Presentation on theme: "Web Security Common security threats and hacking."— Presentation transcript:
Web Security Common security threats and hacking
The OWASP Foundation Nahidul Kibria Co-Leader, OWASP Bangladesh, Senior Software Engineer, KAZ Software Ltd. Writing code for fun and food. And security enthusiastic
The OWASP Foundation Shahee Mirza # Certified Ethical Hacker (C|EH). # Microsoft® Certified Systems Administrator. #Information Security Consultant, Nexus IT Zone. FB:
Why should we care?
6 Most sites are not secure! Attacker can access unauthorized data! They use your web site to attack your users!
7 Historically the web wasn’t designed to be secure Built for static, read only pages Almost no intrinsic security A few security features were “bolted-on” later
8 What does that mean? Cookie based sessions can be hijacked No separation of logic and data All client supplied data cannot be trusted
9 The vast majority of web applications have serious security vulnerabilities! Most developers not aware of the issues.
Web Application threat surface 12 XSS CSRF Click jacking Parameter tempering /sniffing FORGED TOKEN Directory Traversal DIRECT OBJECT REFERENCE SQL Injection XML Injection
13 Ajax Flash Silverlight Applets The attack surface is growing!
Some incident example 14
INSECURE-Mag-31 Study: Global cybercrime costs more than illegal drugs Global drug trade—about $288 billion
Common question is I’m inocent why should I will be target? 16 I don’t have any sensitive data. I’m not even serve any important data. I have no enemy
Answer is You have resource... May be a Multi-core processor...Bandwidth Attacker weaponize your pc to attack other or use you resource Turn your pc to zombie
Botnet-Just in brief 18
19 This is a problem
Network security and others 20
But developers 21
Quick Resource Guide 23
About OWASP OWASP’s mission is “to make application security visible, so that people and organizations can make informed decisions about true application” Attacker not use black art to exploit your application
220 Chapters 25
The OWASP Foundation OWASP Bangladesh Chapter Bangladeshi community of Security professional Globally recognized Open for all Free for all What do we have to offer? Monthly Meetings Mailing List Presentations & Groups Open Forums for Discussion Vendor Neutral Environments
(2010 Edition) OWASP Top 10 Web Application Security Risks (2010 Edition)
Application Developers 28 New attacks/ defense guideline Cheat Sheets Web Goat-emulator-designed to teach web application security lessons
The OWASP Enterprise Security API 29 Custom Enterprise Web Application Enterprise Security API Authenticator User AccessController AccessReferenceMap Validator Encoder HTTPUtilities Encryptor EncryptedProperties Randomizer Exception Handling Logger IntrusionDetector SecurityConfiguration Existing Enterprise Security Services/Libraries
Application Testers and Quality Assurance 30 Tools Testing guide/pentester Application Security Verification Standard Project
OWASP ZAP Proxy/ WebScarab 31
OWASP CSRFTester 32
Application Project Management and Staff 33 Define the process SDLC Code Review
OWASP Code Review Project Code review tool
OWASP Testing Framework 4.2 Information Gathering 4.3 Configuration Management Testing 4.4 Business logic testing 4.5 Authentication Testing 4.6 Authorization Testing 4.7 Session Management Testing 4.8 Data Validation Testing 4.9 Testing for Denial of Service 4.10 Web Services Testing 4.11 Ajax Testing
36 Myth- “The developer will provide me with a secure solution without me asking”
Download Get OWASP Books
38 Coolest Jobs in Information Security #1 Information Security Crime Investigator/Forensics Expert #2 System, Network, and/or Web Penetration Tester #3 Forensic Analyst #4 Incident Responder #5 Security Architect #6 Malware Analyst #7 Network Security Engineer #8 Security Analyst #9 Computer Crime Investigator #10 CISO/ISO or Director of Security #11 Application Penetration Tester #12 Security Operations Center Analyst #13 Prosecutor Specializing in Information Security Crime #14 Technical Director and Deputy CISO #15 Intrusion Analyst #16 Vulnerability Researcher/ Exploit Developer #17 Security Auditor #18 Security-savvy Software Developer #19 Security Maven in an Application Developer Organization #20 Disaster Recovery/Business Continuity Analyst/Manager
39 Subscribe mailing list https://www.owasp.org/index.php/Bangladesh https://www.facebook.com/OWASP.Bangladesh Keep up to date!