HOW VULNERABLE IS YOUR APP? AND HOW TO FIX IT.
summary
Claims that web attacks doubled and business email compromise cost about 26 billion dollars from 2016 to 2019 and that there were 8.4 million XSS incidents in 2019 set urgency. Practical mitigations shown are concrete: stop sending passwords in GETs, use OAuth2/OpenID and rotating tokens, enforce CSP and HSTS, add rate limits and circuit breakers, host static assets on S3 behind a CDN and apply headers via Lambda@Edge, and scan with observatory.mozilla.org to get actionable defects and fixes.
AI-written summary · about
chapters (13)
- 0:00Start
- 5:30Main Avenues for this Attack
- 10:18Ensure Your Apis Are Secure
- 13:02Authentication
- 14:05Rate Limit
- 15:10Https
- 17:06Hsts
- 19:49What's Csp
- 20:20What Can I Do with Csp
- 20:46Stop Access to Unknown Resources
- 27:34Set Up Security Headers in Amazon
- 28:34How Vulnerable Are You
- 35:09Suggestion for for Testers
related talks
59mPractical Security for Web Applications
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
52mDemystifying Front-End Security
55mWeb Application Security: Browsers Fight Back!
01h 03mTen Key Steps for Enhanced Web App Security
24mWe're struggling to keep up
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
59mWeb Application Security Trends