90k reasons security is a must - phpworld 2014
DESCRIPTION
We all have focussed on best practices and code quality over the past years, but we seemed to forgot the most important aspect of the web: security. This talk gives a good overview on your first-line of defence in your code, how to ensure that new exploits and hacking techniques are covered with tests and how you build solid web applications that secured enough to keep script kiddies and wanna-be hackers away. I will also give some tips what to do when you're company becomes victim of cyber crime.TRANSCRIPT
![Page 1: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/1.jpg)
2
http
s://w
ww.
flick
r.com
/pho
tos/
busc
hap/
3112
2390
16
90K reasonswhy security is a must
in it2PROFESSIONAL PHP SERVICES
![Page 3: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/3.jpg)
A year later
3
![Page 4: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/4.jpg)
Today, 2 months later
4
![Page 5: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/5.jpg)
5
http
s://w
ww.
flick
r.com
/pho
tos/
andy
mag
/934
9743
409
![Page 6: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/6.jpg)
Neverending awareness
6
http
s://w
ww.
flick
r.com
/pho
tos/
yono
late
ngo/
8338
5975
58
![Page 7: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/7.jpg)
Why bother?
7
http
s://w
ww.
flick
r.com
/pho
tos/
emag
ic/5
6206
868
![Page 8: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/8.jpg)
8
In the news…
http
s://w
ww.
flick
r.com
/pho
tos/
3990
8901
@N
06/6
9234
0893
8
![Page 9: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/9.jpg)
Yes, you’re a target!
9
http
s://w
ww.
flick
r.com
/pho
tos/
jeep
ersm
edia
/145
4605
9371
![Page 10: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/10.jpg)
Email addresses are valuable!
10
http
s://w
ww.
flick
r.com
/pho
tos/
horia
varla
n/45
1416
4700
![Page 11: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/11.jpg)
One password, many sites!
11
abc123
![Page 12: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/12.jpg)
Advice on tools!!!
12
Password managers!
![Page 13: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/13.jpg)
2-factor authentication
13
http://www.google.com/landing/2step/
![Page 15: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/15.jpg)
Who’s after my data?
15
http
s://w
ww.
flick
r.com
/pho
tos/
teeg
ardi
n/60
9381
0333
![Page 16: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/16.jpg)
Script kiddies
16
![Page 17: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/17.jpg)
Amateur hacker
17
http
s://w
ww.
flick
r.com
/pho
tos/
hack
ny/6
2033
0570
6
![Page 18: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/18.jpg)
Professional hacker
18
http
s://w
ww.
flick
r.com
/pho
tos/
equi
noxe
fr/68
5717
4987
![Page 19: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/19.jpg)
Business Competition
19
http
s://w
ww.
flick
r.com
/pho
tos/
hagg
ism
ac/5
0900
2851
3
![Page 20: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/20.jpg)
Governments
20
http
s://w
ww.
flick
r.com
/pho
tos/
defe
ncei
mag
es/7
9856
9559
1
![Page 21: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/21.jpg)
What to do against it?
21
http
s://w
ww.
flick
r.com
/pho
tos/
drac
hman
n/32
7122
302
![Page 22: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/22.jpg)
Cultural differences
22
http
s://w
ww.
flick
r.com
/pho
tos/
robd
eman
/239
0666
040
![Page 23: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/23.jpg)
Legal regulations
23
http
s://w
ww.
flick
r.com
/pho
tos/
puis
ney/
1674
5868
21
![Page 24: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/24.jpg)
Architectural considerations
24
http
s://w
ww.
flick
r.com
/pho
tos/
nifty
nial
l/127
6892
2813
![Page 25: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/25.jpg)
Restrict physical access
25
http
s://w
ww.
flick
r.com
/pho
tos/
zapt
hedi
ngba
t/487
1337
20
![Page 26: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/26.jpg)
Secure your network
26
http
s://w
ww.
flick
r.com
/pho
tos/
9927
9135
@N
05/1
4618
3422
77
![Page 27: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/27.jpg)
Extra care for privacy data
27
http
s://w
ww.
