Security course 30 April 2018 - Revision history

Johnno: /* Prevention */

2018-04-30T05:06:56Z

Prevention

Johnno at 04:59, 30 April 2018

2018-04-30T04:59:07Z

Johnno: /* Use the headers */

2018-04-30T04:53:53Z

Use the headers

Johnno at 04:53, 30 April 2018

2018-04-30T04:53:28Z

Johnno: /* Cross-Site Request Forgery (CSRF) */

2018-04-30T04:39:32Z

Cross-Site Request Forgery (CSRF)

Johnno: /* Cross-Site Request Forgery (CSRF) */

2018-04-30T04:38:52Z

Cross-Site Request Forgery (CSRF)

Johnno: /* Cross-Site Request Forgery (CSRF) */

2018-04-30T04:38:15Z

Cross-Site Request Forgery (CSRF)

Johnno at 04:37, 30 April 2018

2018-04-30T04:37:37Z

Johnno: /* A7: Cross-Site Scripting (XSS) */

2018-04-30T04:26:34Z

A7: Cross-Site Scripting (XSS)

Johnno: /* A7: Cross-Site Scripting (XSS) */

2018-04-30T03:37:31Z

A7: Cross-Site Scripting (XSS)

@@ Line 215: / Line 215: @@
 # Keep your shit patched
-# Don't use crummy plugins / Don't run code in production you haven't audited yourself
+# Don't use crummy plugins / Don't run someone else's code in production you haven't audited yourself
 === A10: Insufficient logging and monitoring ===

← Older revision		Revision as of 04:59, 30 April 2018
Line 233:		Line 233:
	# Use a web framework.		# Use a web framework.
	# Set the 'SameSite' cookie attribute; prevents cookies on cross-origin requests. Since Chrome 55, Firefox 60. https://caniuse.com#search=SameSite		# Set the 'SameSite' cookie attribute; prevents cookies on cross-origin requests. Since Chrome 55, Firefox 60. https://caniuse.com#search=SameSite
		+
		+	== Links and further reading ==
		+
		+	* OWASP: https://www.owasp.org/
		+	* Scan your site with the Mozilla Observatory: https://observatory.mozilla.org/
		+	* Check your site SSL configuration: https://www.ssllabs.com/ssltest/
		+	* SSL configuration generator: https://mozilla.github.io/server-side-tls/ssl-config-generator/
		+	* Generate a Content Security Policy header: https://report-uri.com/home/generate
		+	* Check for browser capabilities: https://caniuse.com

@@ Line 53: / Line 53: @@
 * HSTS: enforces HTTPS, ciphers, etc. 6-24 months recommended.
 * CSP: restricts scripts, frames, styles etc. Generate one, at https://report-uri.com/home/generate
-* X-Frame-Options prevents click-jacking; potentially obsoleted frame bits in CSP 2.
+* X-Frame-Options prevents click-jacking; potentially obsoleted by the new frame bits in CSP 2.
 * X-XSS-Protection: IE and Webkit support this, but it can be disabled(!?)
 * Prevent MIME type sniffing: X-Content-Type-Options: nosniff

@@ Line 48: / Line 48: @@
 # Use appropriate URL encoding (/ = %2f) and HTML encoding (& = &amp;)
 # Use HTTPS Strict Transport Security, Content Security Policy, and HTML frame options.
 == OWASP ==

@@ Line 216: / Line 216: @@
 # Use a CAPTCHA or similar.
 # Use a web framework.
-# Set the 'SameSite' cookie attribute; prevents cookies on cross-origin requests. Since Chrome 55, Firefox 60. https://caniuse.com?search=SameSite
+# Set the 'SameSite' cookie attribute; prevents cookies on cross-origin requests. Since Chrome 55, Firefox 60. https://caniuse.com#search=SameSite

← Older revision		Revision as of 04:37, 30 April 2018
Line 210:		Line 210:
	# Ensure security sensitive things are logged with sufficient context; validation failures, username, IP, user agent, ACL etc.		# Ensure security sensitive things are logged with sufficient context; validation failures, username, IP, user agent, ACL etc.
	# Monitor logs.		# Monitor logs.
		+
		+	=== Cross-Site Request Forgery (CSRF) ===
		+
		+	# Prevent by using an unpredictable one-use short-lived token in a hidden field, and ensure validity.
		+	# Use a CAPTCHA or similar.
		+	# Use a web framework.
		+	# Set the 'SameSite' cookie attribute; prevents cookies on cross-origin requests. Since Chrome 55, Firefox 58.

← Older revision		Revision as of 04:26, 30 April 2018
Line 179:		Line 179:

	Intercepting proxies, e.g. OWASP ZAP (Zed Application Proxy). Can investigate traffic between browser and internet; can also scan sites for potential vulnerabilities. ZAP runs on Java 8+, set up browsers to use a localhost:xxxx proxy.		Intercepting proxies, e.g. OWASP ZAP (Zed Application Proxy). Can investigate traffic between browser and internet; can also scan sites for potential vulnerabilities. ZAP runs on Java 8+, set up browsers to use a localhost:xxxx proxy.
		+
		+	=== A8: Insecure Deserialisation ===
		+
		+	Deserialisation can be really bad, e.g. XML (see above).
		+
		+	==== Prevention ====
		+
		+	* Do cryptographic integrity checks
		+	* Isolate deserialisation at the lowest priv possible
		+	* Restrict network connectivity from containers doing the deserialising
		+	* Log desz exceptions and failures
		+	* Alert repeated desz attempts
		+
		+	=== A9: Using components with known vulns ===
		+
		+	OS, databases, webservers, scripting languages, caching stores, app frameworks, 3rd party application plugins and widgets, JS libraries, ...
		+
		+	==== Prevention ====
		+
		+	# Keep your shit patched
		+	# Don't use crummy plugins / Don't run code in production you haven't audited yourself
		+
		+	=== A10: Insufficient logging and monitoring ===
		+
		+	If you're not logging, you can't find out what happened. If you're not monitoring, you can't react in time. If you're not doing either, then Ô__o. Most breaches are not detected for several months after they have happened.
		+
		+	==== Prevention ====
		+
		+	# Ensure your logs are digestible by some central logging management system (collectd, ES, kibana, etc.)
		+	# Ensure security sensitive things are logged with sufficient context; validation failures, username, IP, user agent, ACL etc.
		+	# Monitor logs.

← Older revision		Revision as of 03:37, 30 April 2018
Line 177:		Line 177:
	Content-Security-Policy: default-src: self; style-src: self; <nowiki>connect-src: https://api.stripe.com; \		Content-Security-Policy: default-src: self; style-src: self; <nowiki>connect-src: https://api.stripe.com; \
	frame-src self https://js.stripe.com; script-src self https://js.stripe.com</nowiki>		frame-src self https://js.stripe.com; script-src self https://js.stripe.com</nowiki>
		+
		+	Intercepting proxies, e.g. OWASP ZAP (Zed Application Proxy). Can investigate traffic between browser and internet; can also scan sites for potential vulnerabilities. ZAP runs on Java 8+, set up browsers to use a localhost:xxxx proxy.