Advanced Ruby on Rails Security

•

3 likes•940 views

H

My slides about advanced Rails topics at the RubyFools conference. More <a>Ruby on Rails security</a>.

Ruby On Rails Security

Heiko Webers
42@rorsecurity.info

RubyFools Copenhagen, 2008 1

Heiko Webers
Ruby On Rails Security Project: www.RoRsecurity.info
E-Book „Ruby On Rails Security“
Ruby On Rails Security Audits
Software company

RubyFools Copenhagen, 2008 2

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

Advanced Ruby on Rails Security

More Related Content

Similar to Advanced Ruby on Rails Security

Stranger Danger: Your Java Attack Surface Just Got Bigger | JBCNConf 2022

Stranger Danger: Your Java Attack Surface Just Got Bigger | JBCNConf 2022

Stranger Danger: Your Java Attack Surface Just Got Bigger | JBCNConf 2022

Was the cloud shell shocked

Was the cloud shell shocked

Was the cloud shell shocked

Real-World WebAppSec Flaws - Examples and Countermeasues

Real-World WebAppSec Flaws - Examples and Countermeasues

Real-World WebAppSec Flaws - Examples and Countermeasues

Preventing Xs Sin Perl Apache

Preventing Xs Sin Perl Apache

Preventing Xs Sin Perl Apache

Introduction To Rails

Introduction To Rails

Introduction To Rails

from 33 to 0 - A journey to be root

from 33 to 0 - A journey to be root

from 33 to 0 - A journey to be root

As presented at OpenShift Commons Sept 8, 2016. Cyber threats consistently rank as a high priority for data center operators and their reliability teams. As increasingly sophisticated attacks mount, the risk associated with a zero-day attack is significant. Traditional responses include perimeter monitoring and associated network defenses. Since those defenses are reactive to application issues attackers choose to exploit, it’s critical to have visibility into both what is in your container library, but also what the current state of vulnerability activity might be. Current vulnerability information for container images can readily be obtained by using the scan action on Atomic hosts in your OpenShift Container Platform. In this session we’ll cover how an issue becomes a disclosed vulnerability, how to determine the risk associated with your container usage, and potential mitigation patterns you might choose to utilize to limit any potential scope of compromise.

The How and Why of Container Vulnerability Management

The How and Why of Container Vulnerability Management

The How and Why of Container Vulnerability Management

Presented by Tim Mackey, Senior Technical Evangelist at Black Duck Software on September 8, 2016 with OpenShift Commons. Cyber threats consistently rank as a high priority for data center operators and their reliability teams. As increasingly sophisticated attacks mount, the risk associated with a zero-day attack is significant. Traditional responses include perimeter monitoring and associated network defenses. Since those defenses are reactive to application issues attackers choose to exploit, it’s critical to have visibility into both what is in your container library, but also what the current state of vulnerability activity might be. Current vulnerability information for container images can readily be obtained by using the scan action on Atomic hosts in your OpenShift Container Platform. In this session we’ll cover how an issue becomes a disclosed vulnerability, how to determine the risk associated with your container usage, and potential mitigation patterns you might choose to utilize to limit any potential scope of compromise.

The How and Why of Container Vulnerability Management

The How and Why of Container Vulnerability Management

The How and Why of Container Vulnerability Management

Black Duck by Synopsys

Shellshock - A Software Bug

Shellshock - A Software Bug

Shellshock - A Software Bug

The Future of Automated Malware Generation

The Future of Automated Malware Generation

The Future of Automated Malware Generation

Stephan Chenette

As delivered by Tim Mackey, Senior Technical Evangelist - Black Duck Software, at LinuxCon and ContainerCon in Berlin 2016. Traditionally, when datacenter operators talk about application security, they've tended to focus on issues related to key management, firewalls and data access. By contrast, application developers have a security focus which is more aligned with code analysis and fuzzing techniques. The reality is, secure application deployment principles extend from the infrastructure layer through the application and include how the application is deployed. With the prevalence of continuous deployment of micro-services, it’s imperative to focus efforts on what attackers’ view as vulnerable; particularly in an environment where new exploits are being disclosed almost daily. In this session we’ll present: • How known vulnerabilities can make their way into production deployments • How deployment of vulnerable code can be minimized • How to determine the vulnerability status of a container • How to determine the risk associated with a specific package

