OWASP AppSec DC 2012/Access Control

Registration Now OPEN! | Hotel | Schedule | Convention Center | AppSecDC.org

The Presentation

Access Control is a necessary security control at almost every layer within a web application. This talk will discuss several of the key access control anti-patterns commonly found during website security audits. These access control anti-patterns include hard-coded security policies, lack of horizontal access control, and "fail open" access control mechanisms. In reviewing these and other access control anti-patters (problems), we will discuss and design a positive access control mechanism that is data contextual, activity based, configurable, flexible, and deny-by-default - among other positive design attributes that make up a robust web-based access-control mechanism.

The Speakers

Jim Manico

---

Gold Sponsors
Silver Sponsors
Small Business
Exhibitors