WEBVTT

1
00:00:03.110 --> 00:00:07.970
<00:00:03.110>Uh, <00:00:03.237>the <00:00:03.364>topic <00:00:03.491>for <00:00:03.619>today <00:00:03.746>is <00:00:03.873>about <00:00:04.000>how <00:00:04.128>to <00:00:04.255>avoid <00:00:04.382>security <00:00:04.510>pitfalls

2
00:00:08.630 --> 00:00:12.610
<00:00:08.630>in <00:00:08.730>the <00:00:08.830>process <00:00:08.930>of <00:00:09.030>the <00:00:09.130>creating <00:00:09.230>the <00:00:09.330>software <00:00:09.430>in <00:00:09.530>all <00:00:09.630>the <00:00:09.730>levels <00:00:09.830>and <00:00:09.930>all <00:00:10.030>the

3
00:00:12.610 --> 00:00:15.450
<00:00:12.610>timelines. <00:00:12.750>I <00:00:12.889>know <00:00:13.030>we <00:00:13.170>are <00:00:13.309>a <00:00:13.450>bunch <00:00:13.590>of <00:00:13.729>smart <00:00:13.870>people <00:00:14.010>here,

4
00:00:15.750 --> 00:00:17.770
<00:00:15.750>but <00:00:15.925>I <00:00:16.100>believe <00:00:16.274>I <00:00:16.450>can <00:00:16.625>share <00:00:16.800>with <00:00:16.975>you <00:00:17.150>some,

5
00:00:17.920 --> 00:00:21.290
<00:00:17.920>some <00:00:18.060>good <00:00:18.200>security <00:00:18.340>tips <00:00:18.480>and <00:00:18.620>try <00:00:18.760>to <00:00:18.900>point <00:00:19.040>the <00:00:19.180>right <00:00:19.320>direction.

6
00:00:21.350 --> 00:00:25.970
<00:00:21.350>How <00:00:21.477>to <00:00:21.604>be <00:00:21.731>as <00:00:21.859>too <00:00:21.986>secure <00:00:22.113>as <00:00:22.240>much <00:00:22.368>as <00:00:22.495>as <00:00:22.622>possible. <00:00:22.750>Uh,

7
00:00:26.140 --> 00:00:28.650
<00:00:26.140>think <00:00:26.420>about <00:00:26.700>two <00:00:26.980>or <00:00:27.260>me. <00:00:27.540>Uh,

8
00:00:28.890 --> 00:00:33.850
<00:00:28.890>I <00:00:29.006>have <00:00:29.123>also <00:00:29.240>academic <00:00:29.356>and <00:00:29.473>IT <00:00:29.590>professional <00:00:29.706>career, <00:00:29.823>20 <00:00:29.940>plus <00:00:30.056>year <00:00:30.173>in <00:00:30.290>it,

9
00:00:34.070 --> 00:00:38.770
<00:00:34.070>and <00:00:34.186>also <00:00:34.303>let's <00:00:34.420>say <00:00:34.536>15 <00:00:34.653>years <00:00:34.770>in <00:00:34.886>security <00:00:35.003>as <00:00:35.120>a <00:00:35.236>consulting <00:00:35.353>academic <00:00:35.470>and

10
00:00:38.840 --> 00:00:43.570
<00:00:38.840>also <00:00:38.947>as <00:00:39.055>I <00:00:39.163>c <00:00:39.270>I, <00:00:39.378>so, <00:00:39.486>and <00:00:39.593>head <00:00:39.701>of <00:00:39.809>AEC <00:00:39.916>operations <00:00:40.024>in <00:00:40.132>my <00:00:40.240>current,

11
00:00:44.150 --> 00:00:49.050
<00:00:44.150>uh, <00:00:44.305>mother <00:00:44.461>company. <00:00:44.616>Okay, <00:00:44.772>so <00:00:44.927>enough <00:00:45.083>about <00:00:45.238>me. <00:00:45.394>So <00:00:45.550>the,

12
00:00:49.050 --> 00:00:53.090
<00:00:49.050>the <00:00:49.166>first, <00:00:49.283>first, <00:00:49.400>uh, <00:00:49.516>I'd <00:00:49.633>like <00:00:49.750>to <00:00:49.866>start, <00:00:49.983>uh, <00:00:50.099>what <00:00:50.216>are <00:00:50.333>the <00:00:50.449>consequences?

13
00:00:53.960 --> 00:00:58.490
<00:00:53.960>Because <00:00:54.067>to <00:00:54.175>understand, <00:00:54.283>uh, <00:00:54.390>what <00:00:54.498>can, <00:00:54.606>what, <00:00:54.713>what, <00:00:54.821>what <00:00:54.929>can, <00:00:55.036>things <00:00:55.144>can <00:00:55.252>go <00:00:55.360>wrong.

14
00:00:58.790 --> 00:01:03.130
<00:00:58.790>You <00:00:58.897>need <00:00:59.005>to <00:00:59.113>see <00:00:59.220>them. <00:00:59.328>So <00:00:59.436>the <00:00:59.543>first <00:00:59.651>part <00:00:59.759>of <00:00:59.866>presentation <00:00:59.974>is <00:01:00.082>about, <00:01:00.190>uh,

15
00:01:03.270 --> 00:01:05.130
<00:01:03.270>the <00:01:03.620>consequences <00:01:03.970>or <00:01:04.320>the <00:01:04.670>pitfalls.

16
00:01:05.470 --> 00:01:09.930
<00:01:05.470>So <00:01:05.586>my <00:01:05.703>favorite <00:01:05.820>slide <00:01:05.936>in <00:01:06.053>any <00:01:06.170>con <00:01:06.286>con <00:01:06.403>convention <00:01:06.520>like <00:01:06.636>this <00:01:06.753>is <00:01:06.870>about

17
00:01:10.860 --> 00:01:11.693
<00:01:10.860>like <00:01:11.609>this.

18
00:01:12.290 --> 00:01:16.590
<00:01:12.289>So <00:01:12.429>these <00:01:12.570>are <00:01:12.710>the <00:01:12.850>bubbles <00:01:12.990>and <00:01:13.130>the <00:01:13.270>breaches <00:01:13.410>or <00:01:13.550>the <00:01:13.690>famous

19
00:01:17.550 --> 00:01:21.990
<00:01:17.550>companies <00:01:17.690>in <00:01:17.830>it <00:01:17.970>worldwide, <00:01:18.110>you <00:01:18.250>see <00:01:18.390>the <00:01:18.530>name <00:01:18.670>is <00:01:18.810>Facebook, <00:01:18.950>Microsoft,

20
00:01:22.390 --> 00:01:26.750
<00:01:22.390>T-Mobile, <00:01:22.670>Indian <00:01:22.950>Apollo, <00:01:23.230>Ava, <00:01:23.510>extra <00:01:23.790>Brazil,

21
00:01:26.850 --> 00:01:27.683
<00:01:26.850>and <00:01:27.224>so <00:01:27.599>on.

22
00:01:27.730 --> 00:01:32.270
<00:01:27.730>And <00:01:27.846>these <00:01:27.963>numbers <00:01:28.080>inside <00:01:28.196>are <00:01:28.313>the <00:01:28.430>number <00:01:28.546>of <00:01:28.663>the <00:01:28.780>records <00:01:28.896>in <00:01:29.013>the <00:01:29.130>millions

23
00:01:32.500 --> 00:01:37.350
<00:01:32.500>that <00:01:32.627>have <00:01:32.754>actually <00:01:32.881>breached <00:01:33.009>out, <00:01:33.136>leaked <00:01:33.263>somewhere <00:01:33.390>in <00:01:33.518>deep <00:01:33.645>and <00:01:33.772>dark <00:01:33.900>web.

24
00:01:37.850 --> 00:01:38.950
<00:01:37.850>So <00:01:38.345>this <00:01:38.840>is,

25
00:01:38.950 --> 00:01:43.630
<00:01:38.950>this <00:01:39.050>was <00:01:39.150>happened <00:01:39.250>to <00:01:39.350>the <00:01:39.450>company <00:01:39.550>of <00:01:39.650>the <00:01:39.750>millions <00:01:39.850>of <00:01:39.950>the <00:01:40.050>millions <00:01:40.150>US <00:01:40.250>dollars <00:01:40.350>for

26
00:01:43.630 --> 00:01:47.460
<00:01:43.630>the <00:01:43.785>security <00:01:43.941>budget. <00:01:44.096>So <00:01:44.252>they <00:01:44.407>know <00:01:44.563>how <00:01:44.718>to <00:01:44.874>do <00:01:45.030>it,

27
00:01:48.040 --> 00:01:52.100
<00:01:48.039>but <00:01:48.147>things <00:01:48.255>like <00:01:48.363>this <00:01:48.470>are <00:01:48.578>actually, <00:01:48.686>is <00:01:48.793>happening. <00:01:48.901>So <00:01:49.009>that's <00:01:49.116>the <00:01:49.224>point <00:01:49.332>number <00:01:49.440>one.

28
00:01:52.190 --> 00:01:54.380
<00:01:52.190>Point <00:01:52.539>number <00:01:52.890>two, <00:01:53.240>like <00:01:53.590>this,

29
00:01:55.410 --> 00:01:59.180
<00:01:55.410>unfortunately <00:01:55.565>I <00:01:55.721>don't <00:01:55.876>have <00:01:56.032>a, <00:01:56.187>the, <00:01:56.343>the, <00:01:56.498>the, <00:01:56.654>the, <00:01:56.810>the,

30
00:01:59.240 --> 00:02:03.340
<00:01:59.240>the <00:01:59.356>first <00:01:59.473>data <00:01:59.590>for <00:01:59.706>this <00:01:59.823>year, <00:01:59.940>but <00:02:00.056>I <00:02:00.173>believe <00:02:00.290>this <00:02:00.406>number <00:02:00.523>is <00:02:00.640>larger.

31
00:02:03.960 --> 00:02:08.750
<00:02:03.960>So <00:02:04.134>average <00:02:04.309>bridge <00:02:04.485>per <00:02:04.660>company <00:02:04.835>is <00:02:05.009>somewhere <00:02:05.184>about <00:02:05.360>four,

32
00:02:08.940 --> 00:02:09.830
<00:02:08.940>4 <00:02:09.741>million,

33
00:02:10.370 --> 00:02:14.590
<00:02:10.370>almost <00:02:10.603>5 <00:02:10.836>million <00:02:11.070>US <00:02:11.303>dollars <00:02:11.536>per <00:02:11.770>bridge.

34
00:02:15.130 --> 00:02:20.000
<00:02:15.130>So <00:02:15.285>the <00:02:15.441>code, <00:02:15.596>the <00:02:15.752>data, <00:02:15.907>the <00:02:16.063>pr <00:02:16.218>name <00:02:16.374>it, <00:02:16.530>the,

35
00:02:20.000 --> 00:02:23.520
<00:02:20.000>the <00:02:20.140>customer. <00:02:20.280>So <00:02:20.420>there's <00:02:20.560>a <00:02:20.700>lot <00:02:20.840>of <00:02:20.980>at <00:02:21.120>stake. <00:02:21.260>And <00:02:21.400>if,

36
00:02:23.540 --> 00:02:25.800
<00:02:23.540>if <00:02:23.715>we <00:02:23.890>actually <00:02:24.065>try <00:02:24.239>to <00:02:24.415>quantify <00:02:24.590>all <00:02:24.765>this <00:02:24.940>data,

37
00:02:26.300 --> 00:02:28.760
<00:02:26.300>we <00:02:26.650>get <00:02:27.000>something <00:02:27.350>like <00:02:27.700>this.

38
00:02:29.060 --> 00:02:33.250
<00:02:29.060>So <00:02:29.200>it's <00:02:29.340>not <00:02:29.480>a <00:02:29.620>small <00:02:29.760>amount <00:02:29.900>of <00:02:30.040>money <00:02:30.180>per <00:02:30.320>bridge. <00:02:30.460>Again,

39
00:02:34.180 --> 00:02:35.710
<00:02:34.180>this <00:02:34.376>is <00:02:34.573>just <00:02:34.770>one <00:02:34.966>example <00:02:35.163>of <00:02:35.360>the <00:02:35.557>million.

40
00:02:36.700 --> 00:02:40.680
<00:02:36.700>So <00:02:36.980>the <00:02:37.260>15 <00:02:37.540>year <00:02:37.820>old <00:02:38.100>vulnerability

41
00:02:41.500 --> 00:02:45.360
<00:02:41.500>in <00:02:41.700>Python <00:02:41.900>library <00:02:42.100>actually <00:02:42.300>caused <00:02:42.500>the <00:02:42.700>thousand, <00:02:42.900>of,

42
00:02:45.640 --> 00:02:48.120
<00:02:45.640>thousand <00:02:45.839>of <00:02:46.040>the <00:02:46.239>projects <00:02:46.440>actually <00:02:46.640>being <00:02:46.839>exposed <00:02:47.040>online.

43
00:02:49.100 --> 00:02:53.880
<00:02:49.100>So <00:02:49.216>someone <00:02:49.333>is <00:02:49.450>actually <00:02:49.566>created <00:02:49.683>the <00:02:49.799>library, <00:02:49.916>put <00:02:50.033>it <00:02:50.150>somewhere, <00:02:50.266>people <00:02:50.383>use <00:02:50.500>it,

44
00:02:53.900 --> 00:02:57.270
<00:02:53.900>and <00:02:54.027>nobody <00:02:54.154>care <00:02:54.281>about <00:02:54.409>it. <00:02:54.536>So <00:02:54.663>it's <00:02:54.790>the, <00:02:54.918>so <00:02:55.045>it's <00:02:55.172>the <00:02:55.300>issue.

45
00:02:57.730 --> 00:03:01.840
<00:02:57.730>So <00:02:57.837>today <00:02:57.945>it's <00:02:58.053>the, <00:02:58.160>let's <00:02:58.268>say <00:02:58.376>for <00:02:58.483>today <00:02:58.591>in, <00:02:58.699>in <00:02:58.806>the <00:02:58.914>protest <00:02:59.022>of <00:02:59.130>the,

46
00:03:02.950 --> 00:03:05.640
<00:03:02.950>this <00:03:03.125>part, <00:03:03.299>the, <00:03:03.475>the <00:03:03.649>most <00:03:03.825>is <00:03:04.000>actually <00:03:04.174>most <00:03:04.350>hot.