Secure Application Development in the Age of Continuous Delivery

Secure Application Development in the Age of Continuous Delivery

Secure Application Development in the Age of Continuous Delivery

Black Duck by Synopsys

As delivered at LinuxCon and ContainerCon in Berlin 2016. Traditionally, when datacenter operators talk about application security, they've tended to focus on issues related to key management, firewalls and data access. By contrast, application developers have a security focus which is more aligned with code analysis and fuzzing techniques. The reality is, secure application deployment principles extend from the infrastructure layer through the application and include how the application is deployed. With the prevalence of continuous deployment of micro-services, it’s imperative to focus efforts on what attackers’ view as vulnerable; particularly in an environment where new exploits are being disclosed almost daily. In this session we’ll present: • How known vulnerabilities can make their way into production deployments • How deployment of vulnerable code can be minimized • How to determine the vulnerability status of a container • How to determine the risk associated with a specific package

Secure Application Development in the Age of Continuous Delivery

Secure Application Development in the Age of Continuous Delivery

Secure Application Development in the Age of Continuous Delivery

SecurifyLabs & Tiki @ Countermeasure 2014

SecurifyLabs & Tiki @ Countermeasure 2014

SecurifyLabs & Tiki @ Countermeasure 2014

Hafnium attack

Happiest Minds Technologies

apidays LIVE London 2021 - API Security in Highly Volatile Threat Landscapes ...

apidays LIVE London 2021 - API Security in Highly Volatile Threat Landscapes ...

apidays LIVE London 2021 - API Security in Highly Volatile Threat Landscapes ...

Effectiveness of AV in Detecting Web Application Backdoors

Effectiveness of AV in Detecting Web Application Backdoors

Effectiveness of AV in Detecting Web Application Backdoors

n|u - The Open Security Community

2012 B-Sides and ToorCon Talk Offensive Defense Blog Post - http://blog.ioactive.com/2013/01/offensive-defense.html Cyber-criminals have had back-end infrastructures equivalent to Virus Total to test if malware and exploits are effective against AV scanners for many years, thus showing that attackers are proactively avoiding detection when building malware. In this day of age malicious binaries are generated on demand by server-side kits when a victim visits a malicious web page, making reliance solely on hash based solutions inadequate. In the last 15 years detection techniques have evolved in an attempt to keep up with attack trends. In the last few years security companies have looked for supplemental solutions such as the use of machine learning to detect and mitigate attacks against cyber criminals. Let's not pretend attackers can't bypass each and every detection technique currently deployed. Join me as I present and review current detection methods found in most host and network security solutions found today. We will re-review the defense in depth strategy while keeping in mind that a solid security strategy consists of forcing an attacker to spend as much time and effort while needing to know a variety of skills and technologies in order to successfully pull off the attack. In the end I hope to convince you that thinking defensively requires thinking offensively.

B-Sides Seattle 2012 Offensive Defense

B-Sides Seattle 2012 Offensive Defense

B-Sides Seattle 2012 Offensive Defense

Stephan Chenette

In this talk I’ll present the current state of the software supply chain, the big global recent events (SolarWinds, log4shell, codecov, packagist) and the state of the PHP and Drupal ecosystem, the threats and the mitigations that can be applied using tools like Sigstore, Syft, and Grype for digital signatures, SBOM generation, and automatic vulnerability scanning and how to use them for real-world projects to gain unprecedented levels of knowledge of your digital artifacts. There will be also a demo of the mentioned tools in action to implement a secure supply chain pipeline for your Drupal projects.

