SlideShare a Scribd company logo
1 of 35
DEVELOPING SECURE APPLICATIONS AND DEFENDING AGAINST ATTACKS Andy Steingruebl, Manager, Information Risk Management
AGENDA ,[object Object],[object Object],[object Object],[object Object]
WHEN SECURITY FAILS
TYPICAL SECURITY MEASURES IN A BANK
AGENDA ,[object Object],[object Object],[object Object],[object Object]
THE PROBLEM OF SECURITY ,[object Object],[object Object],[object Object]
A BRIEF HISTORY OF SECURITY ISSUES 1994 Amazon 1995 Yahoo! 1998 Google 2005 YouTube
OPEN WEB APPLICATION SECURITY PROJECT (OWASP) TOP 10 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Source: http://www.owasp.org/index.php/Top_10_2007
WEB APPLICATION SECURITY CONSORTIUM (WASC) THREAT CLASSIFICATION ,[object Object],Found at  http://www.webappsec.org/projects/threat/
CROSS SITE SCRIPTING (XSS) ,[object Object]
CROSS SITE SCRIPTING (XSS) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
XSS MITIGATION ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
CROSS SITE REQUEST FORGERY (CSRF) ,[object Object],[object Object],[object Object]
CSRF MITIGATION ,[object Object],[object Object],[object Object],[object Object],[object Object]
SQL INJECTION ,[object Object],[object Object],[object Object],Source: http://xkcd.com/327/
MITIGATING SQL INJECTION ,[object Object],[object Object],[object Object],[object Object]
ATTACKING LOGIN FUNCTIONALITY ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
MITIGATING LOGIN ATTACKS ,[object Object],[object Object],[object Object],[object Object],[object Object]
COMMON SHOPPING CART ATTACKS ,[object Object],[object Object]
PRICE TAMPERING ,[object Object],[object Object],[object Object],[object Object],[object Object]
REFERER HEADER ATTACKS ,[object Object],[object Object],[object Object],[object Object]
APPLICATION SECURITY TESTING ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
APPLICATION SECURITY TESTING (CONT’D) Tools help developers and testers debug HTTP/HTTPS traffic and help identify potential vulnerabilities like XSS, CSRF, and so on.
AGENDA ,[object Object],[object Object],[object Object],[object Object]
APPLICATION SECURITY AND SDLC ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Several standards and regulatory compliance requirements directly or indirectly mandate the need for application security controls - PCI DSS, ISO 17799/27001, SOX, GLBA, etc.
SECURITY IN SDLC ,[object Object],Security in SDLC
WHY BEST PRACTICES? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
COMPUTER EMERGENCY RESPONSE TEAM (CERT) SECURE CODING BEST PRACTICES ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Coding+Practices
INPUT VALIDATION ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
MORE SECURITY BEST PRACTICES ,[object Object],[object Object],[object Object],[object Object],[object Object]
AGENDA ,[object Object],[object Object],[object Object],[object Object]
SECURITY WITH PayPal PRODUCTS ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
CONCLUDING THOUGHTS ,[object Object],[object Object],[object Object],[object Object]
MORE INFORMATION ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
LEARN AND SHARE ,[object Object],[object Object],[object Object],[object Object],LEARN AND SHARE www.x.com Twitter: @paypalx www.facebook.com/paypalx Innovate 09 hashtag: # ppxi09  Proprietary

More Related Content

What's hot

Owasp Top 10 And Security Flaw Root Causes
Owasp Top 10 And Security Flaw Root CausesOwasp Top 10 And Security Flaw Root Causes
Owasp Top 10 And Security Flaw Root Causes
Marco Morana
 
Security hole #5 application security science or quality assurance
Security hole #5 application security   science or quality assuranceSecurity hole #5 application security   science or quality assurance
Security hole #5 application security science or quality assurance
Tjylen Veselyj
 

What's hot (20)

Web Application Security 101
Web Application Security 101Web Application Security 101
Web Application Security 101
 
