Intro
Speaker's Qualifications
Top 5 Vulnerabilities for 2006*
Overall Presentation Goal
Security Sins
Un-validated Input - 1
Un-validated Input - 2
Un-validated Input - SQL Injection - 1
Un-validated Input - SQL Injection - 2
Un-validated Input - SQL Injection - 3
Un-validated Input - SQL Injection attack tools
Un-validated Input - LDAP Injection
Un-validated Input - XPath Injection
Un-validated Input - Solution - 1
Un-validated Input - Solution - 2
Un-validated Input - Solution - 3
Cross Site Scripting (XSS) - 1
Cross Site Scripting (XSS) - 2
Cross Site Scripting (XSS) - 3
Cross Site Scripting: Persistent - 1
Cross Site Scripting: Persistent - 2
Cross Site Scripting - Solution
Un-authenticated Transactions - 1
Un-authenticated Transactions - 2
Un-authenticated Transactions - 3
Un-authenticated Transactions - Solution
Misplaced Trust - 1
Misplaced Trust - 2
Misplaced Trust - Solution
Towards a Secure SDLC - 1
Towards a Secure SDLC - 2
What's the problem?
Real cost of Security
Security integrated into the SDLC
Security Requirements
What are Abuse Cases ?
Dr. Evil
Abuse Cases
Risk Analysis
Basic Risk Analysis methodology
Code Review
Security code review tools for Java
Security Tests
Penetration Tests
Summary - 1
Summary - 2
Security is not a product...
Resources
The talk covers the most insidious security vulnerabilities in Java Web and EE applications through practical demonstration of how to exploit these vulnerabilities and recommendations on how to prevent them. The threat posed by each vulnerability is explained and strategies for mitigating the flaw are introduced. The talk concludes with a discussion about integrating security at every step of the development life cycle.
Stephen de Vries is a Principal Consultant in Corsaire's Security Assessment team. He has worked in IT Security since 1998, and has been programming since 1997. He has spent the last four years focused on Ethical Hacking, Security Assessment and Audit at Corsaire, KPMG and Internet Security Systems. He was a contributing author and trainer on the ISS Ethical Hacking course and Technical Leader for the Automated Perimeter Scanning project co-coordinating a team of six developers in three countries. Stephens past roles have included that of a Security Consultant at a leading City of London Financial institution and also Security Engineer at SMC Electronic Commerce. At both positions he was involved in corporate security at many levels and was responsible for consulting on the paper security policies and procedures, conducting vulnerability assessments, designing, deploying and managing the security infrastructure of the organisation.