What is the Secure Supply Chain and the Current State of the PHP Ecosystem

What is the Secure Supply Chain and the Current State of the PHP Ecosystem

What is the Secure Supply Chain and the Current State of the PHP Ecosystem

This secure lifecycle management process (SLCMP said slickum) defines the basic and most realistic way to develop secure software. While the briefing is a bit dated slide 34 is still a very relevant process. What is below the green line is the security dynamic process that happens supporting the basic development process seen above the green line. SLCMP is supported by building a complementary and excellent information risk framework system security plan or IRASSP. SLCMP is operationally deployed.

Secure by design and secure software development

Secure by design and secure software development

Secure by design and secure software development

Virus Bulletin 2007 Vienna presentation on the "Storm worm" (even though it wasn’t really a "worm" in the classic sense). My reversing details of its kernel-level injection techniques were not publicly documented at the time. Particularly proud of this one after some of the talented Avira guys gave some compliments on my slides’ details of the storm web pages’ javascript, exploit, and shellcode details.

Storm Worm - Malware 2.0

Storm Worm - Malware 2.0

Storm Worm - Malware 2.0

Kurt Baumgartner

Similar to Advanced Ruby on Rails Security (20)

Stranger Danger: Your Java Attack Surface Just Got Bigger | JBCNConf 2022

Stranger Danger: Your Java Attack Surface Just Got Bigger | JBCNConf 2022

Stranger Danger: Your Java Attack Surface Just Got Bigger | JBCNConf 2022

Was the cloud shell shocked

Was the cloud shell shocked

Was the cloud shell shocked

Real-World WebAppSec Flaws - Examples and Countermeasues

Real-World WebAppSec Flaws - Examples and Countermeasues

Real-World WebAppSec Flaws - Examples and Countermeasues

Preventing Xs Sin Perl Apache

Preventing Xs Sin Perl Apache

Preventing Xs Sin Perl Apache

Introduction To Rails

Introduction To Rails

Introduction To Rails

from 33 to 0 - A journey to be root

from 33 to 0 - A journey to be root

from 33 to 0 - A journey to be root

The How and Why of Container Vulnerability Management

The How and Why of Container Vulnerability Management

The How and Why of Container Vulnerability Management

The How and Why of Container Vulnerability Management

The How and Why of Container Vulnerability Management

The How and Why of Container Vulnerability Management

Shellshock - A Software Bug

Shellshock - A Software Bug

Shellshock - A Software Bug

The Future of Automated Malware Generation

The Future of Automated Malware Generation

The Future of Automated Malware Generation

Secure Application Development in the Age of Continuous Delivery

Secure Application Development in the Age of Continuous Delivery

Secure Application Development in the Age of Continuous Delivery

Secure Application Development in the Age of Continuous Delivery

Secure Application Development in the Age of Continuous Delivery

Secure Application Development in the Age of Continuous Delivery

SecurifyLabs & Tiki @ Countermeasure 2014

SecurifyLabs & Tiki @ Countermeasure 2014

SecurifyLabs & Tiki @ Countermeasure 2014

Hafnium attack

apidays LIVE London 2021 - API Security in Highly Volatile Threat Landscapes ...

apidays LIVE London 2021 - API Security in Highly Volatile Threat Landscapes ...

apidays LIVE London 2021 - API Security in Highly Volatile Threat Landscapes ...

Effectiveness of AV in Detecting Web Application Backdoors

Effectiveness of AV in Detecting Web Application Backdoors

Effectiveness of AV in Detecting Web Application Backdoors

B-Sides Seattle 2012 Offensive Defense

B-Sides Seattle 2012 Offensive Defense

B-Sides Seattle 2012 Offensive Defense

What is the Secure Supply Chain and the Current State of the PHP Ecosystem

What is the Secure Supply Chain and the Current State of the PHP Ecosystem

What is the Secure Supply Chain and the Current State of the PHP Ecosystem

Secure by design and secure software development

Secure by design and secure software development

Secure by design and secure software development

Storm Worm - Malware 2.0

Storm Worm - Malware 2.0

Storm Worm - Malware 2.0

Recently uploaded

Advantages of Hiring UIUX Design Service Providers for Your Business

Advantages of Hiring UIUX Design Service Providers for Your Business

Advantages of Hiring UIUX Design Service Providers for Your Business

Pixlogix Infotech

A Domino Admins Adventures (Engage 2024)

