by Nicholas Bering
What are we protecting?




What can go wrong?
Schneier's Law
Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break.




Information Disclosure

Denial of Service

Elevation of Privilege

OWASP Top 10 Vulnerabilities
  1. Injection
  2. Broken Authentication
  3. Sensitive Data Exposure
  4. XML External Entities (XXE)
  5. Broken Access Control
OWASP Top 10 Vulnerabilities
  1. Security Misconfiguration
  2. Cross-site Scripting (XSS)
  3. Insecure Deserialization
  4. Using Components with Known Vulnerabilities
  5. Insufficient Logging and Monitoring
Protect Your Resources
Trust Boundaries

data flow diagaram with trust boundary and legend for symbols

Credit: "Threat Modeling: Designing for Security" by Adam Shostack

Trust Boundaries

Systems are most vulnerable to all aspects of STRIDE when information or commands cross trust boundaries.

OWASP Top 10 Proactive Controls
  1. Define Security Requirements
  2. Leverage Security Frameworks and Libraries
  3. Secure Database Access
  4. Encode and Escape Data
  5. Validate All Inputs
OWASP Top 10 Proactive Controls
  1. Implement Digital Identity
  2. Enforce Access Controls
  3. Protect Data Everywhere
  4. Implement Security Monitoring and Logging
  5. Handle all Errors and Exceptions
Risk Formula

risk = probability x loss

Cost of Mitigation

Even if loss is certain, cost of mitigating risk should not exceeed the potential loss.

Cost of Mitigation

Therefore, if storing sensitive information would cost more than the value that the information provides... just don't store it at all.

Better yet, don't even collect it.

Learning Resources
OWASP Top 10
  • Application Security Verification Standard (ASVS)
  • This is a great resource to use if negotiating the scope for penetration testing, or to do a self-audit against security standards.
  • It's a good way to ease in, because it has maturity levels "baked in".
Troy Hunt

Creator of Have I been pwned?