際際滷

際際滷Share a Scribd company logo

Don't be a trojan - Codemotion Amsterdam 2019

Brian Vermeer
Brian Vermeer

This document discusses the importance of security in software development. It warns that software systems can become compromised over time if security is not prioritized from the beginning. It recommends designing systems with security in mind from the start, implementing secure development practices like automated security testing, code reviews that consider privacy and data exposure, and centralizing logs to detect issues. Maintaining security requires ongoing efforts like monitoring systems in production for vulnerabilities.

1 of 56
Download to read offline
DONT BE A TROJAN BRIAN VERMEER (@BRIANVERM)
@BrianVerm DATA IS THE NEW GOLD
@BrianVerm
@BrianVerm
@BrianVerm BRIAN VERMEER DEVELOPER ADVOCATE
@BrianVerm BUT I GOT NOTHING TO HIDE DONT BE A TROJAN
@BrianVerm HTTPS://NLTIMES.NL/ 2018/03/08/NUDE-VIDEOS- DUTCH-HANDBALL-TEAM- LEAK-ONLINE-SAUNA- CAMERA-HACK
@BrianVerm HTTP://WWW.ALPHR.COM/ HEALTH/1005587/THE-NUMBER- OF-PEOPLE-ASKING-GOOGLE- FOR-MEDICAL-ADVICE-HAS- SKYROCKETED-IN-A-DECADE
SOCIAL RANKING CHINA
@BrianVerm BUT NOW WE HAVE GDPRRIGHT?!
@BrianVerm HTTPS://FUSION.TV/STORY/281543/REAL-FUTURE-EPISODE-8-HACK- ATTACK/?CURATOR=TECHREDEF KEVIN ROOSE - 24 FEB 2016
@BrianVerm HTTPS://FUSION.TV/STORY/281543/REAL-FUTURE-EPISODE-8-HACK- ATTACK/?CURATOR=TECHREDEF KEVIN ROOSE - 24 FEB 2016
@BrianVerm
@BrianVerm
@BrianVerm
@BrianVerm LAPTOP
@BrianVerm PASSWORDS
@BrianVerm DEVOPS
@BrianVerm TEST DATA
@BrianVerm SECURITY BY DESIGN DEVELOPMENT
@BrianVerm DONT BE A TROJAN DATA STORAGE WHAT DATA DO WE STORE? WHAT DATA DO WE NEED? HOW LONG DO WE NEED TO KEEP THIS DATA? HOW DOES THIS DATA TRACE BACK TO AN INDIVIDUAL? WHO HAS ACCESS TO THIS DATA
@BrianVerm SOFTWARE DEVELOPMENT OVER TIME
@BrianVerm DONT BE A TROJAN STAGE 1 - BUILD A NICE CLEAN SYSTEM
@BrianVerm DONT BE A TROJAN STAGE 2 - A LITTLE ADDITION
@BrianVerm DONT BE A TROJAN STAGE 3 - A COMPLETE NEW FEATURE ON TOP
@BrianVerm DONT BE A TROJAN STAGE 4 - EXPANDING WITH A NEW SCOPE
@BrianVerm DONT BE A TROJAN STAGE 5 - AND NOW WE WANT TO RULE THE WORLD
@BrianVerm EXAMPLE PROFILE SERVICE CREATE PROFILE UPDATE PREFERENCES GET PROFILE BY UUID PROFILE - UUID - LIST OF PREFERENCES
@BrianVerm EXAMPLE PROFILE SERVICE CREATE PROFILE UPDATE PREFERENCES GET PROFILE BY UUID PROFILE - UUID - EMAIL - LIST OF PREFERENCES MYHOME SERVICE CLAIM A HOUSE UPDATE YOUR HOUSE FIND ALL HOUSES MyHOUSE - UUID - HOUSE ADDRESS - HOUSE PICTURES SECURED LOGIN
@BrianVerm EXAMPLE PROFILE SERVICE GET PROFILE BY UUID PROFILE - UUID - EMAIL - LIST OF PREFERENCES MYHOME SERVICE FIND ALL HOUSES MyHOUSE - UUID (EXPOSED) - HOUSE ADDRESS - HOUSE PICTURES
@BrianVerm WHAT DATA IS EXPOSED TO THE OUTSIDE WORLD
DATA LEAK?
@BrianVerm WHO WAS EXPOSED? HOW LONG WAS IT THERE? WHAT WAS THE IMPACT? WHAT KIND OF DATA IS LEAKED? AM I A VICTIM?
@BrianVerm LOG EVERYTHING
@BrianVerm BUT WHAT ABOUT CI/CD ?
@BrianVerm AUTOMATED SECURITY TESTS
@BrianVerm SHIFT SECURITY LEFT <
@BrianVerm WHATS IN IT DEPENDENCIES
@BrianVerm Your App
@BrianVerm Your Code Your App
@BrianVerm SPRING SERVERLESS EXAMPLE
@BrianVerm 222 Lines of Code SPRING SERVERLESS EXAMPLE
@BrianVerm 222 Lines of Code SPRING SERVERLESS EXAMPLE
@BrianVerm 222 Lines of Code 5 Direct dependencies SPRING SERVERLESS EXAMPLE
@BrianVerm 222 Lines of Code 5 Direct dependencies 54 dependencies (incl. indirect) SPRING SERVERLESS EXAMPLE
@BrianVerm 222 Lines of Code 5 Direct dependencies 54 dependencies (incl. indirect) 460,046 Lines of Code SPRING SERVERLESS EXAMPLE
@BrianVerm Your Code Your App
@BrianVerm
@BrianVerm CODE REVIEW
DONT BE A TROJAN CODE REVIEW @GetMapping(path="/all") public List<MyHouse> getAllHouses() { return MyHouseRepository.鍖ndAll(); } public class MyHouse { @Id private String id; private Date creationDate; private Date modi鍖cationDate; private String userId; private String street; private Integer number; private String zip; private String city; }
DONT BE A TROJAN CODE REVIEW @GetMapping(path="/all") public List<MyHouse> getAllHouses() { return MyHouseRepository.鍖ndAll(); } public class MyHouse { @Id private String id; private Date creationDate; private Date modi鍖cationDate; @JsonIgnore private String userId; private String street; private Integer number; private String zip; private String city; }
@BrianVerm DESIGN TO BE COMPROMISED
@BrianVerm CENTRALIZED LOGGING AND ALERT ON IT
@BrianVerm KEEP SCANNING IN PRODUCTION
@BrianVerm SHIFT SECURITY LEFT <
@BrianVerm BRIAN VERMEER @BRIANVERM BRIANVERMEER@SNYK.IO

More Related Content

Don't be a trojan - Codemotion Amsterdam 2019