47
00:03:07.590 --> 00:03:12.010
<00:03:07.590>And <00:03:07.706>the <00:03:07.823>last <00:03:07.940>one <00:03:08.056>about <00:03:08.173>the <00:03:08.290>consequence <00:03:08.406>is <00:03:08.523>this. <00:03:08.640>So <00:03:08.756>the <00:03:08.873>Uber, <00:03:08.990>actually,

48
00:03:12.130 --> 00:03:16.490
<00:03:12.130>I <00:03:12.230>use <00:03:12.329>the <00:03:12.430>Uber <00:03:12.530>all <00:03:12.630>the <00:03:12.730>time, <00:03:12.829>uh, <00:03:12.930>but <00:03:13.030>uh, <00:03:13.130>this <00:03:13.230>is <00:03:13.329>actually, <00:03:13.430>uh, <00:03:13.530>information,

49
00:03:16.900 --> 00:03:18.850
<00:03:16.900>let's <00:03:17.180>say <00:03:17.460>last <00:03:17.740>year, <00:03:18.020>October, <00:03:18.300>September,

50
00:03:19.890 --> 00:03:24.440
<00:03:19.890>actually <00:03:20.006>the <00:03:20.123>famous <00:03:20.239>Uber <00:03:20.356>breach <00:03:20.473>on <00:03:20.589>the <00:03:20.706>epic <00:03:20.823>scale <00:03:20.940>from <00:03:21.056>one <00:03:21.173>to <00:03:21.290>10.

51
00:03:24.440 --> 00:03:26.620
<00:03:24.440>This <00:03:24.906>is <00:03:25.373>15. <00:03:25.840>Why?

52
00:03:26.890 --> 00:03:30.760
<00:03:26.890>Because <00:03:27.089>this <00:03:27.290>breach <00:03:27.489>is <00:03:27.690>actually <00:03:27.890>what's <00:03:28.089>happened <00:03:28.290>on,

53
00:03:30.900 --> 00:03:35.610
<00:03:30.900>so <00:03:31.055>let's <00:03:31.211>say <00:03:31.366>stupid <00:03:31.522>way <00:03:31.677>that <00:03:31.833>is <00:03:31.988>possible <00:03:32.144>so <00:03:32.300>that

54
00:03:36.010 --> 00:03:40.850
<00:03:36.010>actually <00:03:36.149>the <00:03:36.290>administrator <00:03:36.429>or <00:03:36.570>the <00:03:36.709>Uber <00:03:36.850>is <00:03:36.989>actually <00:03:37.130>just <00:03:37.269>let <00:03:37.410>attacker

55
00:03:40.990 --> 00:03:42.330
<00:03:40.990>in <00:03:41.392>on <00:03:41.793>the <00:03:42.196>most,

56
00:03:42.480 --> 00:03:46.210
<00:03:42.480>most <00:03:42.619>easiest <00:03:42.760>way <00:03:42.899>just <00:03:43.040>to <00:03:43.179>push <00:03:43.320>a <00:03:43.459>notification <00:03:43.600>or <00:03:43.739>two <00:03:43.880>f,

57
00:03:46.250 --> 00:03:49.250
<00:03:46.250>a <00:03:46.357>two <00:03:46.465>f <00:03:46.573>a <00:03:46.680>two <00:03:46.788>f <00:03:46.896>a <00:03:47.003>two <00:03:47.111>f <00:03:47.219>a, <00:03:47.326>come <00:03:47.434>on, <00:03:47.542>let <00:03:47.650>in.

58
00:03:49.550 --> 00:03:53.650
<00:03:49.550>And <00:03:49.677>the <00:03:49.804>guy <00:03:49.931>was <00:03:50.059>in <00:03:50.186>and <00:03:50.313>actually <00:03:50.440>pulled <00:03:50.568>all <00:03:50.695>the <00:03:50.822>information <00:03:50.950>outside.

59
00:03:54.110 --> 00:03:56.130
<00:03:54.110>The <00:03:54.460>McAfee <00:03:54.810>is <00:03:55.160>actually, <00:03:55.510>uh,

60
00:03:56.490 --> 00:04:01.370
<00:03:56.490>evaluate <00:03:56.630>this <00:03:56.770>debris <00:03:56.910>and <00:03:57.050>say <00:03:57.190>that <00:03:57.330>they <00:03:57.470>advise <00:03:57.610>that <00:03:57.750>any <00:03:57.890>Uber

61
00:04:01.770 --> 00:04:04.970
<00:04:01.770>customer <00:04:01.925>actually <00:04:02.081>delete <00:04:02.236>their <00:04:02.392>account <00:04:02.547>and <00:04:02.703>they <00:04:02.858>create <00:04:03.014>new <00:04:03.170>one.

62
00:04:06.210 --> 00:04:10.750
<00:04:06.210>So <00:04:06.326>that <00:04:06.443>was <00:04:06.560>serious <00:04:06.676>suggest <00:04:06.793>something <00:04:06.910>to, <00:04:07.026>to <00:04:07.143>think <00:04:07.260>about <00:04:07.376>it. <00:04:07.493>So <00:04:07.610>again,

63
00:04:11.280 --> 00:04:15.710
<00:04:11.280>everything, <00:04:11.396>if <00:04:11.513>you, <00:04:11.630>if <00:04:11.746>you <00:04:11.863>back <00:04:11.980>to <00:04:12.096>square <00:04:12.213>one <00:04:12.330>is <00:04:12.446>about <00:04:12.563>the <00:04:12.680>software,

64
00:04:15.800 --> 00:04:18.480
<00:04:15.800>about <00:04:15.975>the <00:04:16.150>code <00:04:16.325>of <00:04:16.500>course, <00:04:16.675>and <00:04:16.850>the <00:04:17.025>people <00:04:17.200>problem.

65
00:04:20.250 --> 00:04:24.590
<00:04:20.250>So <00:04:20.366>how <00:04:20.483>to <00:04:20.600>avoid <00:04:20.716>all <00:04:20.833>this <00:04:20.950>stuff. <00:04:21.066>So <00:04:21.183>there's <00:04:21.300>a <00:04:21.416>bunch <00:04:21.533>of, <00:04:21.649>of,

66
00:04:24.650 --> 00:04:29.150
<00:04:24.650>of <00:04:24.883>practices, <00:04:25.116>best <00:04:25.349>practice, <00:04:25.583>uh, <00:04:25.816>documentation, <00:04:26.049>presentation,

67
00:04:29.950 --> 00:04:33.710
<00:04:29.950>tutorials, <00:04:30.105>videos <00:04:30.261>and <00:04:30.416>so <00:04:30.572>on. <00:04:30.727>But <00:04:30.883>I <00:04:31.038>will <00:04:31.194>try <00:04:31.349>to,

68
00:04:33.790 --> 00:04:36.710
<00:04:33.790>to <00:04:33.965>actually <00:04:34.140>to <00:04:34.315>aggregate <00:04:34.490>all <00:04:34.665>of <00:04:34.840>them <00:04:35.015>in <00:04:35.190>10.

69
00:04:37.210 --> 00:04:41.830
<00:04:37.210>But <00:04:37.349>because <00:04:37.489>this <00:04:37.630>presentation <00:04:37.770>is <00:04:37.909>only <00:04:38.049>30 <00:04:38.190>minutes <00:04:38.330>long <00:04:38.469>and <00:04:38.609>I'm

70
00:04:42.070 --> 00:04:46.150
<00:04:42.070>calibrated <00:04:42.186>for <00:04:42.303>45 <00:04:42.420>minutes, <00:04:42.536>I <00:04:42.653>have <00:04:42.770>tried <00:04:42.886>to <00:04:43.003>sometimes, <00:04:43.120>sometimes <00:04:43.236>to, <00:04:43.353>to <00:04:43.469>squeeze.

71
00:04:46.570 --> 00:04:50.830
<00:04:46.570>And <00:04:46.686>just <00:04:46.803>to <00:04:46.920>pull <00:04:47.036>the <00:04:47.153>most <00:04:47.270>interesting <00:04:47.386>part <00:04:47.503>with <00:04:47.620>couple <00:04:47.736>of <00:04:47.853>of <00:04:47.969>demos,

72
00:04:50.890 --> 00:04:55.790
<00:04:50.890>how <00:04:51.006>to <00:04:51.123>protect <00:04:51.240>your <00:04:51.356>data <00:04:51.473>on <00:04:51.590>the <00:04:51.706>other <00:04:51.823>levels <00:04:51.940>of <00:04:52.056>the <00:04:52.173>circuit <00:04:52.289>development.

73
00:04:57.490 --> 00:05:00.650
<00:04:57.490>So <00:04:57.956>basically <00:04:58.423>just <00:04:58.890>simple,

74
00:05:00.910 --> 00:05:04.090
<00:05:00.910>the <00:05:01.085>follow <00:05:01.260>the <00:05:01.435>best <00:05:01.610>practices. <00:05:01.785>So <00:05:01.960>simple <00:05:02.135>as <00:05:02.310>that.

75
00:05:04.950 --> 00:05:07.580
<00:05:04.950>There <00:05:05.229>is <00:05:05.510>no <00:05:05.789>anything <00:05:06.070>new <00:05:06.349>here.

76
00:05:07.630 --> 00:05:11.860
<00:05:07.630>There <00:05:07.757>is <00:05:07.884>no <00:05:08.011>need <00:05:08.139>to <00:05:08.266>invention <00:05:08.393>the <00:05:08.520>boiling <00:05:08.648>water. <00:05:08.775>Everything <00:05:08.902>is <00:05:09.030>here.

77
00:05:12.490 --> 00:05:16.500
<00:05:12.490>Just <00:05:12.590>you <00:05:12.690>need <00:05:12.790>to <00:05:12.890>follow <00:05:12.990>the <00:05:13.090>procedure. <00:05:13.190>So <00:05:13.290>again, <00:05:13.390>I <00:05:13.490>will <00:05:13.590>explain <00:05:13.690>five <00:05:13.790>of <00:05:13.890>them,

78
00:05:16.960 --> 00:05:21.700
<00:05:16.960>but <00:05:17.067>now <00:05:17.175>I'll <00:05:17.283>just <00:05:17.390>say <00:05:17.498>couple <00:05:17.606>of <00:05:17.713>words <00:05:17.821>about <00:05:17.929>items <00:05:18.036>that <00:05:18.144>actually <00:05:18.252>I'll <00:05:18.359>not

79
00:05:21.700 --> 00:05:25.940
<00:05:21.700>cover <00:05:21.840>later <00:05:21.979>in <00:05:22.120>this <00:05:22.260>presentation. <00:05:22.400>For <00:05:22.539>example, <00:05:22.680>how <00:05:22.820>to <00:05:22.960>use <00:05:23.099>the,

80
00:05:25.940 --> 00:05:28.940
<00:05:25.940>the <00:05:26.219>best <00:05:26.500>crypto <00:05:26.780>library. <00:05:27.060>Uh, <00:05:27.340>again,

81
00:05:29.400 --> 00:05:34.180
<00:05:29.400>you <00:05:29.507>need <00:05:29.615>to <00:05:29.723>do <00:05:29.830>some <00:05:29.938>research <00:05:30.046>to <00:05:30.153>see <00:05:30.261>what <00:05:30.369>kind <00:05:30.476>of <00:05:30.584>the <00:05:30.692>crypto <00:05:30.799>algorithms

82
00:05:34.460 --> 00:05:37.940
<00:05:34.460>actually <00:05:34.599>are <00:05:34.739>the <00:05:34.880>breached <00:05:35.020>or <00:05:35.159>actually <00:05:35.299>are <00:05:35.440>not <00:05:35.580>breached. <00:05:35.719>For <00:05:35.859>example,

83
00:05:38.100 --> 00:05:42.860
<00:05:38.100>a <00:05:38.173>e <00:05:38.247>s <00:05:38.321>2, <00:05:38.394>5, <00:05:38.468>6, <00:05:38.542>a, <00:05:38.615>s, <00:05:38.689>a <00:05:38.763>and <00:05:38.836>so <00:05:38.910>on. <00:05:38.984>Just <00:05:39.057>you <00:05:39.131>need <00:05:39.205>to <00:05:39.278>pick <00:05:39.352>the <00:05:39.426>right <00:05:39.500>one.

84
00:05:43.320 --> 00:05:47.260
<00:05:43.320>Of <00:05:43.475>course, <00:05:43.631>cryptography <00:05:43.786>is <00:05:43.942>straight <00:05:44.097>off <00:05:44.253>about <00:05:44.408>performance <00:05:44.564>and <00:05:44.719>security.

85
00:05:47.760 --> 00:05:50.860
<00:05:47.760>So <00:05:47.887>it's <00:05:48.014>a <00:05:48.141>equilibrium. <00:05:48.269>You <00:05:48.396>need <00:05:48.523>to <00:05:48.650>define <00:05:48.778>the, <00:05:48.905>the, <00:05:49.032>let's <00:05:49.159>say,

86
00:05:51.010 --> 00:05:54.900
<00:05:51.010>idle <00:05:51.210>state <00:05:51.409>of <00:05:51.610>your <00:05:51.810>cryptographic <00:05:52.010>library. <00:05:52.210>Again, <00:05:52.409>uh,

87
00:05:56.460 --> 00:06:00.070
<00:05:56.460>be <00:05:56.739>careful <00:05:57.020>about <00:05:57.299>third <00:05:57.580>party <00:05:57.859>libraries.

88
00:06:00.350 --> 00:06:02.550
<00:06:00.350>I <00:06:00.583>will <00:06:00.816>explain <00:06:01.050>that <00:06:01.283>in <00:06:01.516>more <00:06:01.750>detail.

89
00:06:02.650 --> 00:06:06.710
<00:06:02.650>And <00:06:02.825>also <00:06:03.000>I <00:06:03.174>will <00:06:03.349>say <00:06:03.525>something <00:06:03.700>about <00:06:03.875>DevSecOps <00:06:04.049>process.

90
00:06:07.420 --> 00:06:11.750
<00:06:07.420>Also, <00:06:07.527>the, <00:06:07.635>the <00:06:07.743>most <00:06:07.850>interesting <00:06:07.958>part <00:06:08.066>is <00:06:08.173>use <00:06:08.281>the <00:06:08.389>principle <00:06:08.496>of <00:06:08.604>the <00:06:08.712>last <00:06:08.820>privilege.

91
00:06:12.730 --> 00:06:17.550
<00:06:12.730>How <00:06:12.885>many <00:06:13.041>of <00:06:13.196>you <00:06:13.352>actually <00:06:13.507>is <00:06:13.663>admin <00:06:13.818>on <00:06:13.974>your <00:06:14.130>corporate

92
00:06:18.180 --> 00:06:22.010
<00:06:18.180>machine? <00:06:18.307>I'll <00:06:18.434>just <00:06:18.561>cover <00:06:18.689>my <00:06:18.816>eyes. <00:06:18.943>And <00:06:19.070>there, <00:06:19.198>there's <00:06:19.325>no <00:06:19.452>need <00:06:19.580>to,

93
00:06:22.010 --> 00:06:24.970
<00:06:22.010>to <00:06:22.185>raise <00:06:22.360>your <00:06:22.534>hands. <00:06:22.710>I <00:06:22.885>believe <00:06:23.060>90% <00:06:23.235>of <00:06:23.409>you.

