Beyond The Norm: Building Secure Websites

transcript

Adria RichardsTwin Cities Web Design and Standards Group

We've got a website!

The golden years of html websites

Websites of Today

All your base are belong to us

Exploding Gastanks and Websites

• Initial price • Reliability• Appearance • Features • Performance

Cross Side Scripting

Famous SitesWebmail including Gmail and YahooFacebookWikipediaBarack Obama & Hiliary Clinton Programming technologiesJavascript, HTML, Java, ActiveX, VBScript, Flash, RSS Preventionusers - Smart browsingdevelopers - URL parametersdevelopers - Form inputdevelopers - Cookies developers - Database calls

SQL Injections

Famous Sites Domain Registrar in New Zealand Microsoft UK United Nations Programming technologiesASP, PHP, mySQL, SQL, Oracle What's Vulnerable?All websites that use a databaseForums, CMS', blogs, shopping carts, contact forms Preventiondevelopers - validate your inputdevelopers - monitor input into your forms

Predictable ID's

Famous SitesVictoria's SecretTrend Micro Programming technologiesyour code, session cookies, HTML, social engineering Preventionusers - Smart browsingdevelopers - random user ID and sesson cookie generation

Keeping Your Clients Safe Online

Discuss

DiscussRecruit

DiscussRecruitTest

DiscussRecruitTestMonitor

+ Discuss+ Collaborate+ Test+ Monitor-----------------------= Happy Clients!

Beyond The Norm: Building Secure Websites

Thanks! Adria RichardsTwitter @adriarichards

Citations and Credit

Title inspiration, "Beyond The Norm" from Robert X. Cringely's article at InfoworldPhoto Locks by Leonid MamchenkovPhotos Classic Cars by by Rojer, Draco2008, Martin Pettitt, charkesw , Smudge 9000, dave_7Photo Ford Pinto by Brian Teutsch Photo Rack Right by sylvarPhoto database 2 by Tim MorganPhoto Message error 404 CyboRoZPhoto You buys your ticket by Hryck.Photo Injection by Conor LawlessDog and kid photos susieq3c timtimes airwaves1 riaan_cornelius estoril gopal1035 hdport Ssmallfry Bill in Ash VegasDesign Defects of the Ford Pinto Gas Tank, Engineering DisasterTwitter in KindergartenWikipedia Cross-site ScriptingWikipedia SQL Injection Understanding Malicious Content Mitigation for Web DevelopersInsecure Websites by CRNIdentity theft in web applications

Type of attacks

Abuse of Functionality, Brute Force, Content Spoofing, Credential/Session Prediction, Cross-site Scripting, Defacement, Denial of Service, Directory Indexing, HTTP Response Splitting, Information Leakage, Insufficient Anti-automation, Insufficient Authentication, Insufficient Authorization, Insufficient Process Validation, Insufficient Session Expiration, Known Vulnerabity, Misconfiguration, OS Commanding, Other, Path Traversal, Phishing, Predictable Resource Location, Redirection, SQL Injection, Unknown, Weak Password Recovery Validation, Worm Credit Web Application Security Consortium

Beyond The Norm: Building Secure Websites

Technology