SlideShare une entreprise Scribd logo
1  sur  76
Securing the MVC Architecture Part One Alex Smolen Software Security Consultant Foundstone, Inc Mission Viejo, CA [email_address]
Who are you? ,[object Object],[object Object],[object Object]
You like spicy food…
And pinball…
And astronomy.
You don’t like clueless bosses…
Or frightening cats…
Or Insecure Software!
First day at work… ,[object Object]
Hugh Jasul Good Morning!  Care for coffee?
Seymour Flaus No thanks.
Hugh Jasul Great. Hey, want to see a picture of my cat?
Seymour Flaus Uh…
 
Seymour Flaus Cute.
Hugh Jasul Enough small talk, Seymour. Hacme Inc. is in a bit of trouble…
Seymour Flaus Trouble?
Hugh Jasul We’ve had a few security “issues”…
Seymour Flaus Such as?
Hugh Jasul Hackers have been hacking into Hacme Bank accounts!
Seymour Flaus Oh, is that all? So it’s not just a clever name.
Hugh Jasul No, there’s more.  But find and fix this vulnerability right now! We’re going live tomorrow!
[object Object]
Seymour Flaus OK, fixed it!
Hugh Jasul Not so fast, we got a complaint from one of our UAT testers.
Seymour Flaus Who’s that?
 
Seymour Flaus OK, back to the drawing board.
Hugh Jasul Fantastic work, Seymour. By the way, we’re going to need you on Saturday morning for a four hour meeting…
Seymour Flaus Great. Nice to be appreciated.
Hugh Jasul Next order of business… Hacme Books customers are complaining that a book is being added to their cart!
Seymour Flaus I’m on it!
[object Object]
Hugh Jasul Great job Seymour! By the way, I have some dry cleaning ready, could you..
Seymour Flaus I got my masters for this?
Hugh Jasul Great, great, great. Now, I know you’ve been busy, but there’s a top priority task at hand.
Seymour Flaus Do tell.
Hugh Jasul People have been cheating on Hacme Casino  and scamming us for big $$$. Find and fix!
Seymour Flaus Here we go…
[object Object]
Hugh Jasul Alright, I think that’s a great first day. I’m off to the golf course…
Seymour Flaus See ya. I’m going to go hit up craigslist for a new job.
Introduction ,[object Object],Software Security Consultant Developer Architect/Designer
Introduction Who am I talking to? People using… People building… Software security folks frameworks.
Introduction What’s the point? WTF?
Security Concerns ,[object Object]
MVC Architecture View Model Controller
MVC Architecture View Model Controller View
MVC Architecture View Model Controller
Security Concerns
Security Concerns - Model ,[object Object]
Security Concerns - Model ,[object Object],[object Object],[object Object],[object Object],[object Object],Data Protection in Storage
Security Concerns - Model ,[object Object]
Security Concerns - Model ,[object Object],[object Object],[object Object],Fine Grained Authorization
Security Concerns - Model ,[object Object]
Security Concerns - Model ,[object Object],[object Object],[object Object],Logging
Security Concerns - Model ,[object Object]
Security Concerns - Model ,[object Object],[object Object],[object Object],Authentication
Security Concerns - View ,[object Object]
Security Concerns - View ,[object Object],[object Object],[object Object],Data Sanitization
Security Concerns - View ,[object Object]
Security Concerns - View ,[object Object],[object Object],[object Object],Error Handling
Security Concerns - View ,[object Object]
Security Concerns - View ,[object Object],[object Object],[object Object],Data Protection In Storage
Security Concerns - View ,[object Object]
Security Concerns - View ,[object Object],Data Protection In Transit
Security Concerns - Controller ,[object Object]
Security Concerns - Controller ,[object Object],[object Object],[object Object],Data Validation
Security Concerns - Controller ,[object Object]
Security Concerns - Controller ,[object Object],[object Object],[object Object],[object Object],Session Management
Security Concerns - Controller ,[object Object]
Security Concerns - Controller ,[object Object],[object Object],[object Object],Coarse-Grained Authorization
Security Concerns - Controller ,[object Object]
Security Concerns - Controller ,[object Object],[object Object],Data Protection in Transit
Thanks!
Stay tuned for… ,[object Object],[object Object],[object Object],[object Object]