94
00:06:25.230 --> 00:06:30.150
<00:06:25.230>So <00:06:25.357>it <00:06:25.484>is <00:06:25.611>a <00:06:25.739>huge <00:06:25.866>security <00:06:25.993>risk, <00:06:26.120>again, <00:06:26.248>on <00:06:26.375>the <00:06:26.502>code <00:06:26.630>level,

95
00:06:30.650 --> 00:06:33.750
<00:06:30.650>on <00:06:30.849>the <00:06:31.049>service <00:06:31.250>level, <00:06:31.450>on <00:06:31.650>the <00:06:31.849>application <00:06:32.049>level,

96
00:06:34.450 --> 00:06:37.670
<00:06:34.450>are <00:06:34.650>all <00:06:34.849>these <00:06:35.050>processes <00:06:35.250>need <00:06:35.450>to <00:06:35.650>have <00:06:35.849>the,

97
00:06:37.740 --> 00:06:41.250
<00:06:37.740>that <00:06:37.915>kind <00:06:38.090>of <00:06:38.265>privilege <00:06:38.440>to <00:06:38.615>do. <00:06:38.790>In <00:06:38.965>my <00:06:39.140>practice,

98
00:06:42.210 --> 00:06:43.370
<00:06:42.210>I <00:06:42.558>haven't <00:06:42.906>seen, <00:06:43.254>uh,

99
00:06:43.990 --> 00:06:48.810
<00:06:43.990>too <00:06:44.165>many <00:06:44.340>examples <00:06:44.515>where <00:06:44.690>actually <00:06:44.865>the <00:06:45.040>users <00:06:45.215>from <00:06:45.390>the,

100
00:06:49.520 --> 00:06:53.750
<00:06:49.520>the <00:06:49.695>phase <00:06:49.870>of <00:06:50.044>testing <00:06:50.219>is <00:06:50.395>actually <00:06:50.570>goes <00:06:50.745>in <00:06:50.919>production

101
00:06:54.510 --> 00:06:57.170
<00:06:54.510>and <00:06:54.743>that <00:06:54.976>user <00:06:55.210>was <00:06:55.443>an <00:06:55.676>admin <00:06:55.909>account.

102
00:06:58.430 --> 00:07:03.210
<00:06:58.430>So <00:06:58.530>in <00:06:58.630>a <00:06:58.730>testing <00:06:58.830>phase, <00:06:58.930>we <00:06:59.030>just <00:06:59.130>need <00:06:59.230>to <00:06:59.330>get <00:06:59.430>that <00:06:59.530>account <00:06:59.630>and <00:06:59.730>it's <00:06:59.830>checkmate,

103
00:07:03.470 --> 00:07:05.130
<00:07:03.470>you're <00:07:03.670>inside, <00:07:03.870>you <00:07:04.070>can <00:07:04.270>do <00:07:04.470>whatever <00:07:04.670>you <00:07:04.870>want.

104
00:07:07.500 --> 00:07:12.200
<00:07:07.500>But <00:07:07.640>let's <00:07:07.780>back <00:07:07.920>to <00:07:08.060>square <00:07:08.200>one. <00:07:08.340>Write <00:07:08.480>a <00:07:08.620>secure <00:07:08.760>code, <00:07:08.900>uh,

105
00:07:12.250 --> 00:07:16.800
<00:07:12.250>again, <00:07:12.366>uh, <00:07:12.483>how <00:07:12.600>to <00:07:12.716>write <00:07:12.833>secure <00:07:12.950>code. <00:07:13.066>In <00:07:13.183>most <00:07:13.300>cases, <00:07:13.416>in <00:07:13.533>most <00:07:13.650>cases,

106
00:07:17.680 --> 00:07:21.920
<00:07:17.680>security <00:07:17.855>vulnerability <00:07:18.030>start <00:07:18.205>on <00:07:18.380>the <00:07:18.555>bad <00:07:18.730>input <00:07:18.905>validation <00:07:19.080>period.

107
00:07:23.240 --> 00:07:28.060
<00:07:23.240>Yes, <00:07:23.380>there <00:07:23.520>is <00:07:23.660>other <00:07:23.800>stuff, <00:07:23.940>but <00:07:24.080>in <00:07:24.220>most <00:07:24.360>cases, <00:07:24.500>Euro <00:07:24.640>strings,

108
00:07:28.250 --> 00:07:32.100
<00:07:28.250>user <00:07:28.425>input, <00:07:28.600>query, <00:07:28.775>strings, <00:07:28.950>session <00:07:29.125>states, <00:07:29.300>there <00:07:29.475>other <00:07:29.650>issues,

109
00:07:32.100 --> 00:07:35.740
<00:07:32.100>there <00:07:32.275>are <00:07:32.450>problems <00:07:32.625>if <00:07:32.800>you <00:07:32.975>don't <00:07:33.150>validate <00:07:33.325>them <00:07:33.500>correctly,

110
00:07:36.810 --> 00:07:38.380
<00:07:36.810>they <00:07:37.043>are <00:07:37.276>the <00:07:37.510>vector <00:07:37.743>of <00:07:37.976>the <00:07:38.210>attack.

111
00:07:39.600 --> 00:07:42.640
<00:07:39.600>I <00:07:39.716>will <00:07:39.833>say <00:07:39.950>a <00:07:40.066>couple <00:07:40.183>examples <00:07:40.300>later <00:07:40.416>in <00:07:40.533>presentation, <00:07:40.650>uh, <00:07:40.766>how <00:07:40.883>we <00:07:41.000>actually,

112
00:07:42.640 --> 00:07:46.600
<00:07:42.640>we <00:07:42.815>exploit, <00:07:42.990>uh, <00:07:43.164>this <00:07:43.340>vulnerabilities <00:07:43.515>to <00:07:43.690>actually <00:07:43.865>go <00:07:44.039>very,

113
00:07:46.630 --> 00:07:49.640
<00:07:46.630>very <00:07:46.909>deep <00:07:47.190>inside <00:07:47.469>the <00:07:47.750>system. <00:07:48.030>Again,

114
00:07:50.500 --> 00:07:54.640
<00:07:50.500>it <00:07:50.655>it's <00:07:50.811>always <00:07:50.966>about <00:07:51.122>delivery, <00:07:51.277>performance <00:07:51.433>and <00:07:51.588>security. <00:07:51.744>You <00:07:51.900>know,

115
00:07:54.700 --> 00:07:58.400
<00:07:54.700>the <00:07:54.807>customer <00:07:54.915>will <00:07:55.023>say, <00:07:55.130>we, <00:07:55.238>you <00:07:55.346>have <00:07:55.453>a <00:07:55.561>deadline. <00:07:55.669>I <00:07:55.776>need <00:07:55.884>the, <00:07:55.992>the <00:07:56.099>prototype.

116
00:07:58.640 --> 00:08:01.160
<00:07:58.640>I <00:07:58.767>need <00:07:58.894>to <00:07:59.021>have <00:07:59.149>testing <00:07:59.276>phase, <00:07:59.403>we <00:07:59.530>need <00:07:59.658>to <00:07:59.785>go <00:07:59.912>in <00:08:00.039>production.

117
00:08:01.550 --> 00:08:04.960
<00:08:01.550>Yesterday <00:08:01.783>is <00:08:02.016>not <00:08:02.250>the <00:08:02.483>possible. <00:08:02.716>So <00:08:02.950>again,

118
00:08:05.510 --> 00:08:09.760
<00:08:05.510>it's <00:08:05.626>always <00:08:05.743>about <00:08:05.860>how <00:08:05.976>to, <00:08:06.093>how <00:08:06.210>to <00:08:06.326>security <00:08:06.443>is <00:08:06.560>pushed <00:08:06.676>on <00:08:06.793>the <00:08:06.909>side,

119
00:08:10.900 --> 00:08:15.260
<00:08:10.900>be <00:08:11.016>able <00:08:11.133>to <00:08:11.250>think <00:08:11.366>about <00:08:11.483>security <00:08:11.599>later. <00:08:11.716>No, <00:08:11.833>if <00:08:11.950>you <00:08:12.066>think <00:08:12.183>about <00:08:12.299>later,

120
00:08:15.260 --> 00:08:20.210
<00:08:15.260>it's <00:08:15.360>too <00:08:15.460>late. <00:08:15.560>Now, <00:08:15.659>you <00:08:15.760>need <00:08:15.860>to <00:08:15.960>think <00:08:16.060>about <00:08:16.159>on <00:08:16.260>the <00:08:16.360>early <00:08:16.460>stages, <00:08:16.560>uh, <00:08:16.659>and,

121
00:08:20.310 --> 00:08:21.110
<00:08:20.310>and <00:08:20.550>matter <00:08:20.790>of <00:08:21.030>fact,

122
00:08:21.110 --> 00:08:25.930
<00:08:21.110>how <00:08:21.250>many <00:08:21.390>of <00:08:21.530>you <00:08:21.670>actually <00:08:21.810>knows <00:08:21.950>something <00:08:22.090>about <00:08:22.230>threat <00:08:22.370>modeling <00:08:22.510>stride

123
00:08:25.930 --> 00:08:26.763
methodology?

124
00:08:30.700 --> 00:08:33.910
<00:08:30.700>Okay. <00:08:30.979>Okay. <00:08:31.260>So <00:08:31.539>threat <00:08:31.820>modeling, <00:08:32.100>uh,

125
00:08:34.090 --> 00:08:38.350
<00:08:34.090>is <00:08:34.217>a <00:08:34.344>basic <00:08:34.471>principle <00:08:34.599>of <00:08:34.726>the <00:08:34.853>security <00:08:34.980>from <00:08:35.108>the <00:08:35.235>early <00:08:35.362>phases <00:08:35.490>of,

126
00:08:38.410 --> 00:08:39.190
<00:08:38.409>of <00:08:38.644>the <00:08:38.878>or <00:08:39.112>the,

127
00:08:39.190 --> 00:08:44.090
<00:08:39.190>or <00:08:39.365>the <00:08:39.540>design <00:08:39.715>testing <00:08:39.890>and <00:08:40.065>the <00:08:40.240>production <00:08:40.415>is <00:08:40.590>everything

128
00:08:44.090 --> 00:08:45.850
<00:08:44.090>by <00:08:44.370>the <00:08:44.650>book. <00:08:44.930>Is <00:08:45.210>that <00:08:45.490>clear?

129
00:08:46.030 --> 00:08:50.450
<00:08:46.030>You <00:08:46.146>just <00:08:46.263>need <00:08:46.380>to <00:08:46.496>follow <00:08:46.613>this <00:08:46.730>strategy <00:08:46.846>methodology <00:08:46.963>to <00:08:47.079>actually <00:08:47.196>avoid <00:08:47.313>all <00:08:47.430>these

130
00:08:50.770 --> 00:08:53.540
<00:08:50.770>pitfalls. <00:08:51.470>Also, <00:08:52.170>uh,

131
00:08:54.280 --> 00:08:59.000
<00:08:54.280>do <00:08:54.396>does <00:08:54.513>your <00:08:54.630>company <00:08:54.746>is <00:08:54.863>actually <00:08:54.980>have <00:08:55.096>created <00:08:55.213>any <00:08:55.329>kind <00:08:55.446>of <00:08:55.563>policy <00:08:55.680>or

132
00:08:59.000 --> 00:09:03.820
<00:08:59.000>procedure <00:08:59.175>that <00:08:59.350>you <00:08:59.525>need <00:08:59.700>to <00:08:59.875>follow <00:09:00.050>up <00:09:00.225>or <00:09:00.400>is

133
00:09:04.080 --> 00:09:08.820
<00:09:04.080>up <00:09:04.235>to <00:09:04.391>team. <00:09:04.546>So <00:09:04.702>team <00:09:04.857>will <00:09:05.013>decide <00:09:05.168>about <00:09:05.324>security <00:09:05.480>practice.

134
00:09:09.560 --> 00:09:12.340
<00:09:09.560>Are <00:09:09.687>they <00:09:09.814>going <00:09:09.941>to <00:09:10.069>hike <00:09:10.196>to <00:09:10.323>low <00:09:10.450>or <00:09:10.578>somewhere <00:09:10.705>in <00:09:10.832>the <00:09:10.959>middle?

135
00:09:12.800 --> 00:09:16.500
<00:09:12.800>So <00:09:12.927>if <00:09:13.054>you <00:09:13.181>are <00:09:13.309>speaking <00:09:13.436>about <00:09:13.563>the <00:09:13.690>second <00:09:13.818>part, <00:09:13.945>that's <00:09:14.072>not <00:09:14.199>good.

136
00:09:17.280 --> 00:09:20.100
<00:09:17.280>So <00:09:17.513>some, <00:09:17.746>someone <00:09:17.980>in <00:09:18.213>the <00:09:18.446>company <00:09:18.680>security,

137
00:09:20.500 --> 00:09:24.820
<00:09:20.500>vertical <00:09:20.655>and <00:09:20.811>horizontal <00:09:20.966>need <00:09:21.122>to <00:09:21.277>decide <00:09:21.433>about <00:09:21.588>these <00:09:21.744>policies <00:09:21.900>and

138
00:09:25.700 --> 00:09:29.580
<00:09:25.700>procedures. <00:09:25.875>Also, <00:09:26.050>design <00:09:26.225>your <00:09:26.400>code. <00:09:26.575>That's <00:09:26.750>easy <00:09:26.925>to <00:09:27.100>patch.

139
00:09:30.680 --> 00:09:32.060
<00:09:30.680>So <00:09:30.990>if <00:09:31.300>you <00:09:31.611>need <00:09:31.921>to,

140
00:09:32.080 --> 00:09:36.660
<00:09:32.080>to <00:09:32.255>take <00:09:32.430>offline <00:09:32.605>entire <00:09:32.780>environment <00:09:32.955>to <00:09:33.130>do <00:09:33.305>some <00:09:33.480>patching,

141
00:09:37.160 --> 00:09:38.580
<00:09:37.160>that's <00:09:37.586>no <00:09:38.012>good <00:09:38.438>solution.

