Security Policy Management: Easy as PIE
summary
Claims that security managers and CSP are widely neglected despite low performance cost; a scan finds 2.7% of top 500 sites send CSP (mostly weak). Built a tool called pi that runs in learn mode, auto-generates and simplifies policies (example: a generated policy shrinks to 1800→80 lines), plugs into CI as a maven plugin, and in a demo effectively blocks RCE from a Struts2 OGNL exploit. Manual Tomcat tuning otherwise takes dozens of painful iterations.
AI-written summary · about
chapters (19)
- 0:00Start
- 1:29What is a Security Policy?
- 2:06An Idealized Security Policy
- 2:36A More Realistic Security Policy
- 2:56An Even More Realistic Security Policy
- 3:38Security Managers
- 4:54Content Security Policy
- 7:10Spring Security
- 8:26A Use Case: Struts 2
- 11:52The State of CSP
- 13:52Why Aren't These Tools Getting Used?
- 23:37What is PIE?
- 25:25PIE: Policy Enforcement
- 25:35PIE: Policy Generation
- 26:35PIE: Policy Simplification
- 28:05PIE: Policy Verification
- 30:30What Frameworks Does PIE Support?
- 31:06Extensibility
- 32:59Conclusions
related talks
31mCCSP: Controlled Relaxation of Content Security Policies...
46mContent Security Policies: Let's Break Stuff
01h 00mContent Security Policy: From newbie to advanced
16mA practical guide to implementing Content Security Policy (CSP) to secure Client-side
53mI Wanna Deploy You, but My Senses Tell Me to ...
32mWhat is CSP and Why Haven't You Applied it Yet
17mContent Security Policy: The application security Swiss Army Knife
53mLessons Learned: A Retrospective on Application Security Failures