Zero Trust with Users
summary
Penetration testing finds that authenticated sessions frequently become attack vectors: requests require per-call authorization checks, not just a valid login. Real failures include sequential ID enumeration allowing bulk record access, JWT signature ignored permitting role escalation, input that triggers XSS and SQL/command injection, and password resets that lack ownership checks. Test methodology emphasizes unhappy paths and chaining small logic flaws into full data exfiltration.
AI-written summary · about
chapters (7)
- 0:00Zero Trust intro
- 1:16Developers' blind trust
- 3:23Malicious users bypass auth
- 4:51User input and session hijacking
- 7:43Valid sessions and permission risks
- 10:59Token validation flaws
- 12:26Summary
related talks
31mAttacking Zero Trust Designs in 2021
24mExploring Zero Trust, Threat Intelligence, and Secure SDLC
25mRisk-based authentication and zero trust architecture ZTA
40mZero Trust and Privacy: Moving Security Closer to the Target
27mCommon Application Security Mistakes that Enable Automated Attacks
17mZero Trust access with zero waiting, zero pain, and zero compromises
38mZero Trust Security for your APIs
20mUnderstanding Zero Trust security