Security is Broken: Understanding Common Vulnerabilities
summary
Explains how interoperability and innocuous features in technologies like XML lead to security flaws, using concrete examples of XSS, XXE, and CSRF. Describes how attackers exploit those vulnerabilities and gives guidance on designing and coding more secure software by avoiding the decisions that enabled those exploits.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:49MOUNTAIN WEST RUBYCONF 2016
- 3:02How is security broken?
- 4:20How did we get here?
- 9:51How dangerous are CSRF attacks?
- 10:10How to mitigate CSRF?
- 11:09Caveat: CSRF protection in Rails is order-dependent
- 13:19Refresh tokens with the session / don't reuse tokens
- 18:27How dangerous are XSS attacks?
- 18:53How to mitigate XSS?
- 22:25EXPLOITING XXE with CURL
- 24:53How dangerous are XXE attacks?
- 26:42SECURITY Investigate vulnerabilities & patches
- 27:34SECURITY Resilience & empowerment
- 27:58GitHub eileencodes/security_examples
- 28:23SECURITY Awareness of vulnerabilities
related talks
35mWeb Applications: Common Security Issues
53mThe web is broken: let's fix it!
47mHow XML processing leads to security issues: unpacking XXE
41mSecurity: The world is broken and you are guilty
43mSecurity Vulnerabilities Decomposition: Another way to look at Vulnerabilities
44mSelected Vulnerabilities in Web Applications
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders
31mAchieving Secure Software through Redesign