Alexander Pirker
101 Typical Security Pitfalls
#1about 3 minutes
Defining the context of application security
Security is not absolute and must be evaluated based on the application type, environment, data sensitivity, and performance constraints.
#2about 2 minutes
Understanding the impact of major vulnerabilities
Recent widespread vulnerabilities like Log4Shell and Spring4Shell demonstrate the critical need for proactive security in software development.
#3about 3 minutes
Preventing XSS by sanitizing on the backend
Client-side input sanitization is easily bypassed, so all user-provided data must be sanitized on the backend to prevent XSS attacks.
#4about 4 minutes
Preventing remote code execution from poor input validation
Failing to validate input parameters against an allowlist can lead to command injection, allowing an attacker to open a reverse shell.
#5about 4 minutes
Preventing denial of service attacks from service crashes
Supplying malformed data, like a public key of the wrong length, can trigger a panic in a library and cause a denial-of-service attack.
#6about 4 minutes
How data type downcasting can break cryptography
Implicitly downcasting a larger integer to a smaller type like a byte can lead to information leakage by causing index collisions.
#7about 4 minutes
Preventing information leakage from out-of-bounds memory reads
Failing to validate the length parameter in a memory copy operation can lead to an out-of-bounds read, leaking sensitive stack memory.
#8about 3 minutes
Four key principles for writing secure code
Developers should prioritize input data sanitation, careful data type selection, proper memory management, and graceful error handling.
#9about 1 minute
Q&A on common pitfalls and sanitization tools
The most common security pitfall is XSS from frontend bypasses, and DOMPurify is a recommended tool for HTML sanitization.
Related jobs
Jobs that call for the skills explored in this talk.
Matching moments
00:28 MIN
Why developers make basic cybersecurity mistakes
Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes
18:51 MIN
Five common cybersecurity mistakes developers make
Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes
07:33 MIN
Common web application threats like injection and DoS
Security in modern Web Applications - OWASP to the rescue!
27:19 MIN
Key takeaways on IDE and developer tool security
You click, you lose: a practical look at VSCode's security
40:49 MIN
Implementing secure input and output handling
Software Security 101: Secure Coding Basics
55:17 MIN
Avoiding common security mistakes and giving better feedback
The weekly developer show: Boosting Python with CUDA, CSS Updates & Navigating New Tech Stacks
04:25 MIN
The primary security threat of cross-site scripting
A Primer in Single Page Application Security (Angular, React, Vue.js)
1:15:27 MIN
Understanding common web and API vulnerability classes
Software Security 101: Secure Coding Basics
Featured Partners
Related Videos
33:29Programming secure C#/.NET Applications: Dos & Don'ts
Sebastian Leuer
30:54Cross Site Scripting is yesterday's news, isn't it?
Martina Kraus
27:32Security Pitfalls for Software Engineers
Jasmin Azemović
26:59Security in modern Web Applications - OWASP to the rescue!
Jakub Andrzejewski
44:11Vulnerable VS Code extensions are now at your front door
Raul Onitza-Klugman & Kirill Efimov
29:47You click, you lose: a practical look at VSCode's security
Thomas Chauchefoin & Paul Gerste
58:19Typed Security: Preventing Vulnerabilities By Design
Michael Koppmann
27:10Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks
Sonya Moisset
From learning to earning
Jobs that call for the skills explored in this talk.
IT-Security Engineer Awarness Training and Security Roadmap
Paris Lodron-Universität Salzburg
Powershell
Windows Server
Microsoft Office
Scripting (Bash/Python/Go/Ruby)
Security Solution Designer (SSH Key/Cryptography)
DevNull Security
Edinburgh, United Kingdom
Remote
€80-90K
UML
JIRA
Azure
+2
Systems Engineer - Rust C++, Remote Sandbox Service
xAI
Charing Cross, United Kingdom
Remote
€180K
API
C++
Linux
+1
Backend Developer, Cyber Security
S-RM
Charing Cross, United Kingdom
€58K
Python
Amazon Web Services (AWS)
Full Stack Software Engineer (Attack Surface Management)
Sysdig
Remote
Intermediate
REST
MySQL
Neo4j
PostgreSQL
+4