Security Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities

on YouTube ↗41m

" summary

Injection stays top of the list (OWASP Top 10 2017) despite 20+ years of knowledge, so the concrete moves matter: parametrize queries as the primary defense, fallback to contextual encode output, always validate input at the controller and log anomalies like method changes extra params or auth inconsistencies — six detection points for security logging. Treat third‑party libraries with a wrapper adapter facade pattern, enforce TLS end‑to‑end and key management (found encrypted data and key material stored together), and automate config checks and continuous scanning.

AI-written summary · about

" chapters (27)

1. 0:00Intro
2. 1:37After Report
3. 6:20SQL Injection: Classification
4. 7:13Decompose the Injection Data interpreted as Code
5. 8:25Extract Security Controls
6. 12:11Security Controls: Security Logging
7. 12:27Best Types of Detection Points
8. 13:27Examples of Intrusion Detection Points
9. 16:00Secure Data Handling: Basic Workflow
10. 18:25Storage by Data Types
11. 19:18Data at Rest: Design Vulnerability Example
12. 20:29Security Controls: Data at Rest Encryption Cryptographic Storage
13. 21:21Security Controls: Data in Transit
14. 22:49Root Cause The type of software with vulnerable components
15. 24:02Fundamental Security Principle
16. 24:17Components Examples
17. 25:17Implement a Logging Library
18. 25:54Simple Wrapper
19. 26:52Implement a Payment Gateway Scenario • Vendor APS-line payment gateways . Can have more than one payment gateway in an application • Required to be interchangeable
20. 27:25Adapter Design Pattern
21. 28:07Implement a Single Sign-On
22. 28:31Façade Design Pattern
23. 29:04Secure Software Starts from Design!
24. 30:05Configuration Hardening
25. 31:49Final Takeaways
26. 33:07Security Controls for Secure Development
27. 37:54Global AppSee Amsterdam

" related talks

• 43mSecurity Vulnerabilities Decomposition: Another way to look at VulnerabilitiesKaty Anton · NDC Oslo 2019
• 01h 30mCommon Webapp Vulnerabilities and What to Do About ThemEoin Woods · ACCU 2018
• 53mOWASP Top 10: What are them and how to prevent themAyesh Karunaratne · DrupalCon Amsterdam 2019
• 46mThe Path of Secure SoftwareKaty Anton · Devoxx Belgium 2017
• 54mTaking on the King: Killing Injection VulnerabilitiesJustin Collins · OWASP AppSec California 2018
• 01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017Christian Wenz · NDC Oslo 2017
• 19mFrontend Security is a ThingMadalina Cotumbeanu · DrupalCon Amsterdam 2019
• 53mVulnerabilities Are Ingredients And OWASP Top 10 The Seasoning- Meghan JacquotMeghan Jacquot · Global AppSec Dublin 2023