OWASP Top 10 Vulnerabilities 2017- AppTrana
OWASP Top 10 Vulnerabilities 2017- AppTranaOWASP Top 10 Vulnerabilities 2017- AppTrana
OWASP Top 10 Vulnerabilities 2017- AppTrana
 
Why you need API Security Automation
Why you need API Security AutomationWhy you need API Security Automation
Why you need API Security Automation
 
Axoss Web Application Penetration Testing Services
Axoss Web Application Penetration Testing ServicesAxoss Web Application Penetration Testing Services
Axoss Web Application Penetration Testing Services
 
OWASP API Security Top 10 Examples
OWASP API Security Top 10 ExamplesOWASP API Security Top 10 Examples
OWASP API Security Top 10 Examples
 
Get Ready for Web Application Security Testing
Get Ready for Web Application Security TestingGet Ready for Web Application Security Testing
Get Ready for Web Application Security Testing
 
Top 10 Web Application vulnerabilities
Top 10 Web Application vulnerabilitiesTop 10 Web Application vulnerabilities
Top 10 Web Application vulnerabilities
 
OWASP Top 10 2017 rc1 - The Ten Most Critical Web Application Security Risks
OWASP Top 10 2017 rc1 - The Ten Most Critical Web Application Security RisksOWASP Top 10 2017 rc1 - The Ten Most Critical Web Application Security Risks
OWASP Top 10 2017 rc1 - The Ten Most Critical Web Application Security Risks
 
Owasp Top 10 And Security Flaw Root Causes
Owasp Top 10 And Security Flaw Root CausesOwasp Top 10 And Security Flaw Root Causes
Owasp Top 10 And Security Flaw Root Causes
 
Guidelines to protect your APIs from threats
Guidelines to protect your APIs from threatsGuidelines to protect your APIs from threats
Guidelines to protect your APIs from threats
 
t r
t rt r
t r
 
Oh, WASP! Security Essentials for Web Apps
Oh, WASP! Security Essentials for Web AppsOh, WASP! Security Essentials for Web Apps
Oh, WASP! Security Essentials for Web Apps
 
API Security: the full story
API Security: the full storyAPI Security: the full story
API Security: the full story
 
Step by step guide for web application security testing
Step by step guide for web application security testingStep by step guide for web application security testing
Step by step guide for web application security testing
 
Security hole #5 application security science or quality assurance
Security hole #5 application security   science or quality assuranceSecurity hole #5 application security   science or quality assurance
Security hole #5 application security science or quality assurance
 
OWASP Top 10 (2010 release candidate 1)
OWASP Top 10 (2010 release candidate 1)OWASP Top 10 (2010 release candidate 1)
OWASP Top 10 (2010 release candidate 1)
 
Owasp Top 10
Owasp Top 10Owasp Top 10
Owasp Top 10
 
API Security Guidelines: Beyond SSL and OAuth.
API Security Guidelines: Beyond SSL and OAuth.API Security Guidelines: Beyond SSL and OAuth.
API Security Guidelines: Beyond SSL and OAuth.
 
Security testing
Security testingSecurity testing
Security testing
 
Open APIs: Security for Mobile and the Cloud
Open APIs: Security for Mobile and the CloudOpen APIs: Security for Mobile and the Cloud
Open APIs: Security for Mobile and the Cloud
 

Similar to Developing Secure Applications and Defending Against Common Attacks

Security engineering 101 when good design & security work together
Security engineering 101  when good design & security work togetherSecurity engineering 101  when good design & security work together
Security engineering 101 when good design & security work together
Wendy Knox Everette
 
Hackers versus Developers and Secure Web Programming
Hackers versus Developers and Secure Web ProgrammingHackers versus Developers and Secure Web Programming
Hackers versus Developers and Secure Web Programming
Akash Mahajan
 
The Dev, Sec and Ops of API Security - API World
The Dev, Sec and Ops of API Security - API WorldThe Dev, Sec and Ops of API Security - API World
The Dev, Sec and Ops of API Security - API World
42Crunch
 
