Add files using upload-large-folder tool

.gitattributes

@@ -578,3 +578,25 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 41[[:space:]]-[[:space:]]I18N[[:space:]]&[[:space:]]L10N/002[[:space:]]\[Part[[:space:]]2\][[:space:]]Localization[[:space:]]and[[:space:]]Internationalization.mp4 filter=lfs diff=lfs merge=lfs -text
 44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/001[[:space:]]Java[[:space:]]8[[:space:]]Features[[:space:]](Lambda,[[:space:]]Stream[[:space:]]API,[[:space:]]Optional,[[:space:]]Effectively[[:space:]]Final,[[:space:]]etc.).mp4 filter=lfs diff=lfs merge=lfs -text
 44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/002[[:space:]]Java[[:space:]]9[[:space:]]Stream[[:space:]]API[[:space:]]Updates,[[:space:]]Multi-Resolution[[:space:]]Image,[[:space:]]Stack-Walking[[:space:]]API,[[:space:]]etc.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/003[[:space:]]Java[[:space:]]9[[:space:]]Process[[:space:]]API[[:space:]]&[[:space:]]CompletableFuture[[:space:]]API[[:space:]]updates,[[:space:]]Interface[[:space:]]Private[[:space:]]Methods.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/004[[:space:]]Java[[:space:]]9[[:space:]]jlink[[:space:]]&[[:space:]]jshell.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/005[[:space:]]Java[[:space:]]9[[:space:]]Multi-Release[[:space:]]JAR[[:space:]]Files[[:space:]]&[[:space:]]Compact[[:space:]]Strings.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/006[[:space:]]Java[[:space:]]9[[:space:]]Deprecated[[:space:]]&[[:space:]]Removed[[:space:]]Features.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/007[[:space:]]Java[[:space:]]10[[:space:]]‘var’[[:space:]]variables[[:space:]](Type[[:space:]]inference),[[:space:]]Docker[[:space:]]support,[[:space:]]Flex[[:space:]]Heap[[:space:]]Size,[[:space:]]etc.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/008[[:space:]]Java[[:space:]]10[[:space:]]Other[[:space:]]improvements,[[:space:]]Removals,[[:space:]]Deprecations,[[:space:]]Release[[:space:]]Versioning.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/009[[:space:]]Java[[:space:]]11[[:space:]]LTS[[:space:]]Concept,[[:space:]]New[[:space:]]HTTP[[:space:]]Client,[[:space:]]String[[:space:]]&[[:space:]]Files[[:space:]]API[[:space:]]Updates.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/010[[:space:]]Java[[:space:]]11[[:space:]]Collection[[:space:]]&[[:space:]]Predicate[[:space:]]API[[:space:]]Updates,[[:space:]]Nest-Based[[:space:]]Access[[:space:]]Control[[:space:]]&[[:space:]]more.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/011[[:space:]]Java[[:space:]]12[[:space:]]CompactNumberFormat,[[:space:]]Teeing[[:space:]]Collector,[[:space:]]String.indent(),[[:space:]]transform().mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/012[[:space:]]Java[[:space:]]13[[:space:]]Socket[[:space:]]API,[[:space:]]newFileSystem()[[:space:]]method,[[:space:]]ZGC[[:space:]]Uncommit[[:space:]]Unused[[:space:]]Memory[[:space:]]&[[:space:]]others.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/013[[:space:]]Java[[:space:]]14[[:space:]]Switch[[:space:]]expressions,[[:space:]]Currency[[:space:]]Format,[[:space:]]Helpful[[:space:]]NullPointerExceptions.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/014[[:space:]]Java[[:space:]]15[[:space:]]Text[[:space:]]Blocks,[[:space:]]Hidden[[:space:]]Classes,[[:space:]]new[[:space:]]String[[:space:]]methods.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/015[[:space:]]Java[[:space:]]16[[:space:]]JEP[[:space:]]395[[:space:]]-[[:space:]]Records.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/016[[:space:]]Java[[:space:]]16[[:space:]]instanceof,[[:space:]]Day[[:space:]]Period[[:space:]]Support,[[:space:]]Stream.toList()[[:space:]]&[[:space:]]others.mp4 filter=lfs diff=lfs merge=lfs -text
+44[[:space:]]-[[:space:]]Java[[:space:]]New[[:space:]]Versions/017[[:space:]]Java[[:space:]]17[[:space:]]Sealed[[:space:]]Classes[[:space:]]&[[:space:]]other[[:space:]]improvements.mp4 filter=lfs diff=lfs merge=lfs -text
+46[[:space:]]-[[:space:]]Databases[[:space:]]Overview[[:space:]]and[[:space:]]Environment[[:space:]]Setup/003[[:space:]]Databases[[:space:]]Overview[[:space:]]-[[:space:]]Part[[:space:]]2.mp4 filter=lfs diff=lfs merge=lfs -text
+46[[:space:]]-[[:space:]]Databases[[:space:]]Overview[[:space:]]and[[:space:]]Environment[[:space:]]Setup/002[[:space:]]Databases[[:space:]]Overview[[:space:]]-[[:space:]]Part[[:space:]]1.mp4 filter=lfs diff=lfs merge=lfs -text
+46[[:space:]]-[[:space:]]Databases[[:space:]]Overview[[:space:]]and[[:space:]]Environment[[:space:]]Setup/004[[:space:]]MySQL[[:space:]]Overview[[:space:]]&[[:space:]]Installation[[:space:]](including[[:space:]]Workbench[[:space:]]Installation).mp4 filter=lfs diff=lfs merge=lfs -text
+46[[:space:]]-[[:space:]]Databases[[:space:]]Overview[[:space:]]and[[:space:]]Environment[[:space:]]Setup/005[[:space:]]PostgreSQL[[:space:]]Overview[[:space:]]&[[:space:]]Installation[[:space:]](including[[:space:]]pgAdmin[[:space:]]installation).mp4 filter=lfs diff=lfs merge=lfs -text
+47[[:space:]]-[[:space:]]Relational[[:space:]]databases/001[[:space:]]Relational[[:space:]]Databases[[:space:]]Basic[[:space:]]Concepts.mp4 filter=lfs diff=lfs merge=lfs -text
+47[[:space:]]-[[:space:]]Relational[[:space:]]databases/003[[:space:]]Referential[[:space:]]Integrity[[:space:]]Foreign[[:space:]]Key[[:space:]]Constraint[[:space:]]&[[:space:]]Cascading[[:space:]]Operations.mp4 filter=lfs diff=lfs merge=lfs -text
+47[[:space:]]-[[:space:]]Relational[[:space:]]databases/002[[:space:]]Create[[:space:]]Schema[[:space:]]&[[:space:]]Table[[:space:]]Naming,[[:space:]]Collation,[[:space:]]Engines,[[:space:]]Types,[[:space:]]Column[[:space:]]Properties.mp4 filter=lfs diff=lfs merge=lfs -text