142
00:09:39.160 --> 00:09:44.140
<00:09:39.160>So <00:09:39.253>make <00:09:39.346>the <00:09:39.439>mod <00:09:39.533>r <00:09:39.626>make <00:09:39.719>the <00:09:39.813>patching <00:09:39.906>of <00:09:40.000>the <00:09:40.093>security <00:09:40.186>calls <00:09:40.280>easy <00:09:40.373>as <00:09:40.466>much <00:09:40.560>easy

143
00:09:44.480 --> 00:09:49.460
<00:09:44.480>as <00:09:44.655>as <00:09:44.830>possible. <00:09:45.005>Also, <00:09:45.180>uh, <00:09:45.355>on <00:09:45.530>on <00:09:45.705>on <00:09:45.880>the,

144
00:09:49.460 --> 00:09:53.500
<00:09:49.460>on <00:09:49.600>the <00:09:49.740>last <00:09:49.880>one <00:09:50.020>also, <00:09:50.160>I'll <00:09:50.300>say <00:09:50.440>something <00:09:50.580>more <00:09:50.720>about <00:09:50.860>the,

145
00:09:53.510 --> 00:09:55.420
<00:09:53.510>about <00:09:53.976>the <00:09:54.443>end <00:09:54.910>presentation.

146
00:09:55.800 --> 00:09:59.420
<00:09:55.800>The <00:09:55.955>regular <00:09:56.111>you <00:09:56.266>need <00:09:56.422>to <00:09:56.577>regular <00:09:56.733>pen <00:09:56.888>test <00:09:57.044>your <00:09:57.199>applications.

147
00:10:01.370 --> 00:10:02.203
<00:10:01.370>The <00:10:01.619>question <00:10:01.869>for <00:10:02.119>you,

148
00:10:02.610 --> 00:10:07.430
<00:10:02.610>how <00:10:02.703>many <00:10:02.796>of <00:10:02.890>your <00:10:02.983>applications <00:10:03.076>actually <00:10:03.170>have <00:10:03.263>regular <00:10:03.356>pen <00:10:03.450>test <00:10:03.543>in <00:10:03.636>the <00:10:03.730>SS <00:10:03.823>D <00:10:03.916>L <00:10:04.010>C?

149
00:10:09.380 --> 00:10:11.000
<00:10:09.380>So <00:10:09.846>it's <00:10:10.313>dangerously <00:10:10.780>low.

150
00:10:11.580 --> 00:10:16.440
<00:10:11.580>So <00:10:11.755>let's <00:10:11.930>say <00:10:12.105>90% <00:10:12.280>of <00:10:12.455>you <00:10:12.630>here <00:10:12.805>simply <00:10:12.980>doesn't

151
00:10:16.440 --> 00:10:19.840
<00:10:16.440>have <00:10:16.595>any <00:10:16.751>pen <00:10:16.906>test <00:10:17.062>inside <00:10:17.217>the <00:10:17.373>S <00:10:17.528>D <00:10:17.684>L <00:10:17.840>C.

152
00:10:20.420 --> 00:10:24.320
<00:10:20.420>So <00:10:20.536>for <00:10:20.653>me <00:10:20.770>it <00:10:20.886>is, <00:10:21.003>it <00:10:21.120>is <00:10:21.236>a <00:10:21.353>nightmare, <00:10:21.469>but <00:10:21.586>okay, <00:10:21.703>that's <00:10:21.819>me.

153
00:10:26.950 --> 00:10:31.020
<00:10:26.950>Third <00:10:27.125>party <00:10:27.300>libraries. <00:10:27.475>Uh, <00:10:27.650>I <00:10:27.825>believe <00:10:28.000>that <00:10:28.175>that <00:10:28.350>in,

154
00:10:31.320 --> 00:10:35.300
<00:10:31.320>in <00:10:31.447>modern <00:10:31.574>term <00:10:31.701>is <00:10:31.829>actually <00:10:31.956>as <00:10:32.083>described <00:10:32.210>as <00:10:32.338>a <00:10:32.465>supply <00:10:32.592>chain <00:10:32.720>attack.

155
00:10:36.810 --> 00:10:40.590
<00:10:36.810>Supply <00:10:37.010>chain <00:10:37.209>attack <00:10:37.410>is <00:10:37.609>something <00:10:37.810>new <00:10:38.010>from <00:10:38.209>2019,

156
00:10:40.860 --> 00:10:44.310
<00:10:40.860>just <00:10:41.035>before <00:10:41.210>the <00:10:41.385>covid, <00:10:41.560>uh, <00:10:41.735>nightmare. <00:10:41.910>Uh, <00:10:42.085>and <00:10:42.260>the,

157
00:10:44.310 --> 00:10:49.290
<00:10:44.310>the <00:10:44.449>most <00:10:44.589>famous <00:10:44.729>example <00:10:44.869>of <00:10:45.010>the <00:10:45.150>supply <00:10:45.290>chain <00:10:45.430>attack <00:10:45.569>was <00:10:45.709>a

158
00:10:49.290 --> 00:10:50.570
<00:10:49.290>solar <00:10:49.866>wind <00:10:50.442>bridge.

159
00:10:51.670 --> 00:10:55.590
<00:10:51.670>The <00:10:51.870>attacker <00:10:52.069>was <00:10:52.270>inside <00:10:52.469>the <00:10:52.670>system <00:10:52.870>from <00:10:53.069>the

160
00:10:55.830 --> 00:10:59.750
<00:10:55.830>November, <00:10:56.063>2019 <00:10:56.296>to <00:10:56.530>the <00:10:56.763>November, <00:10:56.996>2021 <00:10:57.230>year.

161
00:11:00.090 --> 00:11:04.910
<00:11:00.090>So <00:11:00.206>the <00:11:00.323>attacker <00:11:00.440>was <00:11:00.556>the <00:11:00.673>one <00:11:00.790>year <00:11:00.906>inside <00:11:01.023>the <00:11:01.140>system <00:11:01.256>just <00:11:01.373>pull <00:11:01.490>information

162
00:11:05.330 --> 00:11:07.510
<00:11:05.330>out. <00:11:05.610>Nobody <00:11:05.890>knows <00:11:06.170>about <00:11:06.450>that. <00:11:06.730>Why?

163
00:11:07.780 --> 00:11:10.510
<00:11:07.780>Because <00:11:08.060>someone <00:11:08.339>has <00:11:08.620>found <00:11:08.900>the <00:11:09.180>library,

164
00:11:10.770 --> 00:11:14.710
<00:11:10.770>old <00:11:10.925>library <00:11:11.081>compromise <00:11:11.236>library <00:11:11.392>that <00:11:11.547>is <00:11:11.703>actually <00:11:11.858>used <00:11:12.014>in <00:11:12.170>production.

165
00:11:15.970 --> 00:11:18.470
<00:11:15.970>So <00:11:16.250>old <00:11:16.530>library <00:11:16.810>I <00:11:17.090>know <00:11:17.370>vulnerability.

166
00:11:19.110 --> 00:11:21.950
<00:11:19.110>I <00:11:19.285>actually <00:11:19.460>find <00:11:19.635>it <00:11:19.810>that <00:11:19.985>the <00:11:20.160>sound <00:11:20.335>is <00:11:20.510>using.

167
00:11:22.250 --> 00:11:25.510
<00:11:22.250>So <00:11:22.405>I <00:11:22.561>just <00:11:22.716>need <00:11:22.872>to <00:11:23.027>use <00:11:23.183>that <00:11:23.338>vulnerability <00:11:23.494>and <00:11:23.650>sneak,

168
00:11:26.370 --> 00:11:31.120
<00:11:26.370>sneak <00:11:26.510>inside <00:11:26.650>of <00:11:26.790>the <00:11:26.930>system. <00:11:27.070>So <00:11:27.210>it's <00:11:27.350>actually <00:11:27.490>they <00:11:27.630>say <00:11:27.770>that,

169
00:11:31.120 --> 00:11:34.480
<00:11:31.120>that <00:11:31.260>there's <00:11:31.400>a <00:11:31.540>Russian <00:11:31.680>behind, <00:11:31.820>but <00:11:31.960>who <00:11:32.100>cares? <00:11:32.240>That <00:11:32.380>the, <00:11:32.520>the,

170
00:11:34.540 --> 00:11:39.520
<00:11:34.540>the <00:11:34.667>major <00:11:34.794>point <00:11:34.921>here <00:11:35.049>that <00:11:35.176>solar <00:11:35.303>wind <00:11:35.430>is <00:11:35.558>actually <00:11:35.685>a <00:11:35.812>tool <00:11:35.939>that

171
00:11:39.760 --> 00:11:44.520
<00:11:39.760>actually <00:11:39.860>used <00:11:39.960>the, <00:11:40.060>the <00:11:40.160>many <00:11:40.260>bin <00:11:40.360>on <00:11:40.460>the, <00:11:40.560>on <00:11:40.660>Azure <00:11:40.760>A <00:11:40.860>v <00:11:40.960>s <00:11:41.060>and <00:11:41.160>on-premise.

172
00:11:44.980 --> 00:11:47.560
<00:11:44.980>But <00:11:45.213>uh, <00:11:45.446>solar <00:11:45.680>wind <00:11:45.913>is <00:11:46.146>actually, <00:11:46.380>uh,

173
00:11:47.780 --> 00:11:52.000
<00:11:47.780>is <00:11:47.920>a <00:11:48.060>tool <00:11:48.199>create <00:11:48.339>by <00:11:48.480>the <00:11:48.620>FireEye <00:11:48.760>and <00:11:48.900>FireEye <00:11:49.040>is <00:11:49.180>a,

174
00:11:52.020 --> 00:11:55.400
<00:11:52.020>the <00:11:52.160>company <00:11:52.300>for <00:11:52.439>the <00:11:52.579>security <00:11:52.720>in <00:11:52.860>top <00:11:53.000>three <00:11:53.140>in <00:11:53.280>the <00:11:53.420>world.

175
00:11:56.480 --> 00:11:59.580
<00:11:56.480>So <00:11:56.635>this <00:11:56.791>actually <00:11:56.946>happened <00:11:57.102>to <00:11:57.257>them <00:11:57.413>again, <00:11:57.568>law <00:11:57.724>four <00:11:57.880>j,

176
00:11:59.880 --> 00:12:01.700
<00:11:59.880>law <00:12:00.113>four <00:12:00.346>J <00:12:00.580>is <00:12:00.813>something <00:12:01.046>more <00:12:01.280>recent,

177
00:12:02.160 --> 00:12:06.840
<00:12:02.160>is <00:12:02.276>also <00:12:02.393>on <00:12:02.510>the <00:12:02.626>epic <00:12:02.743>scale <00:12:02.860>20 <00:12:02.976>that <00:12:03.093>the <00:12:03.209>bunch <00:12:03.326>of <00:12:03.443>of <00:12:03.560>the

178
00:12:06.840 --> 00:12:11.440
<00:12:06.840>libraries <00:12:07.015>is <00:12:07.190>actually <00:12:07.365>was <00:12:07.540>used <00:12:07.715>in <00:12:07.890>production <00:12:08.065>with <00:12:08.240>this

179
00:12:11.440 --> 00:12:14.480
<00:12:11.440>vulnerability. <00:12:11.640>All <00:12:11.840>the <00:12:12.040>Apache <00:12:12.240>service <00:12:12.440>and <00:12:12.640>all. <00:12:12.840>See,

180
00:12:14.480 --> 00:12:17.440
<00:12:14.480>this <00:12:14.713>J <00:12:14.946>library <00:12:15.180>is <00:12:15.413>actually, <00:12:15.646>and <00:12:15.880>still,

181
00:12:17.660 --> 00:12:22.480
<00:12:17.660>and <00:12:17.767>still <00:12:17.875>there's <00:12:17.983>many <00:12:18.090>of <00:12:18.198>the <00:12:18.306>examples <00:12:18.413>online <00:12:18.521>that <00:12:18.629>you <00:12:18.736>can <00:12:18.844>find <00:12:18.952>easily <00:12:19.060>that

182
00:12:22.680 --> 00:12:27.230
<00:12:22.680>actually <00:12:22.880>use <00:12:23.079>this <00:12:23.280>law <00:12:23.479>four <00:12:23.680>J. <00:12:23.880>So <00:12:24.079>why,

183
00:12:27.450 --> 00:12:31.110
<00:12:27.450>why <00:12:27.625>this <00:12:27.800>happen? <00:12:27.975>Because <00:12:28.150>there's <00:12:28.325>actually <00:12:28.500>presentation <00:12:28.675>yesterday <00:12:28.850>on,

184
00:12:31.110 --> 00:12:35.030
<00:12:31.110>on <00:12:31.210>the <00:12:31.310>main <00:12:31.410>stage <00:12:31.510>and <00:12:31.610>the <00:12:31.710>guy <00:12:31.810>was <00:12:31.910>talking <00:12:32.010>something <00:12:32.110>about <00:12:32.210>moving <00:12:32.310>to <00:12:32.410>the <00:12:32.510>left,

185
00:12:36.350 --> 00:12:38.000
<00:12:36.350>like <00:12:36.700>a <00:12:37.050>mindset, <00:12:37.400>I <00:12:37.750>agree,

186
00:12:38.420 --> 00:12:41.760
<00:12:38.420>but <00:12:38.547>also <00:12:38.674>moving <00:12:38.801>on <00:12:38.929>the <00:12:39.056>left <00:12:39.183>in <00:12:39.310>the <00:12:39.438>SS <00:12:39.565>D <00:12:39.692>L <00:12:39.819>C.

187
00:12:42.510 --> 00:12:44.470
<00:12:42.510>So <00:12:43.210>the <00:12:43.910>agile,

188
00:12:45.050 --> 00:12:48.750
<00:12:45.050>the <00:12:45.177>agile <00:12:45.304>is <00:12:45.431>actually <00:12:45.559>the <00:12:45.686>new <00:12:45.813>way <00:12:45.940>of <00:12:46.068>it, <00:12:46.195>new <00:12:46.322>way <00:12:46.449>of,

189
00:12:49.970 --> 00:12:52.910
<00:12:49.970>but <00:12:50.203>agile <00:12:50.436>is <00:12:50.670>actually <00:12:50.903>as <00:12:51.136>a <00:12:51.370>result,

190
00:12:52.940 --> 00:12:57.470
<00:12:52.940>they <00:12:53.080>created <00:12:53.220>DevOps <00:12:53.360>as <00:12:53.500>a <00:12:53.640>concept <00:12:53.780>to <00:12:53.920>actually <00:12:54.060>accelerate <00:12:54.200>all <00:12:54.340>this,

191
00:12:57.930 --> 00:13:02.860
<00:12:57.930>all <00:12:58.069>this <00:12:58.209>stuff. <00:12:58.349>But <00:12:58.489>if <00:12:58.630>you <00:12:58.770>try <00:12:58.910>to <00:12:59.050>search <00:12:59.189>agile <00:12:59.329>documentation,

192
00:13:05.670 --> 00:13:06.760
<00:13:05.670>core, <00:13:06.160>core <00:13:06.651>files,

193
00:13:07.370 --> 00:13:12.360
<00:13:07.370>there <00:13:07.525>is <00:13:07.681>no <00:13:07.836>any <00:13:07.992>vault <00:13:08.147>security <00:13:08.303>inside <00:13:08.458>period. <00:13:08.614>None, <00:13:08.770>none,

194
00:13:13.270 --> 00:13:13.860
none.

