Security Theatre
summary
An ongoing four year scan ingests about 4,800 application versions and indexes 10 million files into a fingerprinting system that runs monthly, producing 255,000 scans overall and a July 2015 snapshot of 6,440 sites where 1,082 had identifiable apps and 2,324 installs — roughly 60% vulnerable to at least one flaw; findings show 25% of versions expose vulnerabilities within three months, expose real failures like Timthumb and OpenX backdoors, and demonstrate the scanner works.
AI-written summary · about
chapters (30)
- 0:00Intro
- 0:33Security Theatre @thomas_shone
- 1:18Denial
- 5:15Internet of Things
- 6:31SAMSUNG
- 10:04Most popular software It's not what you think
- 18:05OpenX Backdoored for almost a year
- 19:41Versioning Projects with bad versioning also have some of the worst security issues
- 19:54Plugins and Templates If an update needs manual changes for plugins or template, no one updates
- 32:18The hardest part of security is not writing secure code
- 32:49without vulnerability Vulnerability research and security updates
- 33:32I trust that the network is configured properly and secure Good system administrators
- 33:42I trust you are who you say you are TLS Certificate Peer Verification or Authentication
- 36:05I trust your computer is not compromised ????
- 36:45I trust that the user won't be the weak link Training and procedures
- 38:17Weakening Compromising encryption or hashing is about reducing time to crack
- 38:27Implementation A bad implementation helps reduce the time to crack
- 40:53Avoid old tutorials on encryption scott/e9319254c8ecbad4f227
- 42:11One way encoding Comparisons / Integrity Checks
- 43:55Timing Attacks Brute forcing cryptographic functions via time taken to execute
- 47:04is critical in encryption Used for key generation and nonces
- 49:44Weak password reset processes Can you Google the answer? How do you handle customer support reset?
- 52:49Patching Strategy If a dependency prevents updating, resolve it now
- 53:50Don't become comfortable Comfort breeds contempt
- 54:38Training Strategy Have a process for dealing with account locks and resets
- 54:59Compromise Strategy Have a plan before you need it
- 55:29Information
- 56:55Decouple roles Databases, servers, domains, roles, ...
- 57:36Get behind PSR-9 & 10
- 58:12Group Performance
related talks
53m8 Million Findings in One Year: Fresh Look at the State of Software Security
40mNurture vs. Nature in AppSec: Data-Driven Measurement of DevSecOps
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
50mWorrisome Web Vulnerability Trends in the Race to Innovation
26mInternet Scanning - Current State and Lessons Learned
52mApplication Security at DevOps Speed and portfolio scale
30mAppSec Timeline: Wins, Failures, Promises, and Predictions
46mBenchmarking AppSec Across Industries