44 - Java New Versions/003 Java 9 Process API & CompletableFuture API updates, Interface Private Methods.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e4a6f5a60db0c473bb07ea6f150b018f10a817bc39f2274d1d2b10627893689f
+size 190037559

44 - Java New Versions/004 Java 9 jlink & jshell.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5d65ceeacf578e842907c4e64a49a3b9faa929c7c8fcb89127fe7ffc8f9e747d
+size 109556625

44 - Java New Versions/005 Java 9 Multi-Release JAR Files & Compact Strings.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:eb0d88695c2696f6b24f652ec57ed5d43d5a7e97f196635ba6bf0e47d50d1f61
+size 114049987

44 - Java New Versions/006 Java 9 Deprecated & Removed Features.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8d6dfdb0f216c06f3b82d6d8a8b8beab4c2b36fec93c1773856de42ad5ce2021
+size 149756049

44 - Java New Versions/007 Java 10 ‘var’ variables (Type inference), Docker support, Flex Heap Size, etc.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d604ce842d6389b7e5b293ca93f795d1bd954ca64b8aed76941499261c241b26
+size 183944826

44 - Java New Versions/008 Java 10 Other improvements, Removals, Deprecations, Release Versioning.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:937eef812d9aebe96580bb6bac9dfc7de70758b1c255eab612146463ac000a0a
+size 215953252