A Domino Admins Adventures (Engage 2024)

A Domino Admins Adventures (Engage 2024)

Gabriella Davis

MySQL Webinar, presented on the 25th of April, 2024. Summary: MySQL solutions enable the deployment of diverse Database Architectures tailored to specific needs, including High Availability, Disaster Recovery, and Read Scale-Out. With MySQL Shell's AdminAPI, administrators can seamlessly set up, manage, and monitor these solutions, ensuring efficiency and ease of use in their administration. MySQL Router, on the other hand, provides transparent routing from the application traffic to the backend servers in the architectures, requiring minimal configuration. Completely built in-house and supported by Oracle, these solutions have been adopted by enterprises of all sizes for their business-critical applications. In this presentation, we'll delve into various database architecture solutions to help you choose the right one based on your business requirements. Focusing on technical details and the latest features to maximize the potential of these solutions.

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Scaling API-first – The story of a global engineering organization

Scaling API-first – The story of a global engineering organization

Scaling API-first – The story of a global engineering organization

AWS Community Day CPH - Three problems of Terraform

AWS Community Day CPH - Three problems of Terraform

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

Discord is a free app offering voice, video, and text chat functionalities, primarily catering to the gaming community. It serves as a hub for users to create and join servers tailored to their interests. Discord’s ecosystem comprises servers, each functioning as a distinct online community with its own channels dedicated to specific topics or activities. Users can engage in text-based discussions, voice calls, or video chats within these channels. Understanding Discord Servers Discord servers are virtual spaces where users congregate to interact, share content, and build communities. Servers may revolve around gaming, hobbies, interests, or fandoms, providing a platform for like-minded individuals to connect. Communication Features Discord offers a range of communication tools, including text channels for messaging, voice channels for real-time audio conversations, and video channels for face-to-face interactions. These features facilitate seamless communication and collaboration. What Does NSFW Mean? The acronym NSFW stands for “Not Safe For Work,” indicating content that may be inappropriate for professional or public settings. NSFW Content NSFW content encompasses material that is sexually explicit, violent, or otherwise graphic in nature. It often includes nudity, profanity, or depictions of sensitive topics.

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

Developing An App To Navigate The Roads of Brazil

Developing An App To Navigate The Roads of Brazil

Developing An App To Navigate The Roads of Brazil

Boost Fertility New Invention Ups Success Rates.pdf

Boost Fertility New Invention Ups Success Rates.pdf

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Handwritten Text Recognition for manuscripts and early printed texts

Handwritten Text Recognition for manuscripts and early printed texts

Handwritten Text Recognition for manuscripts and early printed texts

Maria Levchenko

Data Cloud, More than a CDP by Matt Robison

Data Cloud, More than a CDP by Matt Robison

Data Cloud, More than a CDP by Matt Robison

Anna Loughnan Colquhoun

[2024]Digital Global Overview Report 2024 Meltwater.pdf

[2024]Digital Global Overview Report 2024 Meltwater.pdf

[2024]Digital Global Overview Report 2024 Meltwater.pdf

In this session, we will delve into strategic approaches for optimizing knowledge management within Microsoft 365, amidst the evolving landscape of Copilot. From leveraging automatic metadata classification and permission governance with SharePoint Premium, to unlocking Viva Engage for the cultivation of knowledge and communities, you will gain actionable insights to bolster your organization's knowledge-sharing initiatives. In this session, we will also explore how to facilitate solutions to enable your employees to find answers and expertise within Microsoft 365. You will leave equipped with practical techniques and a deeper understanding of how there is more to effective knowledge management than just enabling Copilot, but building actual solutions to prepare the knowledge that Copilot and your employees can use.

