Alexander Pirker
101 Typical Security Pitfalls
#1about 3 minutes
Defining the context of application security
Security is not absolute and must be evaluated based on the application type, environment, data sensitivity, and performance constraints.
#2about 2 minutes
Understanding the impact of major vulnerabilities
Recent widespread vulnerabilities like Log4Shell and Spring4Shell demonstrate the critical need for proactive security in software development.
#3about 3 minutes
Preventing XSS by sanitizing on the backend
Client-side input sanitization is easily bypassed, so all user-provided data must be sanitized on the backend to prevent XSS attacks.
#4about 4 minutes
Preventing remote code execution from poor input validation
Failing to validate input parameters against an allowlist can lead to command injection, allowing an attacker to open a reverse shell.
#5about 4 minutes
Preventing denial of service attacks from service crashes
Supplying malformed data, like a public key of the wrong length, can trigger a panic in a library and cause a denial-of-service attack.
#6about 4 minutes
How data type downcasting can break cryptography
Implicitly downcasting a larger integer to a smaller type like a byte can lead to information leakage by causing index collisions.
#7about 4 minutes
Preventing information leakage from out-of-bounds memory reads
Failing to validate the length parameter in a memory copy operation can lead to an out-of-bounds read, leaking sensitive stack memory.
#8about 3 minutes
Four key principles for writing secure code
Developers should prioritize input data sanitation, careful data type selection, proper memory management, and graceful error handling.
#9about 1 minute
Q&A on common pitfalls and sanitization tools
The most common security pitfall is XSS from frontend bypasses, and DOMPurify is a recommended tool for HTML sanitization.
Related jobs
Jobs that call for the skills explored in this talk.
Matching moments
18:51 MIN
Five common cybersecurity mistakes developers make
Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes
07:33 MIN
Common web application threats like injection and DoS
Security in modern Web Applications - OWASP to the rescue!
00:28 MIN
Why developers make basic cybersecurity mistakes
Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes
27:19 MIN
Key takeaways on IDE and developer tool security
You click, you lose: a practical look at VSCode's security
05:28 MIN
Common security failures beyond individual coding errors
Maturity assessment for technicians or how I learned to love OWASP SAMM
40:49 MIN
Implementing secure input and output handling
Software Security 101: Secure Coding Basics
55:17 MIN
Avoiding common security mistakes and giving better feedback
The weekly developer show: Boosting Python with CUDA, CSS Updates & Navigating New Tech Stacks
04:25 MIN
The primary security threat of cross-site scripting
A Primer in Single Page Application Security (Angular, React, Vue.js)
Featured Partners
Related Videos
33:29Programming secure C#/.NET Applications: Dos & Don'ts
Sebastian Leuer
30:54Cross Site Scripting is yesterday's news, isn't it?
Martina Kraus
27:32Security Pitfalls for Software Engineers
Jasmin Azemović
26:59Security in modern Web Applications - OWASP to the rescue!
Jakub Andrzejewski
29:47You click, you lose: a practical look at VSCode's security
Thomas Chauchefoin & Paul Gerste
27:10Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks
Sonya Moisset
58:19Typed Security: Preventing Vulnerabilities By Design
Michael Koppmann
1:58:48Software Security 101: Secure Coding Basics
Thomas Konrad
Related Articles
View all articles
From learning to earning
Jobs that call for the skills explored in this talk.
Embedded Security Engineer - Schwachstellenanalyse | Car IT | Secure Coding
Prognum Automotive GmbH
Ulm, Germany
Remote
C++
Backend Developer, Cyber Security
S-RM
Charing Cross, United Kingdom
€58K
Python
Amazon Web Services (AWS)
Student Assistant Backend Development of Security/Hacking Tools - C/C++
Fraunhofer-Gesellschaft
Darmstadt, Germany
C++
Agile Methodologies
DevSecOps Web Application Security 80%-100%
Julius Baer
Fällanden, Switzerland
Intermediate
API
DNS
Java
Linux
React
+1
Software Engineer - SDLC Security - Public Artifacts
Datadog
Paris, France
DevOps
Python
Kubernetes
Configuration Management
Fullstack Data Security Engineer
EffiCon GmbH & Co. KG
Zwickau, Germany
Azure
MySQL
NoSQL
MongoDB
PostgreSQL
+2