195
00:13:13.860 --> 00:13:18.520
<00:13:13.860>So <00:13:13.967>basically <00:13:14.075>it <00:13:14.183>is <00:13:14.290>put <00:13:14.398>the <00:13:14.506>security <00:13:14.613>on <00:13:14.721>the <00:13:14.829>place <00:13:14.936>where <00:13:15.044>actually <00:13:15.152>should <00:13:15.260>be.

196
00:13:18.820 --> 00:13:23.640
<00:13:18.820>So <00:13:18.960>this <00:13:19.100>part <00:13:19.240>here, <00:13:19.380>this <00:13:19.520>part <00:13:19.660>here, <00:13:19.800>you <00:13:19.940>need <00:13:20.080>to <00:13:20.220>check.

197
00:13:23.940 --> 00:13:25.840
<00:13:23.940>So <00:13:24.173>now <00:13:24.406>the <00:13:24.640>second <00:13:24.873>question <00:13:25.106>for <00:13:25.340>you,

198
00:13:26.340 --> 00:13:29.520
<00:13:26.340>how <00:13:26.540>many <00:13:26.740>of <00:13:26.940>you <00:13:27.140>is <00:13:27.340>actually <00:13:27.540>have <00:13:27.740>identify

199
00:13:30.950 --> 00:13:33.840
<00:13:30.950>DevSecOps <00:13:31.150>process <00:13:31.350>in <00:13:31.550>your <00:13:31.750>SS <00:13:31.950>D <00:13:32.150>L <00:13:32.350>C?

200
00:13:36.780 --> 00:13:38.820
<00:13:36.780>I <00:13:37.060>see <00:13:37.339>two <00:13:37.620>or <00:13:37.900>three <00:13:38.180>handles,

201
00:13:39.880 --> 00:13:44.350
<00:13:39.880>let's <00:13:40.055>say <00:13:40.230>500 <00:13:40.405>people <00:13:40.580>here. <00:13:40.755>So <00:13:40.930>again, <00:13:41.105>it's <00:13:41.280>disturbing.

202
00:13:44.730 --> 00:13:49.460
<00:13:44.730>So <00:13:44.870>DevSecOps <00:13:45.010>is <00:13:45.150>actually <00:13:45.290>the <00:13:45.430>concept <00:13:45.570>that <00:13:45.710>will <00:13:45.850>actually <00:13:45.990>put <00:13:46.130>the

203
00:13:49.780 --> 00:13:51.540
<00:13:49.780>security <00:13:50.013>on <00:13:50.246>the <00:13:50.480>place. <00:13:50.713>So <00:13:50.946>you <00:13:51.180>see

204
00:13:53.170 --> 00:13:57.670
<00:13:53.170>on <00:13:53.270>the <00:13:53.370>early <00:13:53.469>on <00:13:53.569>the <00:13:53.670>early <00:13:53.770>stage, <00:13:53.870>try <00:13:53.969>to <00:13:54.069>check <00:13:54.170>the <00:13:54.270>code <00:13:54.370>before <00:13:54.469>the <00:13:54.569>commit.

205
00:13:58.690 --> 00:14:02.310
<00:13:58.690>How <00:13:58.806>many <00:13:58.923>of <00:13:59.040>you <00:13:59.156>actually <00:13:59.273>use <00:13:59.390>the <00:13:59.506>credentials, <00:13:59.623>uh, <00:13:59.740>in, <00:13:59.856>in <00:13:59.973>testing <00:14:00.090>phase?

206
00:14:02.370 --> 00:14:06.850
<00:14:02.370>All <00:14:02.497>of <00:14:02.624>us, <00:14:02.751>but <00:14:02.879>are <00:14:03.006>these <00:14:03.133>credentials <00:14:03.260>will <00:14:03.388>stay <00:14:03.515>in <00:14:03.642>production <00:14:03.770>phase?

207
00:14:06.910 --> 00:14:11.330
<00:14:06.910>You <00:14:07.026>don't <00:14:07.143>know. <00:14:07.260>So <00:14:07.376>you <00:14:07.493>need <00:14:07.610>some <00:14:07.726>kind <00:14:07.843>of <00:14:07.959>guardian <00:14:08.076>here. <00:14:08.193>For <00:14:08.310>example,

208
00:14:11.730 --> 00:14:16.570
<00:14:11.730>talisman <00:14:11.857>as <00:14:11.984>a <00:14:12.111>open <00:14:12.239>source <00:14:12.366>project, <00:14:12.493>again, <00:14:12.620>the <00:14:12.748>third <00:14:12.875>park <00:14:13.002>library <00:14:13.130>check.

209
00:14:16.910 --> 00:14:18.690
<00:14:16.910>So <00:14:17.143>in <00:14:17.376>your <00:14:17.610>S <00:14:17.843>D <00:14:18.076>O <00:14:18.310>C,

210
00:14:18.790 --> 00:14:23.700
<00:14:18.790>you <00:14:18.930>need <00:14:19.069>to <00:14:19.209>have <00:14:19.349>the <00:14:19.490>person <00:14:19.630>process <00:14:19.770>who <00:14:19.910>actually <00:14:20.050>always <00:14:20.189>try

211
00:14:23.720 --> 00:14:28.380
<00:14:23.720>to <00:14:23.847>check <00:14:23.974>the <00:14:24.101>third <00:14:24.229>party <00:14:24.356>libraries <00:14:24.483>because <00:14:24.610>they <00:14:24.738>are <00:14:24.865>now <00:14:24.992>the <00:14:25.120>biggest

212
00:14:28.740 --> 00:14:33.140
<00:14:28.740>security <00:14:28.880>risk, <00:14:29.020>especially <00:14:29.160>open <00:14:29.300>source <00:14:29.440>one <00:14:29.580>because <00:14:29.720>they're <00:14:29.860>simply, <00:14:30.000>they're <00:14:30.140>left,

213
00:14:33.490 --> 00:14:35.180
<00:14:33.490>left <00:14:33.840>out, <00:14:34.190>left <00:14:34.540>out <00:14:34.890>there,

214
00:14:35.440 --> 00:14:39.660
<00:14:35.440>and <00:14:35.567>there <00:14:35.694>is <00:14:35.821>use <00:14:35.949>from <00:14:36.076>many <00:14:36.203>of <00:14:36.330>of <00:14:36.458>us <00:14:36.585>and <00:14:36.712>actually <00:14:36.840>nobody

215
00:14:40.240 --> 00:14:44.580
<00:14:40.240>caress <00:14:40.380>about <00:14:40.520>them <00:14:40.660>in <00:14:40.800>terms <00:14:40.940>of <00:14:41.080>patching <00:14:41.220>and <00:14:41.360>security <00:14:41.500>vulnerability <00:14:41.640>issues.

216
00:14:45.980 --> 00:14:50.000
<00:14:45.980>And <00:14:46.180>so <00:14:46.380>again, <00:14:46.580>you <00:14:46.780>need <00:14:46.980>before <00:14:47.180>the <00:14:47.380>production,

217
00:14:50.620 --> 00:14:53.320
<00:14:50.620>you <00:14:50.853>need <00:14:51.086>to <00:14:51.320>ize <00:14:51.553>your <00:14:51.786>pen <00:14:52.020>test.

218
00:14:53.740 --> 00:14:57.760
<00:14:53.740>So <00:14:53.867>you <00:14:53.994>will <00:14:54.121>need <00:14:54.249>to <00:14:54.376>test <00:14:54.503>your <00:14:54.630>application <00:14:54.758>in <00:14:54.885>the <00:14:55.012>human <00:14:55.140>hands

219
00:14:58.920 --> 00:14:59.980
<00:14:58.920>as <00:14:59.238>a <00:14:59.556>ethical <00:14:59.874>hacker,

220
00:15:00.640 --> 00:15:05.620
<00:15:00.640>but <00:15:00.756>before <00:15:00.873>that <00:15:00.990>you <00:15:01.106>need <00:15:01.223>to <00:15:01.340>try <00:15:01.456>the <00:15:01.573>classical <00:15:01.689>avap <00:15:01.806>Zap <00:15:01.923>top <00:15:02.040>10

221
00:15:05.620 --> 00:15:08.380
<00:15:05.620>vulnerabilities <00:15:06.086>before <00:15:06.553>the <00:15:07.020>production

222
00:15:11.170 --> 00:15:14.830
<00:15:11.170>secure <00:15:11.520>APIs <00:15:11.870>API <00:15:12.219>is <00:15:12.569>everywhere.

223
00:15:15.600 --> 00:15:18.220
<00:15:15.600>We <00:15:15.755>use <00:15:15.911>a <00:15:16.066>p <00:15:16.222>r, <00:15:16.377>you <00:15:16.533>know, <00:15:16.688>they're <00:15:16.844>publicly <00:15:17.000>available,

224
00:15:18.680 --> 00:15:21.700
<00:15:18.680>but <00:15:18.880>these <00:15:19.079>a <00:15:19.280>p <00:15:19.479>I <00:15:19.680>are <00:15:19.880>exposed. <00:15:20.079>Uh,

225
00:15:23.120 --> 00:15:28.100
<00:15:23.120>my <00:15:23.227>team <00:15:23.335>is <00:15:23.443>actually <00:15:23.550>on <00:15:23.658>a <00:15:23.766>daily <00:15:23.873>basis <00:15:23.981>defined <00:15:24.089>the <00:15:24.196>vulnerabilities <00:15:24.304>and <00:15:24.412>secure <00:15:24.520>API

226
00:15:28.280 --> 00:15:31.060
<00:15:28.280>and <00:15:28.746>APIs <00:15:29.213>from, <00:15:29.680>from,

227
00:15:31.250 --> 00:15:35.860
<00:15:31.250>from <00:15:31.405>our <00:15:31.561>customers <00:15:31.716>in <00:15:31.872>actually <00:15:32.027>our <00:15:32.183>own <00:15:32.338>products <00:15:32.494>and <00:15:32.650>the

228
00:15:36.090 --> 00:15:38.620
<00:15:36.090>worldwide <00:15:36.440>web, <00:15:36.790>they're <00:15:37.140>simply <00:15:37.490>exposed.

229
00:15:39.840 --> 00:15:43.140
<00:15:39.840>So <00:15:39.956>there's <00:15:40.073>a <00:15:40.190>many <00:15:40.306>of <00:15:40.423>items <00:15:40.540>how <00:15:40.656>to <00:15:40.773>improve <00:15:40.890>them. <00:15:41.006>And <00:15:41.123>so <00:15:41.240>there's,

230
00:15:43.140 --> 00:15:47.220
<00:15:43.140>there's <00:15:43.240>so <00:15:43.340>much <00:15:43.439>time <00:15:43.540>to <00:15:43.640>to <00:15:43.740>to <00:15:43.840>say <00:15:43.939>about <00:15:44.040>them, <00:15:44.140>but <00:15:44.240>I'll <00:15:44.340>just <00:15:44.439>say <00:15:44.540>that,

231
00:15:47.220 --> 00:15:49.260
<00:15:47.220>that <00:15:47.500>the <00:15:47.780>key <00:15:48.060>key <00:15:48.340>points, <00:15:48.620>uh,

232
00:15:49.400 --> 00:15:53.740
<00:15:49.400>always <00:15:49.555>try <00:15:49.711>to <00:15:49.866>use <00:15:50.022>secure <00:15:50.177>notification <00:15:50.333>of <00:15:50.488>your <00:15:50.644>windows <00:15:50.800>with,

233
00:15:53.880 --> 00:15:55.100
<00:15:53.880>of <00:15:54.154>your <00:15:54.429>A <00:15:54.703>P <00:15:54.978>I.

234
00:15:55.530 --> 00:16:00.100
<00:15:55.530>Because <00:15:55.657>if <00:15:55.784>anyone <00:15:55.911>can <00:15:56.039>hooked <00:15:56.166>up <00:15:56.293>on <00:15:56.420>your <00:15:56.548>A <00:15:56.675>p <00:15:56.802>i <00:15:56.930>without

235
00:16:00.740 --> 00:16:04.940
<00:16:00.740>question, <00:16:00.895>who <00:16:01.051>are <00:16:01.206>you, <00:16:01.362>you <00:16:01.517>can <00:16:01.673>do <00:16:01.828>whatever <00:16:01.984>they <00:16:02.140>want.

236
00:16:05.640 --> 00:16:09.890
<00:16:05.640>Why? <00:16:05.814>Because <00:16:05.990>a <00:16:06.165>p <00:16:06.340>I <00:16:06.515>will <00:16:06.689>deliver <00:16:06.865>actually <00:16:07.040>is

237
00:16:10.960 --> 00:16:15.570
<00:16:10.960>also <00:16:11.087>try <00:16:11.214>to <00:16:11.341>use <00:16:11.469>T <00:16:11.596>L <00:16:11.723>S <00:16:11.850>S <00:16:11.978>S <00:16:12.105>L <00:16:12.232>encryption <00:16:12.360>channel

238
00:16:15.720 --> 00:16:19.290
<00:16:15.720>between <00:16:15.860>the <00:16:16.000>A <00:16:16.140>P <00:16:16.280>I <00:16:16.420>and <00:16:16.560>the <00:16:16.700>and <00:16:16.840>the <00:16:16.980>endpoint. <00:16:17.120>Maybe,

239
00:16:19.660 --> 00:16:23.370
<00:16:19.660>maybe <00:16:19.893>productional <00:16:20.126>is <00:16:20.360>going <00:16:20.593>something <00:16:20.826>like <00:16:21.060>passwords,

240
00:16:23.370 --> 00:16:27.730
<00:16:23.370>credit <00:16:23.497>card <00:16:23.624>numbers <00:16:23.751>and <00:16:23.879>so <00:16:24.006>on, <00:16:24.133>need <00:16:24.260>to <00:16:24.388>protect <00:16:24.515>all <00:16:24.642>this <00:16:24.770>information.