44 - Java New Versions/009 Java 11 LTS Concept, New HTTP Client, String & Files API Updates.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d75d5c190b770faa7bcc8b6f6b7515ece90f0a3fa3bdfb97b5f5915bac05dac8
+size 376262556

44 - Java New Versions/010 Java 11 Collection & Predicate API Updates, Nest-Based Access Control & more.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0b69f59588dff616512d36849dbac9a1952f6a8ffda87df97170074a630ac195
+size 270387280

44 - Java New Versions/011 Java 12 CompactNumberFormat, Teeing Collector, String.indent(), transform().mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8be71d65fe99631fff2febb0e59b4233058bc61df04549a855fd7651ebc1ec56
+size 378294951

44 - Java New Versions/012 Java 13 Socket API, newFileSystem() method, ZGC Uncommit Unused Memory & others.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b07a6b597fe4c169ec2f80e9ac575ea22f3efb2046802b2e45c0cf431707b3c3
+size 234783920

44 - Java New Versions/013 Java 14 Switch expressions, Currency Format, Helpful NullPointerExceptions.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f9bd5f740f36bc5a6f5ea4050c4df1069f23b99c07b4555905c218a6fe61f3d7
+size 260905623

44 - Java New Versions/014 Java 15 Text Blocks, Hidden Classes, new String methods.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:bfaa3c54776e688bb22431cf1f18213a0eb5c4eb0afa6e0be4f6394c6c003aeb
+size 339932181

44 - Java New Versions/015 Java 16 JEP 395 - Records.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:afbaca8ee84b1e10aab1dd9b1fb759103114240d39c6c03b51d160f31cae53e9
+size 281735994

44 - Java New Versions/016 Java 16 instanceof, Day Period Support, Stream.toList() & others.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:40dfd8226d9d034455c26e4f381352ffeebfa138ec7c6042896511a28b9e59d0
+size 263540069

44 - Java New Versions/017 Java 17 Sealed Classes & other improvements.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:454bc8ba622d61f059be4f9a524eb20bd183e1176cd25fef8af78327641e4876
+size 317087204

46 - Databases Overview and Environment Setup/002 Databases Overview - Part 1.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:94f2d2ab374d0d0cc99230f46de93835ed018745a8c5ab2fd6a15fab4fc2528a
+size 185731700

46 - Databases Overview and Environment Setup/003 Databases Overview - Part 2.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:dbf79bc5e381f02eb7f93b125469491268abaa00f94b1308dc4dac7a5b86d4b4
+size 164078558

46 - Databases Overview and Environment Setup/004 MySQL Overview & Installation (including Workbench Installation).mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0aa48bb177231ad8706997087ecf71e57df36906277c16950c5739f710ef1927
+size 170355725

46 - Databases Overview and Environment Setup/005 PostgreSQL Overview & Installation (including pgAdmin installation).mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fc231471841a6af2adff6d6a6281d7bae55eba95ae556b6cecaa471bd8f30ff4
+size 138627682

47 - Relational databases/001 Relational Databases Basic Concepts.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0ed540f7cef5f519d455ae9f177a17bd3a0b90d568db7e6a0ed3c4c3496f63e8
+size 107397197

47 - Relational databases/002 Create Schema & Table Naming, Collation, Engines, Types, Column Properties.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d300c2247fe7c9caa494a4fd84e4160576879d71c71d3cdc05bda0e4e44b83c7
+size 367026479

47 - Relational databases/003 Referential Integrity Foreign Key Constraint & Cascading Operations.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1ce67f983efbb0af21246e46939abf9fed77acc1cc048357e2079bd8e6410f01
+size 242455530

73 - OWASP Top 10 2021/005 Source-code-examples-from-the-lesson.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/AndriiPiatakha/java-learnit-web-online-store/tree/master/online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/cf

73 - OWASP Top 10 2021/006 Injection (Overview, Fuzzing, CWEs, Impact, Injection Types, Command Injection)_en.srt