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Histor y of HAM Radio presentation slide

Histor y of HAM Radio presentation slide

Histor y of HAM Radio presentation slide

Partners Life - Insurer Innovation Award 2024

Partners Life - Insurer Innovation Award 2024

Partners Life - Insurer Innovation Award 2024

The Digital Insurer

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

The Digital Insurer

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

Building Digital Trust in a Digital Economy Veronica Tan, Director - Cyber Security Agency of Singapore Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

Three things you will take away from the session: • How to run an effective tenant-to-tenant migration • Best practices for before, during, and after migration • Tips for using migration as a springboard to prepare for Copilot in Microsoft 365 Main ideas: Migration Overview: The presentation covers the current reality of cross-tenant migrations, the triggers, phases, best practices, and benefits of a successful tenant migration Considerations: When considering a migration, it is important to consider the migration scope, performance, customization, flexibility, user-friendly interface, automation, monitoring, support, training, scalability, data integrity, data security, cost, and licensing structure Next Wave: The next wave of change includes the launch of Copilot, which requires businesses to be prepared for upcoming changes related to Copilot and the cloud, and to consolidate data and tighten governance ShareGate: ShareGate can help with pre-migration analysis, configurable migration tool, and automated, end-user driven collaborative governance

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

What are drone anti-jamming systems? The drone anti-jamming systems and anti-spoof technology protect against interference, jamming, and spoofing of the UAVs. To protect their security, countries are beginning to research drone anti-jamming systems, also known as drone strike weapons. The anti-jam and anti-spoof technology protects against interference, jamming and spoofing. A drone strike weapon is a drone attack weapon that can attack and destroy enemy drones. So what is so unique about this amazing system?

What Are The Drone Anti-jamming Systems Technology?

What Are The Drone Anti-jamming Systems Technology?

What Are The Drone Anti-jamming Systems Technology?

Antenna Manufacturer Coco

Recently uploaded (20)

Advantages of Hiring UIUX Design Service Providers for Your Business

Advantages of Hiring UIUX Design Service Providers for Your Business

Advantages of Hiring UIUX Design Service Providers for Your Business

A Domino Admins Adventures (Engage 2024)

A Domino Admins Adventures (Engage 2024)

A Domino Admins Adventures (Engage 2024)

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Scaling API-first – The story of a global engineering organization

Scaling API-first – The story of a global engineering organization

Scaling API-first – The story of a global engineering organization

AWS Community Day CPH - Three problems of Terraform

AWS Community Day CPH - Three problems of Terraform

AWS Community Day CPH - Three problems of Terraform

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

Developing An App To Navigate The Roads of Brazil

Developing An App To Navigate The Roads of Brazil

Developing An App To Navigate The Roads of Brazil

Boost Fertility New Invention Ups Success Rates.pdf

Boost Fertility New Invention Ups Success Rates.pdf

Boost Fertility New Invention Ups Success Rates.pdf

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Handwritten Text Recognition for manuscripts and early printed texts

Handwritten Text Recognition for manuscripts and early printed texts

Handwritten Text Recognition for manuscripts and early printed texts

Data Cloud, More than a CDP by Matt Robison

Data Cloud, More than a CDP by Matt Robison

Data Cloud, More than a CDP by Matt Robison

[2024]Digital Global Overview Report 2024 Meltwater.pdf

[2024]Digital Global Overview Report 2024 Meltwater.pdf

[2024]Digital Global Overview Report 2024 Meltwater.pdf

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Histor y of HAM Radio presentation slide

Histor y of HAM Radio presentation slide

Histor y of HAM Radio presentation slide

Partners Life - Insurer Innovation Award 2024

Partners Life - Insurer Innovation Award 2024

Partners Life - Insurer Innovation Award 2024

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

What Are The Drone Anti-jamming Systems Technology?

What Are The Drone Anti-jamming Systems Technology?

What Are The Drone Anti-jamming Systems Technology?

Advanced Ruby on Rails Security

1. Ruby On Rails Security Heiko Webers 42@rorsecurity.info RubyFools Copenhagen, 2008 1

2. Heiko Webers Ruby On Rails Security Project: www.RoRsecurity.info E-Book „Ruby On Rails Security“ Ruby On Rails Security Audits Software company RubyFools Copenhagen, 2008 2