Download as PDF, PPTX
Uploaded byDiego Pacheco
Sec 101
This document profiles Diego Pacheco and provides an overview of key software security principles including defense in depth, the least privilege principle, encryption, TLS and mTLS, misconfiguration and error handling, input sanitization, cross-site scripting (XSS), insecure serialization/deserialization, known vulnerabilities, logging and audit trails, threat analysis, and engineering friction. The document emphasizes applying security best practices to protect customer experience, brand integrity, and compliance while avoiding friction for engineering teams.
Sec 101
- 1.
- 2. @diego_pacheco ❏ Cat's Father ❏Head of Software Architect ❏ Agile Coach ❏ SOA/Microservices Expert ❏ DevOps Practitioner ❏ Speaker ❏ Author diegopacheco http://diego-pacheco.blogspot.com.br/ About me... https://diegopacheco.github.io/
- 3. We are usedto Security in the physical world
- 4.
- 5. Why should wecare? ❏ Ethics ❏ Customer Experience ❏ Brand Integrity ❏ Compliance
- 6. Defense in depth ❏NSA ❏ Layers ❏ All IT systems ❏ It’s all about redundancy ❏ AV, Auth, Encryption, MFA, Sandboxes, DMZ, VPN, Firewalls, etc...
- 7. Least Privilege Principle ❏Minimum level of access and privilege. ❏ Avoid wide open permissions like * ❏ Avoid Attacker Surface ❏ Spots malware spread
- 8. Encryption ❏ Symmetric &Asymmetric ❏ Encoding Information ❏ AES Standard ❏ Key Diversity ❏ Envelope Encryption ❏ App vs Storage Encryption ❏ Rotations
- 9. TLS and mTLS ❏Privacy and data integrity ❏ Secure Connections ❏ Asymmetric Encryption ❏ Email, Chats, VoIP, HTTPS ❏ mTLS - No Man in the Middle ❏ Rotations
- 12. Misconfiguration & ErrorHandler ❏ Unnecessary enable ports ❏ Stacks Traces ❏ Default Passwords ❏ Software Out of Date ❏ Missing Sec configs
- 13. Input Sanitization ❏ SQLInjection ❏ Prepared Statements ❏ Remote File Inclusion ❏ Paths / Sequences ❏ Always clean user inputs ❏ Use UUIDs
- 14. XSS (Cross SiteScripting) ❏ JavaScript Injection ❏ Storage (view by admin) ❏ Reflected (back to user) ❏ Latest Browser versions ❏ Requires Sanitization
- 15. Insecure Serialization/Deserialization ❏ XXE- External XML Entity SAML(SSO), < SOAP 1.2 ❏ XML Upload from untrusted sources ❏ Disable XML external entity and DTD processing ❏ Validate XML with XSD
- 16. Know Vulnerabilities ❏ OWASPtop 10 ❏ CVE/CWE ❏ Code Analysis ❏ Keep Software up to date
- 17. Logging & AuditTrail ❏ Local / Unmonitored logs ❏ Audit trail on high-value transactions ❏ Monitoring on suspicious activities
- 18. Threat Analysis ❏ Allmodels are wrong but some are useful for us ❏ Allow us to see the Threats ❏ Help figure out priorities ❏ Democratize security ❏ https://threagile.io/
- 19. Engineering Friction ❏ Tests,DevOps, ... ❏ Security might cripple engineering capabilities ❏ Security is a Refactoring enabler force ❏ Security is Everybody's jobs
- 20.