@@ -0,0 +1,788 @@
+1
+00:00:06,000 --> 00:00:06,000
+Hello.
+
+2
+00:00:06,000 --> 00:00:06,000
+Yes.
+
+3
+00:00:07,000 --> 00:00:10,000
+In this lesson, we're going to learn the following risk category.
+
+4
+00:00:10,000 --> 00:00:12,000
+This is called injection.
+
+5
+00:00:12,000 --> 00:00:17,000
+We're going to start this lesson from the general overview of injection waste category.
+
+6
+00:00:17,000 --> 00:00:24,000
+I will also share with you not a common weakness enumerations that are associated with this risk category.
+
+7
+00:00:25,000 --> 00:00:31,000
+To help you understand why injection risk category is important, we will discuss potential impacts
+
+8
+00:00:32,000 --> 00:00:34,000
+that may be caused by vulnerabilities problems.
+
+9
+00:00:34,000 --> 00:00:43,000
+This risk category will compare risk category from our last top ten 2021 was top ten 2017.
+
+10
+00:00:43,000 --> 00:00:49,000
+After that, we're going to start a review of different types of injections, namely, we're going to
+
+11
+00:00:49,000 --> 00:00:54,000
+talk about common injection, cross-site scripting, and it's different types.
+
+12
+00:00:54,000 --> 00:01:03,000
+SQL injection injection, no SQL injection, simple pass injection and block injection.
+
+13
+00:01:03,000 --> 00:01:05,000
+We're going to have a lot of examples.
+
+14
+00:01:06,000 --> 00:01:10,000
+I will share with you how to prevent each specific type of injection.
+
+15
+00:01:10,000 --> 00:01:16,000
+And as and those are some we're going to summarize the common rules and guidelines that is recommended
+
+16
+00:01:16,000 --> 00:01:24,000
+to follow to prevent injection vulnerabilities and also will input validation goals and different input
+
+17
+00:01:24,000 --> 00:01:25,000
+validation strategies.
+
+18
+00:01:26,000 --> 00:01:27,000
+Let's start our lesson.
+
+19
+00:01:28,000 --> 00:01:35,000
+Injections are one of the most common vulnerabilities in applications, depending on what environment
+
+20
+00:01:35,000 --> 00:01:36,000
+and the utilities you use.
+
+21
+00:01:37,000 --> 00:01:39,000
+That can be a variety of injection flaws.
+
+22
+00:01:40,000 --> 00:01:45,000
+Among these types, common injection is one of the most dangerous.
+
+23
+00:01:45,000 --> 00:01:49,000
+Some of the most common injections are sequel no.
+
+24
+00:01:49,000 --> 00:01:57,000
+Sequel, operating system, common objects, relational mapping or forum l dub and expression, language
+
+25
+00:01:57,000 --> 00:02:00,000
+or object graph navigation library injection.
+
+26
+00:02:01,000 --> 00:02:06,000
+The concept is identical among all interpreter's source code reviews.
+
+27
+00:02:06,000 --> 00:02:15,000
+The best massive of detecting applications are vulnerable to injections, automated testing of all parameters
+
+28
+00:02:15,000 --> 00:02:18,000
+headers euro cookies jigsaw.
+
+29
+00:02:18,000 --> 00:02:22,000
+So an excellent data input is strongly encouraged.
+
+30
+00:02:23,000 --> 00:02:30,000
+Organizations can include static, dynamic and interactive application security testing those in the
+
+31
+00:02:30,000 --> 00:02:36,000
+CIC pipeline to identify introduce injection flaws before production deployment.
+
+32
+00:02:37,000 --> 00:02:45,000
+An application is vulnerable to attack when user supplied data is not part of the filter or sanitized
+
+33
+00:02:45,000 --> 00:02:46,000
+by the application.
+
+34
+00:02:47,000 --> 00:02:53,000
+Dynamic queries on non parameterized calls without context over escape and are used directly in the
+
+35
+00:02:53,000 --> 00:02:54,000
+interpreter.
+
+36
+00:02:55,000 --> 00:02:58,000
+Hostile data is used within an object.
+
+37
+00:02:58,000 --> 00:03:07,000
+Relational mapping from such parameters to extract additional sensitive rack or hostile data is directly
+
+38
+00:03:07,000 --> 00:03:08,000
+used or concatenated.
+
+39
+00:03:09,000 --> 00:03:16,000