flick
r.com
/pho
tos/
hyku
/368
9125
57
![Page 28: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/28.jpg)
Use encryption
28
http
s://w
ww.
flick
r.com
/pho
tos/
ideo
nexu
s/51
7538
3269
![Page 29: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/29.jpg)
Lock down your application
29
http
s://w
ww.
flick
r.com
/pho
tos/
sim
on_c
ocks
/453
4589
059
![Page 30: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/30.jpg)
Create security checkpoints
30
http
s://w
ww.
flick
r.com
/pho
tos/
paul
k/22
1299
2458
![Page 31: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/31.jpg)
Track movements
31
http
s://w
ww.
flick
r.com
/pho
tos/
timsa
mof
f/362
7307
55
![Page 32: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/32.jpg)
Code considerations
32
http
s://w
ww.
flick
r.com
/pho
tos/
nyuh
uhuu
/444
3886
636
![Page 33: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/33.jpg)
Security is not an afterthought!
33
http
s://w
ww.
flick
r.com
/pho
tos/
web
b-za
hn/1
0971
2154
25
![Page 35: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/35.jpg)
Sanitise data, always<?php $id = $_GET['id']; // sanitise tainted data $clean_id = filter_var($id, FILTER_SANITIZE_NUMBER_INT); $clean_id = filter_var($clean_id, FILTER_VALIDATE_INT); if (0 < $clean_id) { $stmt = $pdo->prepare( 'SELECT * FROM TABLE WHERE `id` = ?' ); $stmt->bindParam(1, $clean_id, PDO::PARAM_INT); $stmt->execute(); }
35
![Page 36: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/36.jpg)
36
![Page 37: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/37.jpg)
Use the right tool for the job
37
http
s://w
ww.
flick
r.com
/pho
tos/
floria
nric
/726
3382
550
![Page 38: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/38.jpg)
38
![Page 39: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/39.jpg)
39
![Page 40: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/40.jpg)
Layered security
40
http
s://w
ww.
flick
r.com
/pho
tos/
fees
ta/2
7005
7520
1
![Page 41: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/41.jpg)
You know all this, right!
41
http
s://w
ww.
flick
r.com
/pho
tos/
sara
hrei
do/3
1208
7734
8
![Page 42: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/42.jpg)
Victim of an attack?
42
http
s://w
ww.
flick
r.com
/pho
tos/
mar
ittol
edo/
8512
2449
45
![Page 43: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/43.jpg)
Know you’ve been hacked!
43
![Page 44: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/44.jpg)
Inform everyone ASAP!
44
http
s://w
ww.
flick
r.com
/pho
tos/
blue
robo
t/549
0728
061
![Page 45: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/45.jpg)
Get security advise!
45
![Page 46: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/46.jpg)
Inform the world
46
![Page 47: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/47.jpg)
Your turn
47
http
s://w
ww.
flick
r.com
/pho
tos/
tmab
2003
/427
7896
845
![Page 48: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/48.jpg)
Spread the word
48
http
s://w
ww.
flick
r.com
/pho
tos/
sune
ko/3
7331
0729
![Page 49: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/49.jpg)
Comment on “bad” practices
49
http
s://w
ww.
flick
r.com
/pho
tos/
seba
stia
n_be
rgm
ann/
3991
5396
05
![Page 50: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/50.jpg)
Learn about the risks
50
![Page 52: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/52.jpg)
Use hack cheat sheets
52
ha.ckers.org
![Page 53: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/53.jpg)
Continuously unit test!
53
![Page 54: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/54.jpg)
Other resources…
54
![Page 58: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/58.jpg)
May the force be with you
58
![Page 59: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/59.jpg)
Questions
59
http
s://w
ww.
flick
r.com
/pho
tos/
colin
kinn
er/2
2005
0002
4
![Page 60: 90K Reasons Security is a Must - PHPWorld 2014](https://reader036.vdocument.in/reader036/viewer/2022062419/5590ed571a28ab05748b46c3/html5/thumbnails/60.jpg)
60
joind.in/11858If you like it, thanks.
If you don’t, please tell me how to improve