Contenu connexe

Similaire à Smolen Alex Securing The Mvc Architecture Part One

Eat Your Vegetables - Data Security for Data Scientists
Eat Your Vegetables - Data Security for Data ScientistsEat Your Vegetables - Data Security for Data Scientists
Eat Your Vegetables - Data Security for Data ScientistsWilliam Voorhees
 
Cybersecurity Awareness E-Book - WeSecureApp
Cybersecurity Awareness E-Book - WeSecureAppCybersecurity Awareness E-Book - WeSecureApp
Cybersecurity Awareness E-Book - WeSecureAppWeSecureApp
 
Password and Account Management Strategies - April 2019
Password and Account Management Strategies - April 2019Password and Account Management Strategies - April 2019
Password and Account Management Strategies - April 2019Kimberley Dray
 
How to secure web applications
How to secure web applicationsHow to secure web applications
How to secure web applicationsMohammed A. Imran
 
Stu Hirst - Thinking Out cLoud July 2019
Stu Hirst - Thinking Out cLoud July 2019Stu Hirst - Thinking Out cLoud July 2019
Stu Hirst - Thinking Out cLoud July 2019Stu Hirst
 
Secure Coding principles by example: Build Security In from the start - Carlo...
Secure Coding principles by example: Build Security In from the start - Carlo...Secure Coding principles by example: Build Security In from the start - Carlo...
Secure Coding principles by example: Build Security In from the start - Carlo...Codemotion
 
The 5 Stages of Secrets Management Grief, And How to Prevail
The 5 Stages of Secrets Management Grief, And How to Prevail The 5 Stages of Secrets Management Grief, And How to Prevail
The 5 Stages of Secrets Management Grief, And How to Prevail Bryan Sterling
 
Protecting your online identity - Managing your passwords
Protecting your online identity -  Managing your passwordsProtecting your online identity -  Managing your passwords
Protecting your online identity - Managing your passwordsBunmi Sowande
 
Top Ten Tips For Tenacious Defense In Asp.Net
Top Ten Tips For Tenacious Defense In Asp.NetTop Ten Tips For Tenacious Defense In Asp.Net
Top Ten Tips For Tenacious Defense In Asp.Netalsmola
 
Web security leeds sharp dot netnotts
Web security leeds sharp dot netnottsWeb security leeds sharp dot netnotts
Web security leeds sharp dot netnottsJohn Staveley
 
Online Security and Privacy Issues
Online Security and Privacy IssuesOnline Security and Privacy Issues
Online Security and Privacy Issuesebusinessmantra
 
Ensuring Full Proof Security At Xero
Ensuring Full Proof Security At XeroEnsuring Full Proof Security At Xero
Ensuring Full Proof Security At XeroCraig Walker
 
The Principles of Secure Development - David Rook
The Principles of Secure Development - David RookThe Principles of Secure Development - David Rook
The Principles of Secure Development - David RookSecurity B-Sides
 
Security 101 for No- techies
Security 101 for No- techiesSecurity 101 for No- techies
Security 101 for No- techiesBrenton Johnson
 
So you wanna be a pentester - free webinar to show you how
So you wanna be a pentester - free webinar to show you howSo you wanna be a pentester - free webinar to show you how
So you wanna be a pentester - free webinar to show you howJoe McCray
 
Web security presentation
Web security presentationWeb security presentation
Web security presentationJohn Staveley
 
Password Management
Password ManagementPassword Management
Password ManagementDavon Smart
 

Similaire à Smolen Alex Securing The Mvc Architecture Part One (20)

Eat Your Vegetables - Data Security for Data Scientists
Eat Your Vegetables - Data Security for Data ScientistsEat Your Vegetables - Data Security for Data Scientists
Eat Your Vegetables - Data Security for Data Scientists
 
Cybersecurity Awareness E-Book - WeSecureApp
Cybersecurity Awareness E-Book - WeSecureAppCybersecurity Awareness E-Book - WeSecureApp
Cybersecurity Awareness E-Book - WeSecureApp
 
