Peeling the Web Application Security Onion
summary
Redesign separates static and dynamic layers and hardens each with concrete components: React + nginx + S3 CDN for public assets with strict content security policies and HTTP headers, Adobe IO gateway for IMS OAuth2 token handling, rate limiting and signed tokens, and Project Ethos containers with Jenkins CICD for secure-by-default builds. Automated vulnerability tracking blocks unsafe third‑party libraries in builds, GDPR hooks are integrated, and an external pen test (Bishop Fox) finds no serious issues, claiming cost‑effective, layered risk reduction.
AI-written summary · about
chapters (11)
- 0:00Introduction and speakers
- 1:05Security onion concept
- 3:57Adobe common control framework
- 8:01Identity management system
- 9:48Shared Cloud platform
- 11:36New web app architecture
- 13:28Frontend security layers
- 15:59API gateway and backend
- 18:51Dynamic content protection
- 20:17Compliance and testing
- 21:45Summary and takeaways
related talks
30mWeb Security Engineering - Protect all layers of your project
34mWeb security explored through horror movies
40mModern Web Application Defense with OWASP Tools
01h 03mTen Key Steps for Enhanced Web App Security
29mSecuring Your Web Application Pipeline From Intruders
13mSecurity in modern Web Applications - OWASP to the rescue
35mDemystifying web application security
52mApplication Security at DevOps Speed and portfolio scale