JSConfEU 2013

1. Security First

4. Thanks First

5. Hi, I’m Adam

6. Hi, I’m Adam
@adam_baldwin
@liftsecurity
@nodesecurity

7. Hi, I’m Adam
@evilpacket

9. andbang.com

10. andbang.com

13. Node Security Project
nodesecurity.io

14. Security First

15. We’re Fucked

16. Nothing is 100%
Secure.

19. Defender Attacker

20. Defender Attacker

22. AttackerDefender

23. Software is Hard

24. Software is full of
opinions

26. Mobile First

27. Mobile First
Content First

28. Mobile First
Content First
Offline First

29. Mobile First
Content First
Offline First
SECURITY

30. Software is full of
constraints

31. Security is one of those

32. Who’s responsible for
security?

33. Who’s responsible for
security?
You are.

34. Why?

36. NSA Spent $25 million
on ‘software
vulnerabilities’ in 2013

37. Stay off the menu.

38. Litigation is coming.

39. Litigation is coming.

40. Enough Doom & Gloom
already!

41. Enough Doom & Gloom
already!

42. Something has to
change

43. Let’s build a
Security First
culture

45. Why do we avoid
security?

46. - Ignorance
- Procrastination
- Not Exciting work
- Not Rewarded

47. Education
Understand Vulnerabilities

48. The simple stuff
still works.

50. Validation / Sanitization
Cryptohttp://www.matasano.com/articles/crypto-challenges/
http://owasp.org

51. npm install all the things™

52. npm install coffeescript

53. so..ahhh. what else?

54. Process
It’s not immutable

55. Community
Bridge all the worlds
http://blog.andyet.com/2013/09/11/shame-and-security

56. security.md

57. Homework.
- Learn about 1 vuln
- Audit some code
- Teach a Friend

58. confwork?
Talk to each other about
security...

59. </PRESENTATION>
@adam_baldwin | @LiftSecurity