From the Crypt to the Code

A cryptic videotape haunting its viewers, a shape-shifting entity haunting a research station, or an astronaut unknowingly carrying an alien onto a spaceship —do these scenarios sound familiar? These horror movie plots share similarities with scenarios in web security you have already encountered.

Join me on a chilling journey through web security as we explore the most common vulnerabilities through the lens of horror movies. From the sinister injection flaws reminiscent of "Alien" to the terrifying specter of broken authentication akin to "Unfriended". But don't worry, we'll also shed light on solutions in web development, turning these security nightmares into tales of triumph. If you dare, join us and learn how to conquer the darkness invited by your web applications.

Transcript

1. Web security explored through horror movies
2. Slight spoiler alert / content warning
3. Brillstein-Grey Entertainment
4. Brillstein-Grey Entertainment
5. Let‘s split up, gang!
6. Are we really better then them?
7. They‘re the same picture.
9. Friendly professor to the rescue!
11. Let‘s draft our own survival playbook
13. Broken Access Control
14. Nobody will see him come, […] He can hear every secret.
16. Deny by default
17. Deny by default Rate limit API and controller access
18. Deny by default Rate limit API and controller access Invalidate stateful session identifiers
19. Deny by default Rate limit API and controller access Invalidate stateful session identifiers Implement and reuse access control mechanisms
22. Cryptographic Failures
23. The box. You opened it. We came
25. Encrypt all sensitive data
26. Classify data processed, stored, or transmitted Encrypt all sensitive data
27. Classify data processed, stored, or transmitted Don't store sensitive data unnecessarily Encrypt all sensitive data
28. Classify data processed, stored, or transmitted Don't store sensitive data unnecessarily Don‘t cache sensitive responses Encrypt all sensitive data
29. Classify data processed, stored, or transmitted Don't store sensitive data unnecessarily secure, strong & up-to-date protocols Don‘t cache sensitive responses Encrypt all sensitive data
37. Use a safe API
38. Use a safe API positive server-side input validation
39. Use a safe API positive server-side input validation Use SQL features
40. Use a safe API positive server-side input validation Use SQL features escape special characters
41. Example sanitation
42. Example sanitation Library or build your own
43. Example sanitation
46. Vurnerable and Outdated Dependencies
49. Remove ununsed dependencies etc.
50. Remove ununsed dependencies etc. Inventory of all version numbers
51. Remove ununsed dependencies etc. Inventory of all version numbers Obtain from official sources & secure links
52. Remove ununsed dependencies etc. Inventory of all version numbers Obtain from official sources & secure links Monitor if library get unmaintained
53. Remove ununsed dependencies etc. Inventory of all version numbers Obtain from official sources & secure links Monitor if library get unmaintained
57. Stay as a team
58. Stay as a team Take care of your batteries
59. Stay as a team Take care of your batteries Double-check if the killer was defeated
60. Stay as a team Take care of your batteries Double-check if the killer was defeated Take your prof‘s OWASP‘s advice seriously
61. Thank you!
62. Thank you!