This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Netherlands April 10, 2013"
(Created page with "= April 10, 2013 = "In this Chapter meeting we will not REST until we have designed an access control mechanism to protect your web services..." ==Programme:== :18:30 - 19:15...") |
m |
||
| Line 18: | Line 18: | ||
deny-by-default - among other positive design attributes that make up a robust web-based | deny-by-default - among other positive design attributes that make up a robust web-based | ||
access-control mechanism. | access-control mechanism. | ||
| + | :[[Media:Owaspnl-jimmanico-toptendefensesv8.pdf | Download the presentation as PDF]] | ||
===RESTful web services, the web security blind spot=== | ===RESTful web services, the web security blind spot=== | ||
As a light weight alternative to web services, RESTful services are fast becoming a leading | As a light weight alternative to web services, RESTful services are fast becoming a leading | ||
| Line 29: | Line 30: | ||
and present novel approaches for automated testing of RESTful services using grey-box testing, a | and present novel approaches for automated testing of RESTful services using grey-box testing, a | ||
method combining a client attack tool and a server based monitor. | method combining a client attack tool and a server based monitor. | ||
| + | :[[Media:Owaspnl-oferschezaf-securitytestingforrestapplicationsv6april2013.pdf | Download the presentation as PDF]] | ||
| + | |||
==Speakers== | ==Speakers== | ||
===Jim Manico=== | ===Jim Manico=== | ||
Revision as of 09:04, 23 April 2013
April 10, 2013
"In this Chapter meeting we will not REST until we have designed an access control mechanism to protect your web services..."
Programme:
- 18:30 - 19:15 Registration & Pizza
- 19:15 - 20:00 “Access Control Design Best Practices” – Jim Manico
- 20:00 - 20:15 Break
- 20:15 - 21:00 “RESTful services, the web security blind spot” – Ofer Shezaf
- 21:00 - 21:30 Networking
Presentations:
Access Control Design Best Practices
Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control problems, we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.
RESTful web services, the web security blind spot
As a light weight alternative to web services, RESTful services are fast becoming a leading technology for developing mobile applications and web 2.0 sites. Upon first glance, RESTful services seem very different than web services and suspiciously similar to regular web technology. The similarity of RESTful services to regular web leads to the misconception that RESTful services are secured in the same way. However, RESTful services share many of the security risks of web services without the compensating Web Services security controls. The presentation will describe RESTful services and their use, the complexities in protecting them and common attack vectors that specific to REST services such as ULR embedded attacks. The presentation concludes with a discussion of the challenges of security testing for RESTful services and present novel approaches for automated testing of RESTful services using grey-box testing, a method combining a client attack tool and a server based monitor.
Speakers
Jim Manico
Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. He authors and delivers developer security awareness training for WhiteHat Security and has a background as a software developer and architect. Jim is also a global board member for the OWASP foundation. He manages and participates in several OWASP projects, including the OWASP cheat sheet series and the OWASP podcast series.
Ofer Shezaf
Ofer Shezaf is an internationally recognized application security expert. Ofer manages security solutions at HP ArcSight and prior to that managed web security research at HP Fortify and at Breach Security. Ofer is an OWASP (Open Web Application Security Project) leader, the founder of the OWASP Israeli chapter and a WASC (Web Application Security Consortium) officer. Ofer is leading the Web Application Firewall Evaluation criteria project and founded the ModSecurity core rule set project and the WASC web hacking incident database project. Ofer is blogging about the role and value of information security at www.xiom.com trying to separate myth and reality in the information security world.