+This equal or common contains distraction and malicious data in dynamic queries, come ons or stored
+
+40
+00:03:16,000 --> 00:03:17,000
+procedures.
+
+41
+00:03:17,000 --> 00:03:22,000
+Injection flaws are very prevalent, particularly in legacy code.
+
+42
+00:03:23,000 --> 00:03:29,000
+Injection vulnerabilities are often found in sequel s pass on those sequel queries.
+
+43
+00:03:29,000 --> 00:03:37,000
+Operating system commands, x amount passes, SMTP gathers expression, languages and forum queries.
+
+44
+00:03:38,000 --> 00:03:46,000
+Injection flows easy to discover Excel money code scanners and those can help attackers find injection
+
+45
+00:03:46,000 --> 00:03:46,000
+flows.
+
+46
+00:03:47,000 --> 00:03:55,000
+What forces are opposed is a program which injects automatically some random data into programs that
+
+47
+00:03:55,000 --> 00:03:57,000
+detect box.
+
+48
+00:03:57,000 --> 00:04:06,000
+The data generation path is made of generators and the ability ID relies on the blogging tools in programming
+
+49
+00:04:06,000 --> 00:04:07,000
+and software development.
+
+50
+00:04:08,000 --> 00:04:16,000
+OSI Foster is an automated software testing technique that involves providing invalid, unexpected or
+
+51
+00:04:16,000 --> 00:04:19,000
+random data as equals to a computer program.
+
+52
+00:04:20,000 --> 00:04:27,000
+Almost any source of data can be an injection vector environment variables, parameters, external and
+
+53
+00:04:27,000 --> 00:04:30,000
+internal web services and all types of users.
+
+54
+00:04:31,000 --> 00:04:37,000
+Injection flows at zero one in that target can send hostile data to an interpreter.
+
+55
+00:04:37,000 --> 00:04:49,000
+Multiple common weakness enumerations included CW E 79 Cross-Site Scripting, CW 89 SQL Injection and
+
+56
+00:04:49,000 --> 00:04:54,000
+CW 73 External control of file name of POS.
+
+57
+00:04:55,000 --> 00:05:01,000
+Why is this lasting is important and why we should know about injection and be very attentive while
+
+58
+00:05:01,000 --> 00:05:03,000
+creating our software.
+
+59
+00:05:03,000 --> 00:05:08,000
+Let's learn what the potential impact can be done by different types of injections.
+
+60
+00:05:09,000 --> 00:05:15,000
+The injection can result in data loss, corruption or disclosure to unauthorized parties.
+
+61
+00:05:16,000 --> 00:05:23,000
+A loss of accountability or denial of access injection can sometimes make the company post takeover.
+
+62
+00:05:24,000 --> 00:05:28,000
+The business impact depends on the needs of the application and data.
+
+63
+00:05:29,000 --> 00:05:36,000
+The impact of command injection can range from stealing data, changing system configurations or even
+
+64
+00:05:36,000 --> 00:05:38,000
+bringing the whole system down.
+
+65
+00:05:38,000 --> 00:05:45,000
+Malicious actors sometimes use command injection to create security weaknesses in the system and then
+
+66
+00:05:45,000 --> 00:05:48,000
+exports and create its weaknesses.
+
+67
+00:05:48,000 --> 00:05:55,000
+A successful injection can also provide attackers with unauthorized access to the database, allowing
+
+68
+00:05:56,000 --> 00:06:04,000
+them to exit mine tables with critical information from them and even acquire administrator access.
+
+69
+00:06:04,000 --> 00:06:09,000
+Let's compare now injection some of us 2021 and 2017.
+
+70
+00:06:10,000 --> 00:06:17,000
+Injections are attacks in which an attacker attempts to send data to a web application to execute thousands
+
+71
+00:06:17,000 --> 00:06:25,000
+of the application was not actually designed to do this can be injection windows is such a cycle operating
+
+72
+00:06:25,000 --> 00:06:34,000
+system or injections is in your top 10.21 update also contains the vulnerability cross-site scripting
+
+73
+00:06:34,000 --> 00:06:38,000
+because this vulnerability is a principle also an injection.
