Security Vulnerabilities Decomposition: Another way to look at Vulnerabilities
summary
Argues that measuring CWEs at the end fails and instead prescribes implementing concrete controls early: parameterize queries to stop SQL and second‑order injections, contextually encode outputs for XSS, and validate at the entry point (controller) to reduce attack surface. Recommends OWASP AppSensor detection points and consistent security logging for real‑time detection, store keys separately in key vaults, use TLS even inside networks, and wrap/adapt third‑party libraries to limit exposure; notes 85.7% .NET and 92% C++ apps include known vulnerable components.
AI-written summary · about
chapters (30)
- 0:00Intro
- 2:50Katy Anton
- 3:38Common Weakness Enumeration
- 5:37CWEs in Injection Category
- 7:06Decompose the Injection
- 8:40Extract Security Controls
- 12:45Security Controls: Security Logging
- 13:04The 6 Best Types of Detection Points
- 14:01Examples of Intrusion Detection Points
- 18:11Secure Data Handling: Basic Workflow
- 19:52Data at Rest: Design Vulnerability example
- 22:06Tool for Publicly Disclosed Machine Keys
- 22:36Encryption: Security Controls
- 23:34Data in Transit: Security Controls
- 24:59State of Software Security
- 26:12Root Cause
- 27:12What is Attack Surface?
- 27:46Fundamental Security Principle
- 28:11Components Examples
- 28:45Implement Logging Library
- 30:10Simple Wrapper
- 31:04Implement a Payment Gateway
- 31:55Adapter Design Pattern
- 32:22Implement a Single Sign-On
- 32:46Facade Design Pattern
- 33:11Secure Software Starts from Design!
- 34:26Rick Rescorla
- 38:52Security Controls In Development Cycle
- 41:03Final Takeaways
- 42:48References
related talks
41mSecurity Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
46mThe Path of Secure Software
30mWeb Security Engineering - Protect all layers of your project
27mHow Security, Development & Testing can work together to stop ...
58m: The OWASP Top Ten Proactive Controls 2018
59mPractical Security for Web Applications
01h 03mTen Key Steps for Enhanced Web App Security