241
00:16:29.960 --> 00:16:30.860
<00:16:29.960>And <00:16:30.230>you <00:16:30.500>see <00:16:30.770>this,

242
00:16:31.150 --> 00:16:36.060
<00:16:31.150>these <00:16:31.277>are <00:16:31.404>currently <00:16:31.531>attacks <00:16:31.659>that <00:16:31.786>actually <00:16:31.913>can <00:16:32.040>be <00:16:32.168>possible <00:16:32.295>on <00:16:32.422>your <00:16:32.550>APIs

243
00:16:36.250 --> 00:16:38.630
<00:16:36.250>without <00:16:36.716>any, <00:16:37.183>let's <00:16:37.650>say,

244
00:16:39.900 --> 00:16:42.470
<00:16:39.900>huge <00:16:40.074>skills <00:16:40.250>of <00:16:40.425>ethical <00:16:40.600>hacking. <00:16:40.775>It's <00:16:40.949>easy <00:16:41.125>to <00:16:41.300>do

245
00:16:44.200 --> 00:16:47.140
<00:16:44.200>handle <00:16:44.433>later <00:16:44.666>with <00:16:44.900>care. <00:16:45.133>My <00:16:45.366>favorite <00:16:45.600>part,

246
00:16:47.920 --> 00:16:51.540
<00:16:47.920>how <00:16:48.060>many <00:16:48.199>of <00:16:48.339>you <00:16:48.479>actually <00:16:48.620>use <00:16:48.760>encryption <00:16:48.900>on <00:16:49.040>the <00:16:49.180>database <00:16:49.319>layer,

247
00:16:52.950 --> 00:16:57.490
<00:16:52.950>SQL <00:16:53.090>server, <00:16:53.230>MyQ, <00:16:53.370>MariaDB <00:16:53.510>and <00:16:53.650>so <00:16:53.790>on? <00:16:53.930>Great. <00:16:54.070>This <00:16:54.210>is <00:16:54.350>much,

248
00:16:57.490 --> 00:17:02.290
<00:16:57.490>much <00:16:57.630>better <00:16:57.770>situation. <00:16:57.910>Why? <00:16:58.050>Because <00:16:58.190>this, <00:16:58.330>this <00:16:58.470>part <00:16:58.610>is <00:16:58.750>actually, <00:16:58.890>uh,

249
00:17:02.590 --> 00:17:06.800
<00:17:02.590>is <00:17:02.823>something <00:17:03.056>like <00:17:03.290>a <00:17:03.523>preemptive <00:17:03.756>strike <00:17:03.990>protection

250
00:17:07.300 --> 00:17:09.920
<00:17:07.300>before <00:17:07.500>the <00:17:07.700>breach <00:17:07.899>and <00:17:08.099>protection <00:17:08.300>after <00:17:08.500>the <00:17:08.700>breach.

251
00:17:10.700 --> 00:17:14.960
<00:17:10.700>So <00:17:10.900>if <00:17:11.100>you <00:17:11.300>encrypted <00:17:11.500>sensitive <00:17:11.700>data, <00:17:11.900>I <00:17:12.100>dunno,

252
00:17:14.960 --> 00:17:19.440
<00:17:14.960>medical <00:17:15.160>records, <00:17:15.360>passwords, <00:17:15.560>grades <00:17:15.760>of <00:17:15.960>students, <00:17:16.160>confidential <00:17:16.360>information,

253
00:17:19.600 --> 00:17:21.480
<00:17:19.599>I <00:17:19.833>dunno, <00:17:20.066>name <00:17:20.300>it, <00:17:20.533>if <00:17:20.766>you <00:17:21.000>anchored.

254
00:17:21.700 --> 00:17:26.440
<00:17:21.700>So <00:17:21.816>if <00:17:21.933>that <00:17:22.050>data <00:17:22.166>base <00:17:22.283>is <00:17:22.400>actually <00:17:22.516>leaked <00:17:22.633>outside <00:17:22.750>on <00:17:22.866>the <00:17:22.983>dark <00:17:23.100>web,

255
00:17:26.790 --> 00:17:30.000
<00:17:26.790>it's <00:17:27.069>useless <00:17:27.349>because <00:17:27.629>it's, <00:17:27.909>I <00:17:28.190>dunno,

256
00:17:30.160 --> 00:17:34.280
<00:17:30.160>a <00:17:30.287>S <00:17:30.414>2 <00:17:30.541>5 <00:17:30.669>6 <00:17:30.796>encrypted <00:17:30.923>or <00:17:31.050>a <00:17:31.178>s <00:17:31.305>i, <00:17:31.432>I <00:17:31.560>dunno.

257
00:17:34.500 --> 00:17:38.400
<00:17:34.500>So <00:17:34.640>easily <00:17:34.780>protected. <00:17:34.920>I'll <00:17:35.060>show <00:17:35.200>you <00:17:35.340>now. <00:17:35.480>Uh, <00:17:35.620>the <00:17:35.760>quick <00:17:35.900>demo,

258
00:17:45.470 --> 00:17:49.200
<00:17:45.470>how <00:17:45.625>to <00:17:45.781>create <00:17:45.936>just <00:17:46.092>simple <00:17:46.247>database <00:17:46.403>environment <00:17:46.558>in <00:17:46.714>SQL <00:17:46.870>server,

259
00:17:49.820 --> 00:17:50.653
<00:17:49.820>simple <00:17:50.569>table,

260
00:17:51.060 --> 00:17:55.680
<00:17:51.060>import <00:17:51.187>some <00:17:51.314>data <00:17:51.441>and <00:17:51.569>keep <00:17:51.696>that <00:17:51.823>data <00:17:51.950>on <00:17:52.078>the <00:17:52.205>fly <00:17:52.332>to <00:17:52.460>actually,

261
00:17:56.100 --> 00:17:58.960
<00:17:56.100>uh, <00:17:56.300>protect <00:17:56.500>the, <00:17:56.699>I <00:17:56.899>dunno, <00:17:57.100>username <00:17:57.300>and <00:17:57.500>password,

262
00:17:59.020 --> 00:18:03.520
<00:17:59.020>credit <00:17:59.175>card <00:17:59.331>numbers <00:17:59.486>as <00:17:59.642>a <00:17:59.797>fictional <00:17:59.953>columns <00:18:00.108>inside <00:18:00.264>this <00:18:00.420>demo.

263
00:18:10.520 --> 00:18:11.720
<00:18:10.520>I <00:18:10.790>have <00:18:11.060>seen <00:18:11.330>minutes <00:18:11.600>more.

264
00:18:14.930 --> 00:18:16.490
<00:18:14.930>I <00:18:15.280>will <00:18:15.630>just <00:18:15.980>try <00:18:16.330>to,

265
00:18:18.770 --> 00:18:23.230
<00:18:18.770>I <00:18:18.897>can't <00:18:19.024>speed <00:18:19.151>up <00:18:19.279>here <00:18:19.406>because <00:18:19.533>I <00:18:19.660>am <00:18:19.788>in <00:18:19.915>the <00:18:20.042>presenter <00:18:20.170>mode.

266
00:18:24.440 --> 00:18:26.610
<00:18:24.440>This <00:18:24.640>is <00:18:24.840>the <00:18:25.040>table, <00:18:25.240>this <00:18:25.440>is <00:18:25.640>the <00:18:25.840>certificate.

267
00:18:29.640 --> 00:18:33.380
<00:18:29.640>So <00:18:29.780>it's <00:18:29.920>a, <00:18:30.060>it's <00:18:30.200>higher <00:18:30.340>here. <00:18:30.480>So <00:18:30.620>while <00:18:30.760>watching <00:18:30.900>this <00:18:31.040>demo,

268
00:18:33.680 --> 00:18:37.060
<00:18:33.680>so <00:18:33.835>in <00:18:33.991>SQL <00:18:34.146>server <00:18:34.302>you <00:18:34.457>have <00:18:34.613>higher <00:18:34.768>here <00:18:34.924>of <00:18:35.080>encryption.

269
00:18:37.560 --> 00:18:41.900
<00:18:37.560>So <00:18:37.715>the <00:18:37.871>master <00:18:38.026>key <00:18:38.182>level <00:18:38.337>database, <00:18:38.493>key <00:18:38.648>level <00:18:38.804>and <00:18:38.960>the,

270
00:18:42.500 --> 00:18:46.340
<00:18:42.500>I <00:18:42.675>dunno, <00:18:42.850>certificate <00:18:43.025>symmetric <00:18:43.200>or <00:18:43.375>as <00:18:43.550>metric <00:18:43.725>key <00:18:43.900>level.

271
00:18:46.760 --> 00:18:50.900
<00:18:46.760>So <00:18:46.915>if <00:18:47.071>you <00:18:47.226>pull <00:18:47.382>just <00:18:47.537>one <00:18:47.693>key <00:18:47.848>from <00:18:48.004>that <00:18:48.160>wall,

272
00:18:51.240 --> 00:18:52.073
<00:18:51.240>it <00:18:51.614>is <00:18:51.989>useless.

273
00:18:52.440 --> 00:18:56.970
<00:18:52.440>You <00:18:52.595>need <00:18:52.751>the <00:18:52.906>entire <00:18:53.062>vertical <00:18:53.217>to <00:18:53.373>actually <00:18:53.528>compromise <00:18:53.684>this <00:18:53.840>data.

274
00:18:58.610 --> 00:18:59.443
Okay,

275
00:19:02.510 --> 00:19:05.640
<00:19:02.510>just <00:19:02.665>to <00:19:02.821>actually <00:19:02.976>show <00:19:03.132>you <00:19:03.287>what <00:19:03.443>I <00:19:03.598>will <00:19:03.754>pull <00:19:03.910>out

276
00:19:09.160 --> 00:19:13.740
<00:19:09.160>sample <00:19:09.335>and <00:19:09.510>now <00:19:09.685>I <00:19:09.860>will <00:19:10.035>import <00:19:10.210>this <00:19:10.385>data <00:19:10.560>at

277
00:19:13.740 --> 00:19:18.420
<00:19:13.740>encrypted <00:19:13.895>on <00:19:14.051>the <00:19:14.206>fly <00:19:14.362>using <00:19:14.517>anchored <00:19:14.673>by <00:19:14.828>key <00:19:14.984>embedded <00:19:15.140>function

278
00:19:18.800 --> 00:19:21.940
<00:19:18.800>inside <00:19:18.940>the <00:19:19.080>SQL <00:19:19.220>language, <00:19:19.360>inside <00:19:19.500>the <00:19:19.639>SQL <00:19:19.780>server <00:19:19.919>as <00:19:20.060>a <00:19:20.200>backend.

279
00:19:28.230 --> 00:19:29.063
<00:19:28.230>And <00:19:28.604>that's <00:19:28.979>it.

280
00:19:38.740 --> 00:19:41.680
<00:19:38.740>You <00:19:38.895>see <00:19:39.051>there's <00:19:39.206>delay <00:19:39.362>because <00:19:39.517>the <00:19:39.673>encryption <00:19:39.828>and <00:19:39.984>that's <00:19:40.140>okay.

281
00:19:43.390 --> 00:19:46.840
<00:19:43.390>Two <00:19:43.670>seconds <00:19:43.950>delay <00:19:44.230>as <00:19:44.510>usual <00:19:44.790>query.

282
00:19:48.030 --> 00:19:52.770
<00:19:48.030>And <00:19:48.170>now <00:19:48.310>you <00:19:48.450>will <00:19:48.590>see <00:19:48.730>side <00:19:48.870>by <00:19:49.010>side <00:19:49.149>this <00:19:49.290>data <00:19:49.430>how

283
00:19:53.050 --> 00:19:55.330
<00:19:53.050>actually <00:19:53.330>look <00:19:53.610>like <00:19:53.889>inside <00:19:54.169>the <00:19:54.450>table.

284
00:19:57.360 --> 00:20:01.460
<00:19:57.360>Always <00:19:57.534>close <00:19:57.709>the <00:19:57.885>key. <00:19:58.060>If <00:19:58.235>your <00:19:58.409>database <00:19:58.584>is <00:19:58.760>actually,

285
00:20:01.480 --> 00:20:06.420
<00:20:01.480>or <00:20:01.587>a <00:20:01.695>system <00:20:01.803>actually <00:20:01.910>breaks <00:20:02.018>down, <00:20:02.126>the <00:20:02.233>entire <00:20:02.341>memory <00:20:02.449>will <00:20:02.556>dump <00:20:02.664>on <00:20:02.772>the <00:20:02.880>disc.

286
00:20:07.120 --> 00:20:09.700
<00:20:07.120>And <00:20:07.260>the <00:20:07.399>key <00:20:07.540>from <00:20:07.679>memory <00:20:07.820>will <00:20:07.959>also <00:20:08.100>go <00:20:08.239>on <00:20:08.379>the <00:20:08.520>disc.

287
00:20:10.200 --> 00:20:13.260
<00:20:10.200>So <00:20:10.355>in <00:20:10.511>the <00:20:10.666>forensics <00:20:10.822>it <00:20:10.977>can <00:20:11.133>be <00:20:11.288>actually <00:20:11.444>pulled <00:20:11.600>out.

288
00:20:14.420 --> 00:20:18.760
<00:20:14.420>Always <00:20:14.536>close <00:20:14.653>the <00:20:14.770>key <00:20:14.886>for <00:20:15.003>encryption <00:20:15.120>after <00:20:15.236>the <00:20:15.353>use. <00:20:15.470>Open, <00:20:15.586>close, <00:20:15.703>open, <00:20:15.820>close,

289
00:20:18.760 --> 00:20:21.040
<00:20:18.760>open, <00:20:18.960>close <00:20:19.160>all <00:20:19.360>the <00:20:19.560>time <00:20:19.760>I <00:20:19.960>see <00:20:20.160>it.

290
00:20:21.980 --> 00:20:25.800
<00:20:21.980>So <00:20:22.120>this <00:20:22.260>information <00:20:22.400>are <00:20:22.540>useless <00:20:22.680>for <00:20:22.820>attacker <00:20:22.960>and <00:20:23.100>that's <00:20:23.240>the <00:20:23.380>point.

291
00:20:29.010 --> 00:20:33.990
<00:20:29.010>How <00:20:29.137>many <00:20:29.264>of <00:20:29.391>you <00:20:29.519>can <00:20:29.646>say <00:20:29.773>in <00:20:29.900>full <00:20:30.028>mouth <00:20:30.155>that <00:20:30.282>your <00:20:30.410>database

292
00:20:34.870 --> 00:20:39.640
<00:20:34.870>actually <00:20:35.025>kept <00:20:35.181>the <00:20:35.336>historical <00:20:35.492>information <00:20:35.647>from <00:20:35.803>day <00:20:35.958>one <00:20:36.114>all <00:20:36.270>changes

293
00:20:39.970 --> 00:20:44.480
<00:20:39.970>until <00:20:40.110>now. <00:20:40.250>So <00:20:40.390>any <00:20:40.530>correction <00:20:40.670>of <00:20:40.810>the <00:20:40.950>phone <00:20:41.090>number, <00:20:41.230>last <00:20:41.370>name,

294
00:20:44.480 --> 00:20:46.360
<00:20:44.480>first <00:20:44.760>name, <00:20:45.040>any <00:20:45.320>kind <00:20:45.600>of <00:20:45.880>data

295
00:20:48.460 --> 00:20:52.830
<00:20:48.460>because <00:20:48.587>it's <00:20:48.714>actually <00:20:48.841>just <00:20:48.969>update <00:20:49.096>statement <00:20:49.223>for <00:20:49.350>the <00:20:49.478>SQL <00:20:49.605>server <00:20:49.732>or <00:20:49.860>other

296
00:20:53.720 --> 00:20:58.100
<00:20:53.720>MySQL <00:20:53.920>sql. <00:20:54.120>So <00:20:54.320>it's <00:20:54.520>update <00:20:54.720>new <00:20:54.920>last <00:20:55.120>name,

297
00:20:58.400 --> 00:21:01.060
<00:20:58.400>but <00:20:58.600>what <00:20:58.800>was <00:20:59.000>the <00:20:59.200>last <00:20:59.400>name <00:20:59.600>before <00:20:59.800>that?