Web Application Security Testing
Web Application Security TestingWeb Application Security Testing
Web Application Security Testing
Marco Morana
 

Similar to Developing Secure Applications and Defending Against Common Attacks (20)

C01461422
C01461422C01461422
C01461422
 
The Principles of Secure Development - David Rook
The Principles of Secure Development - David RookThe Principles of Secure Development - David Rook
The Principles of Secure Development - David Rook
 
Become a Security Ninja
Become a Security NinjaBecome a Security Ninja
Become a Security Ninja
 
5 step plan to securing your APIs
5 step plan to securing your APIs5 step plan to securing your APIs
5 step plan to securing your APIs
 
Security in the cloud protecting your cloud apps
Security in the cloud   protecting your cloud appsSecurity in the cloud   protecting your cloud apps
Security in the cloud protecting your cloud apps
 
A security note for web developers
A security note for web developersA security note for web developers
A security note for web developers
 
Security engineering 101 when good design & security work together
Security engineering 101  when good design & security work togetherSecurity engineering 101  when good design & security work together
Security engineering 101 when good design & security work together
 
OWASP Secure Coding
OWASP Secure CodingOWASP Secure Coding
OWASP Secure Coding
 
Jan 2008 Allup
Jan 2008 AllupJan 2008 Allup
Jan 2008 Allup
 
00. introduction to app sec v3
00. introduction to app sec v300. introduction to app sec v3
00. introduction to app sec v3
 
Hackers versus Developers and Secure Web Programming
Hackers versus Developers and Secure Web ProgrammingHackers versus Developers and Secure Web Programming
Hackers versus Developers and Secure Web Programming
 
Application Security Part 1 Threat Defense In Client Server Applications ...
Application Security   Part 1   Threat Defense In Client Server Applications ...Application Security   Part 1   Threat Defense In Client Server Applications ...
Application Security Part 1 Threat Defense In Client Server Applications ...
 
Automating your AWS Security Operations
Automating your AWS Security OperationsAutomating your AWS Security Operations
Automating your AWS Security Operations
 
Developing Web Applications Securely - How to Fix Common Code Vulnerabilities...
Developing Web Applications Securely - How to Fix Common Code Vulnerabilities...Developing Web Applications Securely - How to Fix Common Code Vulnerabilities...
Developing Web Applications Securely - How to Fix Common Code Vulnerabilities...
 
Automating your AWS Security Operations
Automating your AWS Security OperationsAutomating your AWS Security Operations
Automating your AWS Security Operations
 
Web Application Security
Web Application SecurityWeb Application Security
Web Application Security
 
Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020Secure coding presentation Oct 3 2020
Secure coding presentation Oct 3 2020
 
The Dev, Sec and Ops of API Security - API World
The Dev, Sec and Ops of API Security - API WorldThe Dev, Sec and Ops of API Security - API World
The Dev, Sec and Ops of API Security - API World
 
Web Application Security Testing
Web Application Security TestingWeb Application Security Testing
Web Application Security Testing
 
Application Security Review 5 Dec 09 Final
Application Security Review 5 Dec 09 FinalApplication Security Review 5 Dec 09 Final
Application Security Review 5 Dec 09 Final
 

More from PayPalX Developer Network

More from PayPalX Developer Network (20)

Payments Anywhere with PayPal
Payments Anywhere with PayPalPayments Anywhere with PayPal
Payments Anywhere with PayPal
 
Trends in social commerce
Trends in social commerceTrends in social commerce
Trends in social commerce
 
Online Payments For Developers
Online Payments For DevelopersOnline Payments For Developers
Online Payments For Developers
 
Monetizing with PayPal on Mobile
Monetizing with PayPal on MobileMonetizing with PayPal on Mobile
Monetizing with PayPal on Mobile
 
Fueling the Wallet.Next
Fueling the Wallet.NextFueling the Wallet.Next
Fueling the Wallet.Next
 
Monetizing your Applications with PayPal X Payments Platform
Monetizing your Applications withPayPal X Payments PlatformMonetizing your Applications withPayPal X Payments Platform
Monetizing your Applications with PayPal X Payments Platform
 
Social Media Metrics
Social Media MetricsSocial Media Metrics
Social Media Metrics
 
In Search of your Wallet ?
In Search of your Wallet ?In Search of your Wallet ?
In Search of your Wallet ?
 
