We’ll get started at 18:05

Week09

COMP6443 H18A

My Experience

How’d you find the course

  • What’d you like
  • What’d you dislike
  • What can be improved

https://myexperience.unsw.edu.au

DevSecOps

 

Waterfall 🌊 vs agile 🏃

  • Systematic/design vulnerabilities are much harder to solve than simple coding/logic errors.

  • This is exacerbated in the waterfall approach, as you don’t really go back to the design phase.

 

Waterfall 🌊

  • exponentially more $$$ to fix bugs later into SDLC
  • we want to shift security left <<<

 

💻 vms vs containers 🐳

CVEs

Common Vulnerability Enumerations

It’s really important that the security community works together

where to find em

Application Security Testing

SAST vs DAST tools

  • SAST: full access to source-code (white box)
  • DAST: just have the application (black box)
  • IAST: runtime specific (e.g. only specific times)

I accidentally pushed some secrets here

can you find them?

old commits

wayback machine

github events (commit is here)

who’d be dumb enough to…

me lol (it’s not a pub-key…)

top 10 images taken moments before after disaster

maybe check your old projects to see if you’ve made similar dumb mistakes?

What makes a good app

The fundamentals

  • Availability 💰
  • Reliability 💰
  • Scalability 💰
  • Security 🙈 🙉 🙊

At a high level

 

not doing this

Supply chain attacks

dependency stuffs

Trusting code we didn’t write ourselves

  • npm
  • pip/pypi
  • pacman/aur
  • cargo

Vulnerabilities

Malicious developers

Dependency confusion

  • npm install xyz
  • how does it resolve xyz
  • public & private version of xyz
  • higher version number

read more

Typosquatting

  • pip install falsk
  • package named falsk:

read more

Vulnerability in the package manager

I don’t have an example 🤷

what makes a secure web app

technology

  • NGINX, Lets Encrypt (TLS), Docker
  • don’t trust user input anybody (zero-trust)
  • good access control

Challenges/Walkthrough