298
00:21:01.970 --> 00:21:06.600
<00:21:01.970>Or <00:21:02.125>how <00:21:02.281>can <00:21:02.436>I <00:21:02.592>do <00:21:02.747>some <00:21:02.903>forensic <00:21:03.058>analysis <00:21:03.214>inside <00:21:03.370>this

299
00:21:06.770 --> 00:21:11.200
<00:21:06.770>audit <00:21:06.877>logs? <00:21:06.985>So <00:21:07.093>to <00:21:07.200>do <00:21:07.308>that <00:21:07.416>I <00:21:07.523>need <00:21:07.631>to <00:21:07.739>answer <00:21:07.846>on <00:21:07.954>who, <00:21:08.062>what <00:21:08.170>event.

300
00:21:11.420 --> 00:21:15.430
<00:21:11.420>So <00:21:11.595>there's <00:21:11.770>actually <00:21:11.945>really <00:21:12.120>cool <00:21:12.295>feature <00:21:12.470>on <00:21:12.645>database <00:21:12.820>market.

301
00:21:15.540 --> 00:21:17.510
<00:21:15.540>It's <00:21:16.006>called <00:21:16.473>temporal <00:21:16.940>databases.

302
00:21:17.870 --> 00:21:20.950
<00:21:17.870>Temporal <00:21:18.103>database <00:21:18.336>is <00:21:18.570>actually <00:21:18.803>was <00:21:19.036>the <00:21:19.270>research,

303
00:21:21.060 --> 00:21:25.270
<00:21:21.060>it's <00:21:21.215>called <00:21:21.371>immortal <00:21:21.526>DB <00:21:21.682>to <00:21:21.837>actually, <00:21:21.993>uh, <00:21:22.148>to <00:21:22.304>actually, <00:21:22.460>uh,

304
00:21:25.270 --> 00:21:30.110
<00:21:25.270>provide <00:21:25.445>you <00:21:25.620>that <00:21:25.795>historical <00:21:25.970>tables <00:21:26.145>beside <00:21:26.320>the <00:21:26.495>production <00:21:26.670>tables

305
00:21:30.180 --> 00:21:34.870
<00:21:30.180>that <00:21:30.296>actually <00:21:30.413>keep <00:21:30.530>the <00:21:30.646>information <00:21:30.763>all <00:21:30.880>the <00:21:30.996>time <00:21:31.113>of <00:21:31.230>the <00:21:31.346>changes <00:21:31.463>for <00:21:31.580>the

306
00:21:35.030 --> 00:21:39.670
<00:21:35.030>forensics, <00:21:35.146>for <00:21:35.263>the <00:21:35.379>audit <00:21:35.496>and <00:21:35.613>the <00:21:35.730>temper <00:21:35.846>proof <00:21:35.963>logs. <00:21:36.080>So <00:21:36.196>three <00:21:36.313>one <00:21:36.430>again,

307
00:21:40.310 --> 00:21:45.190
<00:21:40.310>forensics <00:21:40.510>audits <00:21:40.710>and <00:21:40.909>temper <00:21:41.110>proof <00:21:41.310>logs <00:21:41.510>inside <00:21:41.710>your

308
00:21:45.370 --> 00:21:46.203
system.

309
00:21:50.560 --> 00:21:52.880
<00:21:50.560>I <00:21:50.735>will <00:21:50.909>try <00:21:51.085>to <00:21:51.260>see <00:21:51.435>in <00:21:51.610>this <00:21:51.784>demo <00:21:51.960>also.

310
00:22:00.740 --> 00:22:03.900
<00:22:00.740>I <00:22:00.847>have <00:22:00.955>only <00:22:01.063>three <00:22:01.170>minutes <00:22:01.278>left, <00:22:01.386>I <00:22:01.493>believe <00:22:01.601>I <00:22:01.709>will <00:22:01.816>just <00:22:01.924>skip <00:22:02.032>this <00:22:02.140>demo,

311
00:22:04.000 --> 00:22:08.820
<00:22:04.000>but <00:22:04.100>this <00:22:04.200>presentation <00:22:04.300>will <00:22:04.400>be <00:22:04.500>on <00:22:04.600>the, <00:22:04.700>on <00:22:04.800>the, <00:22:04.900>on <00:22:05.000>the, <00:22:05.100>on <00:22:05.200>the <00:22:05.300>webpage. <00:22:05.400>The,

312
00:22:09.000 --> 00:22:11.620
<00:22:09.000>the <00:22:09.155>most <00:22:09.311>important <00:22:09.466>part <00:22:09.622>of <00:22:09.777>the <00:22:09.933>presentation <00:22:10.088>is <00:22:10.244>this <00:22:10.400>one.

313
00:22:12.480 --> 00:22:17.420
<00:22:12.480>So <00:22:12.620>you <00:22:12.760>need <00:22:12.900>to, <00:22:13.040>to <00:22:13.180>define <00:22:13.320>the <00:22:13.460>pen <00:22:13.600>test <00:22:13.740>on <00:22:13.880>the,

314
00:22:17.640 --> 00:22:22.180
<00:22:17.640>on <00:22:17.767>your <00:22:17.894>projects. <00:22:18.021>Doesn't <00:22:18.149>matter <00:22:18.276>how, <00:22:18.403>when <00:22:18.530>and <00:22:18.658>who <00:22:18.785>will <00:22:18.912>do <00:22:19.040>it,

315
00:22:22.770 --> 00:22:23.700
<00:22:22.770>just <00:22:23.188>do <00:22:23.607>it.

316
00:22:24.200 --> 00:22:28.660
<00:22:24.200>So <00:22:24.316>there's <00:22:24.433>a <00:22:24.550>many <00:22:24.666>things <00:22:24.783>on <00:22:24.900>the <00:22:25.016>menu <00:22:25.133>how <00:22:25.250>we <00:22:25.366>can <00:22:25.483>do <00:22:25.600>it.

317
00:22:29.430 --> 00:22:31.700
<00:22:29.430>Black <00:22:29.630>test, <00:22:29.830>black <00:22:30.030>box, <00:22:30.230>white <00:22:30.430>box, <00:22:30.630>red <00:22:30.830>box.

318
00:22:32.000 --> 00:22:36.420
<00:22:32.000>It <00:22:32.116>means <00:22:32.233>the <00:22:32.350>white <00:22:32.466>box <00:22:32.583>means <00:22:32.700>that <00:22:32.816>attacker <00:22:32.933>have <00:22:33.050>the <00:22:33.166>all <00:22:33.283>the <00:22:33.400>information,

319
00:22:36.600 --> 00:22:39.740
<00:22:36.600>source <00:22:36.833>code, <00:22:37.066>application <00:22:37.300>documentation <00:22:37.533>to <00:22:37.766>test <00:22:38.000>it.

320
00:22:40.330 --> 00:22:45.220
<00:22:40.330>Gray <00:22:40.457>mode <00:22:40.584>means <00:22:40.711>it's <00:22:40.839>only <00:22:40.966>had <00:22:41.093>the <00:22:41.220>user's <00:22:41.348>username <00:22:41.475>and <00:22:41.602>act <00:22:41.730>like

321
00:22:45.260 --> 00:22:49.220
<00:22:45.260>a <00:22:45.387>regular <00:22:45.514>user. <00:22:45.641>And <00:22:45.769>the <00:22:45.896>black <00:22:46.023>box <00:22:46.150>mean <00:22:46.278>I <00:22:46.405>don't <00:22:46.532>know <00:22:46.660>anything.

322
00:22:49.900 --> 00:22:53.340
<00:22:49.900>I <00:22:50.007>need <00:22:50.115>to <00:22:50.223>try <00:22:50.330>the <00:22:50.438>break <00:22:50.546>in <00:22:50.653>inside <00:22:50.761>the <00:22:50.869>black <00:22:50.976>box <00:22:51.084>to <00:22:51.192>pull <00:22:51.300>information

323
00:22:54.510 --> 00:22:55.840
<00:22:54.510>outside. <00:22:55.706>Uh,

324
00:22:56.430 --> 00:23:01.120
<00:22:56.430>also <00:22:56.585>ideal <00:22:56.741>scenario <00:22:56.896>is <00:22:57.052>to <00:22:57.207>have <00:22:57.363>the <00:22:57.518>internal <00:22:57.674>pen <00:22:57.830>testing

325
00:23:02.500 --> 00:23:03.720
<00:23:02.500>in <00:23:02.719>the <00:23:02.939>pen <00:23:03.158>from <00:23:03.378>the <00:23:03.598>team.

326
00:23:04.220 --> 00:23:09.160
<00:23:04.220>You <00:23:04.347>don't <00:23:04.474>need <00:23:04.601>pen <00:23:04.729>tester <00:23:04.856>inside <00:23:04.983>the <00:23:05.110>team <00:23:05.238>because <00:23:05.365>comfort <00:23:05.492>of <00:23:05.620>interest,

327
00:23:10.420 --> 00:23:12.960
<00:23:10.420>he <00:23:10.560>or <00:23:10.700>she <00:23:10.840>or <00:23:10.980>they <00:23:11.120>should <00:23:11.260>be <00:23:11.400>outside <00:23:11.540>of <00:23:11.680>the <00:23:11.820>team.

328
00:23:14.250 --> 00:23:18.220
<00:23:14.250>Also <00:23:14.405>try <00:23:14.561>to <00:23:14.716>verify <00:23:14.872>the <00:23:15.027>assess <00:23:15.183>with <00:23:15.338>external <00:23:15.494>pen <00:23:15.650>testing

329
00:23:19.740 --> 00:23:24.440
<00:23:19.740>to <00:23:19.847>see <00:23:19.955>are <00:23:20.063>are <00:23:20.170>open, <00:23:20.278>tested, <00:23:20.386>actually <00:23:20.493>going, <00:23:20.601>doing <00:23:20.709>the <00:23:20.816>good <00:23:20.924>and <00:23:21.032>great <00:23:21.140>job.

330
00:23:25.000 --> 00:23:29.640
<00:23:25.000>Actually <00:23:25.175>the <00:23:25.350>the <00:23:25.525>customers, <00:23:25.700>uh, <00:23:25.875>in <00:23:26.050>my <00:23:26.225>case <00:23:26.400>scenario,

331
00:23:29.830 --> 00:23:33.080
<00:23:29.830>they <00:23:30.030>always <00:23:30.230>try, <00:23:30.429>try <00:23:30.629>to <00:23:30.830>to <00:23:31.030>ask <00:23:31.230>us,

332
00:23:33.500 --> 00:23:37.000
<00:23:33.500>do <00:23:33.627>you <00:23:33.754>do <00:23:33.881>external <00:23:34.009>and <00:23:34.136>internal <00:23:34.263>pain <00:23:34.390>testing? <00:23:34.518>If <00:23:34.645>we <00:23:34.772>say <00:23:34.900>yes,

333
00:23:37.220 --> 00:23:42.100
<00:23:37.220>it <00:23:37.327>is <00:23:37.435>actually <00:23:37.543>is <00:23:37.650>a <00:23:37.758>running <00:23:37.866>scenario <00:23:37.973>to, <00:23:38.081>to <00:23:38.189>get <00:23:38.296>the <00:23:38.404>business. <00:23:38.512>The <00:23:38.620>baseline,

334
00:23:42.360 --> 00:23:44.780
<00:23:42.360>uh, <00:23:42.560>in <00:23:42.760>web <00:23:42.959>application <00:23:43.159>is <00:23:43.360>always <00:23:43.560>top <00:23:43.760>10

335
00:23:46.420 --> 00:23:50.610
<00:23:46.420>cross <00:23:46.575>as <00:23:46.731>15 <00:23:46.886>SQL <00:23:47.042>injection, <00:23:47.197>cookie <00:23:47.353>forgery, <00:23:47.508>name <00:23:47.664>it. <00:23:47.820>There's,

336
00:23:50.610 --> 00:23:54.490
<00:23:50.610>there's <00:23:50.737>10 <00:23:50.864>of <00:23:50.991>them <00:23:51.119>and <00:23:51.246>each <00:23:51.373>year <00:23:51.500>the <00:23:51.628>top <00:23:51.755>10 <00:23:51.882>is <00:23:52.010>changed,

337
00:23:55.310 --> 00:23:57.970
<00:23:55.310>but <00:23:55.450>they <00:23:55.590>are <00:23:55.730>all <00:23:55.870>the <00:23:56.010>same. <00:23:56.149>So <00:23:56.290>this <00:23:56.429>is <00:23:56.570>your <00:23:56.710>baseline.

338
00:23:58.630 --> 00:24:03.170
<00:23:58.630>Use <00:23:58.785>the <00:23:58.941>OS <00:23:59.096>Z <00:23:59.252>as <00:23:59.407>a <00:23:59.563>tool <00:23:59.718>blue <00:23:59.874>professional <00:24:00.030>or

339
00:24:03.360 --> 00:24:04.193
<00:24:03.360>Carl <00:24:04.109>Linux.

340
00:24:04.480 --> 00:24:09.450
<00:24:04.480>There's <00:24:04.573>a <00:24:04.666>bunch <00:24:04.760>of <00:24:04.853>tools <00:24:04.946>inside <00:24:05.040>the <00:24:05.133>Cali <00:24:05.226>that <00:24:05.320>actually <00:24:05.413>can <00:24:05.506>use <00:24:05.600>to <00:24:05.693>try <00:24:05.786>to <00:24:05.880>pen

341
00:24:09.450 --> 00:24:14.170
<00:24:09.450>test <00:24:09.577>your <00:24:09.704>application. <00:24:09.831>And <00:24:09.959>no, <00:24:10.086>it <00:24:10.213>means <00:24:10.340>pen <00:24:10.468>test <00:24:10.595>is <00:24:10.722>not <00:24:10.850>equal.

342
00:24:14.470 --> 00:24:19.050
<00:24:14.470>QA <00:24:14.670>q <00:24:14.870>quality <00:24:15.070>assurance <00:24:15.270>can <00:24:15.470>do <00:24:15.670>pen <00:24:15.870>testing

343
00:24:19.440 --> 00:24:23.970
<00:24:19.440>because <00:24:19.595>this <00:24:19.751>person <00:24:19.906>are <00:24:20.062>not <00:24:20.217>calibrated <00:24:20.373>to <00:24:20.528>think <00:24:20.684>like <00:24:20.840>attacker.