Fowa University Session Monetizing in any ecosystem
Fowa University Session Monetizing in any ecosystemFowa University Session Monetizing in any ecosystem
Fowa University Session Monetizing in any ecosystem
 
Sm Metrics from Social Media Week
Sm Metrics from Social Media WeekSm Metrics from Social Media Week
Sm Metrics from Social Media Week
 
Monetization with PayPal Payments Platform
Monetization with PayPal Payments PlatformMonetization with PayPal Payments Platform
Monetization with PayPal Payments Platform
 
Accept PayPal in 5 Minutes or Less Using Button Manager and Button Manager API
Accept PayPal in 5 Minutes or Less Using Button Manager and Button Manager APIAccept PayPal in 5 Minutes or Less Using Button Manager and Button Manager API
Accept PayPal in 5 Minutes or Less Using Button Manager and Button Manager API
 
Bill Me Later
Bill Me LaterBill Me Later
Bill Me Later
 
One Gateway for All Kinds of Payments—the Payflow Integration
One Gateway for All Kinds of Payments—the Payflow IntegrationOne Gateway for All Kinds of Payments—the Payflow Integration
One Gateway for All Kinds of Payments—the Payflow Integration
 
Cool New Advances in PayPal Express Checkout
Cool New Advances in PayPal Express CheckoutCool New Advances in PayPal Express Checkout
Cool New Advances in PayPal Express Checkout
 
Developing Bullet-Proof Payment Applications for Mobile and Consumer Electron...
Developing Bullet-Proof Payment Applications for Mobile and Consumer Electron...Developing Bullet-Proof Payment Applications for Mobile and Consumer Electron...
Developing Bullet-Proof Payment Applications for Mobile and Consumer Electron...
 
Maximizing PayPal's New Identity Services to Create Seamless and Safe User Ex...
Maximizing PayPal's New Identity Services to Create Seamless and Safe User Ex...Maximizing PayPal's New Identity Services to Create Seamless and Safe User Ex...
Maximizing PayPal's New Identity Services to Create Seamless and Safe User Ex...
 
Opening Our Platform to Developers: PayPal's New Application Model and Develo...
Opening Our Platform to Developers: PayPal's New Application Model and Develo...Opening Our Platform to Developers: PayPal's New Application Model and Develo...
Opening Our Platform to Developers: PayPal's New Application Model and Develo...
 
Adaptive Payments: Changing How We Pay with PIN, Pre-approved and Split Payments
Adaptive Payments: Changing How We Pay with PIN, Pre-approved and Split PaymentsAdaptive Payments: Changing How We Pay with PIN, Pre-approved and Split Payments
Adaptive Payments: Changing How We Pay with PIN, Pre-approved and Split Payments
 
Streamline Your User Experience and Increase Conversion with Adaptive Accounts
Streamline Your User Experience and Increase Conversion with Adaptive AccountsStreamline Your User Experience and Increase Conversion with Adaptive Accounts
Streamline Your User Experience and Increase Conversion with Adaptive Accounts
 

Recently uploaded

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
WSO2
 

Recently uploaded (20)

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Six Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal OntologySix Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal Ontology
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with Milvus
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Elevate Developer Efficiency & build GenAI Application with Amazon Q​
Elevate Developer Efficiency & build GenAI Application with Amazon Q​Elevate Developer Efficiency & build GenAI Application with Amazon Q​
Elevate Developer Efficiency & build GenAI Application with Amazon Q​
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
WSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering Developers
 
MS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsMS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectors
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
CNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In PakistanCNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In Pakistan
 

Developing Secure Applications and Defending Against Common Attacks