Defending Against Data Breaches, as a Practicing Ruby Developer
summary
Claims that over fifty percent of web-app breaches stem from stolen credentials and that two-factor for staff would have prevented many real incidents such as Buffer and Code Spaces. Recommends concrete tools and settings: Brakeman, bundler-audit, force SSL plus Strict‑Transport‑Security and secure cookie flags, PGP for encrypting production copies, exercise OWASP Rails Goat, and classify data so encryption keys and backups get treated as top‑sensitive. Gives specific abuse scenarios and logging plus defense‑in‑depth controls that developers can implement now.
AI-written summary · about
chapters (12)
- 0:00Data breach prevention intro
- 1:27Security is not binary
- 3:16Data breach definition and legal impact
- 5:24Real breach root causes
- 7:52Security as dev requirement
- 8:55Information classification system
- 10:00User stories with security constraints
- 12:29Abuser stories for attackers
- 13:11OWASP top 10 countermeasures
- 15:39Secure headers SSL tools
- 17:48Encryption PGP in workflows
- 18:28Recap defense-in-depth
related talks
43mUncertain Times: Securing Rails Apps and User Data
31mRails Application Security in Practice
42mSecuring Your Rails App
36mSecurity is hard, but we can't go shopping
59mPractical Security for Web Applications
43mSecuring Your Site
34mThe World of Rails Security
38m"Application Security for Rails Engineers"