Controlled Stirling Power Unit Seth Thomas Vanderbilt University Photo Advisor:

579 views • 22 slides