1. Web 2.0 Security Aleksandr Yampolskiy, Ph.D.

2. What is Web 2.0? Dictionary.com Main Entry: web 2.0 Part of Speech: n Definition: the second generation of the World Wide Web in which content is user-generated and dynamic, and software is offered that mimics desktop programs Example: Web 2.0 encourages collaboration and communication between users. Etymology: 2004

3. Web 2.0 Sites

4. Cuene.com/mima Web 2.0 Evolution

5. Gilt is a Web 2.0 site for luxury fashion at discounted prices Gilt combines published content with user generated content. Users can shop, blog, upload comments about fashion products to Twitter, Facebook. Users can share cool deals on Gilt City via Facebook, Twitter, Email. Users can blog about Gilt products.

6. Evolution of Threats in Web 2.0 Every insider is a threat. Even a CISO. To a trojan, you are just an IP address. New propagation methods for malware (PDF, videos, social networks, pop-up ads, etc.) Perimeter of the network is no longer clearly defined as employees use social media (Twitter, Facebook) and external cloud providers.

8. More data in more places

9. Secure and insecure content from different sites mashed on a page

10. We now need to review client-side and server-side code.

11. Dynamic, agile development approach results in code that’s not thoroughly tested

12. Complicated UI frameworks may contain their own subtle security bugs

14. Relax, it’s not that bad!

16. Multilayered “onion security”.

17. None of the “new” attacks appear on OWASP top 10 list of security bugs.

18. In fact, Verizon 2009 data breach report lists top data breach causes as - Weak or default passwords - SQL injection attacks - Improper access rights - XSS attacks

19. Our Approach Security decisions are based on risk, not just threats and vulnerabilities (risk = threat*vulnerability*cost). Don’t chase hot vulnerabilities of the day. Instead, mitigate top risks. AAA and least privilege principle. Heavily based on policy and user education. “Onion security” – multiple protections at each layer. Achieve “essential”, then worry about “excellent”. Be a “how team” instead of a “no team”. Build security into the software development lifecycle.

21. Monitor Internet connections for suspicious activity.

22. Install anti-virus and anti-malware software on every computer.

24. Recommendations (cont.) Build security into the SDLC (software development lifecycle). Secure coding + books for all developers. Fortify static code scanner + dynamic scans using BurpSuite - Jira security category approval workflow

25. Recommendations (cont.) Standardized configmanager for firewall rules. Bandwidth analysis. Standard laptop and server images (disk encryption, A/V, LanRev) Evaluate 3rd parties’ security before sending them your data. Monitor your good name (actually go to hacker forums, Google for it, watch the press, etc.)

26. 16