Password and Account Management Strategies - April 2019
Password and Account Management Strategies - April 2019Password and Account Management Strategies - April 2019
Password and Account Management Strategies - April 2019
 
How to secure web applications
How to secure web applicationsHow to secure web applications
How to secure web applications
 
Stu Hirst - Thinking Out cLoud July 2019
Stu Hirst - Thinking Out cLoud July 2019Stu Hirst - Thinking Out cLoud July 2019
Stu Hirst - Thinking Out cLoud July 2019
 
Truth and Consequences
Truth and ConsequencesTruth and Consequences
Truth and Consequences
 
Secure Coding principles by example: Build Security In from the start - Carlo...
Secure Coding principles by example: Build Security In from the start - Carlo...Secure Coding principles by example: Build Security In from the start - Carlo...
Secure Coding principles by example: Build Security In from the start - Carlo...
 
The 5 Stages of Secrets Management Grief, And How to Prevail
The 5 Stages of Secrets Management Grief, And How to Prevail The 5 Stages of Secrets Management Grief, And How to Prevail
The 5 Stages of Secrets Management Grief, And How to Prevail
 
Protecting your online identity - Managing your passwords
Protecting your online identity -  Managing your passwordsProtecting your online identity -  Managing your passwords
Protecting your online identity - Managing your passwords
 
Top Ten Tips For Tenacious Defense In Asp.Net
Top Ten Tips For Tenacious Defense In Asp.NetTop Ten Tips For Tenacious Defense In Asp.Net
Top Ten Tips For Tenacious Defense In Asp.Net
 
Web security leeds sharp dot netnotts
Web security leeds sharp dot netnottsWeb security leeds sharp dot netnotts
Web security leeds sharp dot netnotts
 
Online Security and Privacy Issues
Online Security and Privacy IssuesOnline Security and Privacy Issues
Online Security and Privacy Issues
 
Ensuring Full Proof Security At Xero
Ensuring Full Proof Security At XeroEnsuring Full Proof Security At Xero
Ensuring Full Proof Security At Xero
 
Getting authentication right
Getting authentication rightGetting authentication right
Getting authentication right
 
The Principles of Secure Development - David Rook
The Principles of Secure Development - David RookThe Principles of Secure Development - David Rook
The Principles of Secure Development - David Rook
 
Security 101 for No- techies
Security 101 for No- techiesSecurity 101 for No- techies
Security 101 for No- techies
 
issue15
issue15issue15
issue15
 
So you wanna be a pentester - free webinar to show you how
So you wanna be a pentester - free webinar to show you howSo you wanna be a pentester - free webinar to show you how
So you wanna be a pentester - free webinar to show you how
 
Web security presentation
Web security presentationWeb security presentation
Web security presentation
 
Password Management
Password ManagementPassword Management
Password Management
 

Dernier

Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...apidays
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...apidays
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfOrbitshub
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024The Digital Insurer
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobeapidays
 
Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Zilliz
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWERMadyBayot
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10
 
Six Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal OntologySix Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal Ontologyjohnbeverley2021
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusZilliz
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native ApplicationsWSO2
 
MS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsMS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsNanddeep Nachan
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesrafiqahmad00786416
 
WSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2
 
Elevate Developer Efficiency & build GenAI Application with Amazon Q​
Elevate Developer Efficiency & build GenAI Application with Amazon Q​Elevate Developer Efficiency & build GenAI Application with Amazon Q​
Elevate Developer Efficiency & build GenAI Application with Amazon Q​Bhuvaneswari Subramani
 
Vector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxVector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxRemote DBA Services
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1
 

Dernier (20)

Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
 
Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Six Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal OntologySix Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal Ontology
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with Milvus
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
MS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsMS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectors
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
WSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering Developers
 
Elevate Developer Efficiency & build GenAI Application with Amazon Q​
Elevate Developer Efficiency & build GenAI Application with Amazon Q​Elevate Developer Efficiency & build GenAI Application with Amazon Q​
Elevate Developer Efficiency & build GenAI Application with Amazon Q​
 
Vector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxVector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptx
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 

Smolen Alex Securing The Mvc Architecture Part One