Arm yourself with Domain Driven Security. It's time to slay some security trolls?
summary
Shows that designing domain primitives prevents real attacks: a minus‑1 quantity becomes an explicit Quantity value object so negative orders and weird credit invoices vanish; SQL injection reproduces with "' or 1=1" against a vulnerable demo app on GitHub and is stopped by prepared statements plus modeling usernames as a constrained type. Uses context mapping to stop XSS and second‑order injections, offers a one‑read sensitive‑value pattern for logs, flags microservice semantic breaks (payments vs cash payments), and reports KTH Masters research and a forthcoming book.
AI-written summary · about
chapters (7)
- 0:00Start
- 15:43HISTORY OF DDSEC
- 18:19THE CLASSICS - DYNAMIC SQL STRING
- 19:57DEMO SQL INJECTION
- 22:25HTTP INJECTION
- 37:37PREVENTING DATA LEAKAGE
- 48:24KEY TAKE AWAYS
related talks
40mSecure Software & Domain Driven Design
52mSecure by Design, Revisited - Insights & Pitfalls
50mCracking the Code to Secure Software
29mGraphQL Security Best Practices and Hardening
29mSecurity by(e) Design?
38mSecure Coding: Back to basics
19mFrontend Security is a Thing
52mPractical Security in Web Applications