344
00:24:24.850 --> 00:24:29.630
<00:24:24.850>You <00:24:24.957>need <00:24:25.065>the <00:24:25.173>attacker <00:24:25.280>mode <00:24:25.388>to <00:24:25.496>actually <00:24:25.603>see <00:24:25.711>your <00:24:25.819>application <00:24:25.926>is <00:24:26.034>breakable <00:24:26.142>or <00:24:26.250>not.

345
00:24:30.010 --> 00:24:32.270
<00:24:30.010>And <00:24:30.243>believe <00:24:30.476>me, <00:24:30.710>they're <00:24:30.943>all <00:24:31.176>breakable <00:24:31.410>always.

346
00:24:34.870 --> 00:24:39.090
<00:24:34.870>And <00:24:35.103>the <00:24:35.336>last <00:24:35.570>30 <00:24:35.803>seconds <00:24:36.036>tips, <00:24:36.270>uh,

347
00:24:39.430 --> 00:24:43.210
<00:24:39.430>how <00:24:39.570>many <00:24:39.710>of <00:24:39.850>you <00:24:39.990>is <00:24:40.130>actually, <00:24:40.270>uh, <00:24:40.410>beside <00:24:40.550>your <00:24:40.690>company, <00:24:40.830>uh,

348
00:24:43.290 --> 00:24:48.150
<00:24:43.290>projects <00:24:43.465>Do <00:24:43.639>some <00:24:43.815>freelancing? <00:24:43.990>Come <00:24:44.165>on. <00:24:44.340>Come <00:24:44.514>on. <00:24:44.690>Yes,

349
00:24:48.230 --> 00:24:52.950
<00:24:48.230>I <00:24:48.323>know, <00:24:48.416>I <00:24:48.510>know. <00:24:48.603>Don't, <00:24:48.696>don't <00:24:48.790>be <00:24:48.883>shy, <00:24:48.976>but <00:24:49.070>how <00:24:49.163>many <00:24:49.256>of <00:24:49.350>you <00:24:49.443>is <00:24:49.536>actually <00:24:49.630>uh,

350
00:24:53.170 --> 00:24:54.750
<00:24:53.170>do <00:24:53.450>that <00:24:53.730>on <00:24:54.010>the <00:24:54.290>company <00:24:54.570>laptops.

351
00:24:58.210 --> 00:25:01.510
<00:24:58.210>So <00:24:58.365>don't <00:24:58.521>do <00:24:58.676>that. <00:24:58.832>Please <00:24:58.987>don't <00:24:59.143>do <00:24:59.298>that <00:24:59.454>because <00:24:59.610>uh,

352
00:25:01.510 --> 00:25:06.430
<00:25:01.510>there <00:25:01.626>is <00:25:01.743>a <00:25:01.860>lot <00:25:01.976>of <00:25:02.093>legal <00:25:02.210>issue <00:25:02.326>there <00:25:02.443>because <00:25:02.560>the <00:25:02.676>customer <00:25:02.793>can <00:25:02.910>sue

353
00:25:06.430 --> 00:25:10.010
<00:25:06.430>you <00:25:06.570>and <00:25:06.710>they <00:25:06.850>have <00:25:06.990>all <00:25:07.130>these <00:25:07.270>logs <00:25:07.410>to <00:25:07.550>actually <00:25:07.690>prove <00:25:07.830>that.

354
00:25:10.670 --> 00:25:13.010
<00:25:10.670>So <00:25:10.950>try <00:25:11.230>to <00:25:11.510>to <00:25:11.790>to <00:25:12.070>your,

355
00:25:13.070 --> 00:25:17.330
<00:25:13.070>to <00:25:13.197>do <00:25:13.324>your <00:25:13.451>freelancing <00:25:13.579>and <00:25:13.706>private <00:25:13.833>job <00:25:13.960>always <00:25:14.088>on <00:25:14.215>the <00:25:14.342>private <00:25:14.470>machine.

356
00:25:17.630 --> 00:25:21.240
<00:25:17.630>So <00:25:17.830>personally <00:25:18.030>me, <00:25:18.230>this <00:25:18.430>is <00:25:18.630>my <00:25:18.830>personal <00:25:19.030>laptop.

357
00:25:21.560 --> 00:25:25.840
<00:25:21.560>I <00:25:21.667>didn't <00:25:21.775>take <00:25:21.883>on <00:25:21.990>this <00:25:22.098>conference, <00:25:22.206>my <00:25:22.313>company <00:25:22.421>machine, <00:25:22.529>I <00:25:22.636>don't <00:25:22.744>need <00:25:22.852>it <00:25:22.960>here.

358
00:25:26.350 --> 00:25:27.800
<00:25:26.350>Just <00:25:27.655>listen.

359
00:25:28.140 --> 00:25:33.040
<00:25:28.140>And <00:25:28.267>I <00:25:28.394>don't <00:25:28.521>ac <00:25:28.649>access <00:25:28.776>any <00:25:28.903>resources <00:25:29.030>or <00:25:29.158>company <00:25:29.285>with <00:25:29.412>this <00:25:29.540>machine.

360
00:25:33.820 --> 00:25:38.120
<00:25:33.820>Why? <00:25:33.975>Because <00:25:34.131>I <00:25:34.286>know <00:25:34.442>if <00:25:34.597>I <00:25:34.753>install <00:25:34.908>something <00:25:35.064>here, <00:25:35.220>compromise.

361
00:25:38.500 --> 00:25:42.720
<00:25:38.500>That's <00:25:38.675>something <00:25:38.850>can <00:25:39.025>compromise <00:25:39.200>my <00:25:39.375>environment. <00:25:39.550>Simple <00:25:39.725>as <00:25:39.900>that.

362
00:25:44.920 --> 00:25:49.570
<00:25:44.920>And <00:25:45.153>time <00:25:45.386>for <00:25:45.620>a <00:25:45.853>question. <00:25:46.086>I'm <00:25:46.320>done.

363
00:25:56.900 --> 00:26:00.760
<00:25:56.900>And <00:25:57.000>can <00:25:57.100>I <00:25:57.200>do <00:25:57.300>some <00:25:57.400>selfie <00:25:57.500>with <00:25:57.600>you <00:25:57.700>please? <00:25:57.800>Thank <00:25:57.900>you. <00:25:58.000>Thank <00:25:58.100>you <00:25:58.200>very <00:25:58.300>much.

364
00:26:00.760 --> 00:26:01.593
<00:26:00.760>Thank <00:26:01.009>you <00:26:01.259>very <00:26:01.509>much.

365
00:26:05.470 --> 00:26:09.580
<00:26:05.470>Thank <00:26:05.586>you. <00:26:05.703>Thank <00:26:05.820>you <00:26:05.936>very <00:26:06.053>much. <00:26:06.170>Jasmine, <00:26:06.286>let's <00:26:06.403>not <00:26:06.520>break <00:26:06.636>the <00:26:06.753>stage. <00:26:06.870>Okay?

366
00:26:09.780 --> 00:26:14.140
<00:26:09.780>I <00:26:09.896>do <00:26:10.013>my <00:26:10.129>best. <00:26:10.246>Thank <00:26:10.363>you. <00:26:10.480>There <00:26:10.596>are <00:26:10.713>a <00:26:10.830>couple <00:26:10.946>of <00:26:11.063>question <00:26:11.180>Indeed.

367
00:26:14.560 --> 00:26:15.393
<00:26:14.560>One <00:26:14.934>A <00:26:15.309>is,

368
00:26:15.560 --> 00:26:19.940
<00:26:15.560>is <00:26:15.653>there <00:26:15.746>a <00:26:15.840>way <00:26:15.933>to <00:26:16.026>di <00:26:16.120>identify <00:26:16.213>if <00:26:16.306>an <00:26:16.399>open <00:26:16.493>source <00:26:16.586>library <00:26:16.679>I'm <00:26:16.773>using <00:26:16.866>is <00:26:16.960>vulnerable?

369
00:26:20.120 --> 00:26:22.100
<00:26:20.120>Yes, <00:26:20.353>yes. <00:26:20.586>Yeah, <00:26:20.820>there's <00:26:21.053>a <00:26:21.286>site. <00:26:21.520>Uh,

370
00:26:22.580 --> 00:26:25.260
<00:26:22.580>actually <00:26:22.754>the <00:26:22.929>follow <00:26:23.105>all <00:26:23.280>these <00:26:23.455>CV <00:26:23.629>vulnerabilities <00:26:23.804>or <00:26:23.980>the,

371
00:26:25.400 --> 00:26:27.740
<00:26:25.400>the <00:26:25.555>third <00:26:25.711>party <00:26:25.866>library, <00:26:26.022>just <00:26:26.177>the <00:26:26.333>follow <00:26:26.488>of <00:26:26.644>the <00:26:26.800>site.

372
00:26:28.490 --> 00:26:32.980
<00:26:28.490>Just <00:26:28.606>type <00:26:28.723>on <00:26:28.840>a <00:26:28.956>Google <00:26:29.073>how <00:26:29.190>to <00:26:29.306>find <00:26:29.423>the <00:26:29.540>third <00:26:29.656>party <00:26:29.773>library <00:26:29.890>security

373
00:26:32.980 --> 00:26:34.900
<00:26:32.980>vulnerability. <00:26:33.330>It's <00:26:33.680>the <00:26:34.030>first <00:26:34.380>one.

374
00:26:35.960 --> 00:26:40.730
<00:26:35.960>Just <00:26:36.067>subscribe <00:26:36.175>to <00:26:36.283>that <00:26:36.390>site <00:26:36.498>and <00:26:36.606>put <00:26:36.713>that <00:26:36.821>information <00:26:36.929>inside <00:26:37.036>your <00:26:37.144>SS <00:26:37.252>D <00:26:37.360>L

375
00:26:40.850 --> 00:26:42.970
<00:26:40.850>C <00:26:41.024>and <00:26:41.199>try <00:26:41.375>to <00:26:41.550>be <00:26:41.725>to <00:26:41.899>up <00:26:42.074>to <00:26:42.250>date,

376
00:26:43.530 --> 00:26:46.280
<00:26:43.530>which <00:26:43.685>is <00:26:43.841>the <00:26:43.996>best <00:26:44.152>environment <00:26:44.307>to <00:26:44.463>execute <00:26:44.618>a <00:26:44.774>pen <00:26:44.930>test.

377
00:26:46.660 --> 00:26:50.400
<00:26:46.660>Do <00:26:46.760>you <00:26:46.860>suggest <00:26:46.960>to <00:26:47.060>create <00:26:47.160>a <00:26:47.260>new <00:26:47.360>environment <00:26:47.460>just <00:26:47.560>for <00:26:47.660>executing <00:26:47.760>a <00:26:47.860>pen <00:26:47.960>test <00:26:48.060>board

378
00:26:50.400 --> 00:26:55.240
<00:26:50.400>professional. <00:26:50.555>So <00:26:50.711>period. <00:26:50.866>Done. <00:26:51.022>Okay, <00:26:51.177>last <00:26:51.333>one <00:26:51.488>on <00:26:51.644>the <00:26:51.800>fly,

379
00:26:55.380 --> 00:26:59.560
<00:26:55.380>you <00:26:55.480>say <00:26:55.580>that <00:26:55.680>the <00:26:55.780>responsibility <00:26:55.880>for <00:26:55.980>S <00:26:56.080>D <00:26:56.180>L <00:26:56.280>C <00:26:56.380>is <00:26:56.480>on <00:26:56.580>a <00:26:56.680>single <00:26:56.780>responsibility.

380
00:26:59.910 --> 00:27:00.600
<00:26:59.910>What <00:27:00.117>do <00:27:00.324>you <00:27:00.531>think?

381
00:27:00.600 --> 00:27:04.920
<00:27:00.600>This <00:27:00.716>is <00:27:00.833>not <00:27:00.949>on <00:27:01.066>the <00:27:01.183>team <00:27:01.300>educating <00:27:01.416>each <00:27:01.533>other <00:27:01.649>in <00:27:01.766>agile <00:27:01.883>l <00:27:02.000>methodology.

382
00:27:05.670 --> 00:27:08.360
<00:27:05.670>This <00:27:05.903>can't <00:27:06.136>work, <00:27:06.370>right? <00:27:06.603>It's <00:27:06.836>okay. <00:27:07.070>Uh,

383
00:27:08.460 --> 00:27:12.520
<00:27:08.460>you <00:27:08.567>need <00:27:08.675>to <00:27:08.783>have <00:27:08.890>the <00:27:08.998>security <00:27:09.106>awareness <00:27:09.213>in, <00:27:09.321>in <00:27:09.429>entire <00:27:09.536>team <00:27:09.644>by <00:27:09.752>specific <00:27:09.860>job.

384
00:27:12.990 --> 00:27:16.280
<00:27:12.990>That <00:27:13.117>job <00:27:13.244>task <00:27:13.371>need <00:27:13.499>to <00:27:13.626>be <00:27:13.753>done <00:27:13.880>by <00:27:14.008>professionals <00:27:14.135>as <00:27:14.262>your <00:27:14.390>job.

385
00:27:16.500 --> 00:27:21.200
<00:27:16.500>So <00:27:16.607>SS <00:27:16.715>D <00:27:16.823>L <00:27:16.930>C <00:27:17.038>can <00:27:17.146>be <00:27:17.253>do <00:27:17.361>by <00:27:17.469>QA <00:27:17.576>or <00:27:17.684>Agile <00:27:17.792>scrum <00:27:17.900>master.

386
00:27:21.420 --> 00:27:22.680
<00:27:21.420>You <00:27:21.646>need <00:27:21.873>to <00:27:22.100>be <00:27:22.327>by <00:27:22.554>developers.

387
00:27:22.900 --> 00:27:27.080
<00:27:22.900>So <00:27:23.000>the <00:27:23.100>security <00:27:23.200>you <00:27:23.300>need <00:27:23.400>to <00:27:23.500>have <00:27:23.600>the <00:27:23.700>person <00:27:23.800>actually <00:27:23.900>deal <00:27:24.000>with <00:27:24.100>security <00:27:24.200>on <00:27:24.300>their

388
00:27:27.180 --> 00:27:31.040
<00:27:27.180>own <00:27:27.296>terms. <00:27:27.413>Thank <00:27:27.530>you <00:27:27.646>very <00:27:27.763>much <00:27:27.880>guys <00:27:27.996>for <00:27:28.113>being <00:27:28.230>here <00:27:28.346>and <00:27:28.463>listening <00:27:28.580>around.

389
00:27:31.040 --> 00:27:31.800
<00:27:31.040>The <00:27:31.268>applause <00:27:31.495>for <00:27:31.724>Jasmine.