+
+74
+00:06:39,000 --> 00:06:48,000
+Probably this is a key difference if we compare injection in our last top ten 2017 and the top ten 2021.
+
+75
+00:06:49,000 --> 00:06:51,000
+There are different injection types.
+
+76
+00:06:51,000 --> 00:06:52,000
+That's loans them.
+
+77
+00:06:53,000 --> 00:06:56,000
+They are operating system common injection.
+
+78
+00:06:57,000 --> 00:07:02,000
+Even despite in my subjective opinions, this injection is not very popular nowadays.
+
+79
+00:07:02,000 --> 00:07:05,000
+I believe it is still worse to consider because of us.
+
+80
+00:07:05,000 --> 00:07:08,000
+Puts a stress on this type of injection.
+
+81
+00:07:08,000 --> 00:07:16,000
+Based on the statistics, based on my experience and the audits that I do on other software projects
+
+82
+00:07:16,000 --> 00:07:23,000
+and during my consultancy practice, I don't observe a lot of cases applications using the command line
+
+83
+00:07:23,000 --> 00:07:29,000
+directly from the application and expose an API of interaction that was common line.
+
+84
+00:07:29,000 --> 00:07:33,000
+But still, each of us highlights this type of threat.
+
+85
+00:07:33,000 --> 00:07:37,000
+I believe this verse to consider cross-site scripting.
+
+86
+00:07:38,000 --> 00:07:45,000
+This group is also known as the excess SAS injection or otherwise cross-site scripting injection.
+
+87
+00:07:46,000 --> 00:07:52,000
+In my opinion, this is a very interesting type of injection and even nowadays very popular.
+
+88
+00:07:53,000 --> 00:07:59,000
+There are a lot of cases with confirmation of this kind of attacks submitted in cryptocurrency industry.
+
+89
+00:07:59,000 --> 00:08:06,000
+And not only is there a lot of startups, is it a bother it was released in their products as soon as
+
+90
+00:08:06,000 --> 00:08:06,000
+possible.
+
+91
+00:08:07,000 --> 00:08:11,000
+Just ignores the potential risk of cross-site scripting injection.
+
+92
+00:08:12,000 --> 00:08:17,000
+That's why I'd love to draw your extra attention to this category, and we're going to have a lot of
+
+93
+00:08:17,000 --> 00:08:19,000
+examples to discuss.
+
+94
+00:08:19,000 --> 00:08:21,000
+SQL Injection.
+
+95
+00:08:21,000 --> 00:08:29,000
+Injection, no SQL injection like symmetric injection and injection.
+
+96
+00:08:30,000 --> 00:08:33,000
+Let's review these different types of injection wells.
+
+97
+00:08:33,000 --> 00:08:33,000
+Examples.
+
+98
+00:08:34,000 --> 00:08:37,000
+Let's start from the operating system.
+
+99
+00:08:37,000 --> 00:08:38,000
+Come on, injection.
+
+100
+00:08:38,000 --> 00:08:40,000
+Let's understand first.
+
+101
+00:08:40,000 --> 00:08:41,000
+What is it?
+
+102
+00:08:41,000 --> 00:08:42,000
+Come on.
+
+103
+00:08:42,000 --> 00:08:49,000
+Injection is a technique where malicious actor tries to execute the operating system commands on the
+
+104
+00:08:49,000 --> 00:08:51,000
+system person's application.
+
+105
+00:08:51,000 --> 00:08:54,000
+User input is used to execute these commands.
+
+106
+00:08:55,000 --> 00:09:02,000
+For example, a task can execute commands to show a list of files in some directories on the server
+
+107
+00:09:02,000 --> 00:09:02,000
+side.
+
+108
+00:09:03,000 --> 00:09:10,000
+Also, AutoCAD can execute some scripts that will operate in a system like that, using some critical
+
+109
+00:09:10,000 --> 00:09:16,000
+files for a common injection attack to work, the application should make three main conditions.
+
+110
+00:09:17,000 --> 00:09:23,000
+The first one is application should have privileges, permissions to execute system commands.
+
+111
+00:09:24,000 --> 00:09:30,000
+The second, the application should use user provided data as a parts of system commands.
+
+112
+00:09:30,000 --> 00:09:37,000
+And this is a user provided data and should not be escape sanitized before use.
+
+113
+00:09:37,000 --> 00:09:44,000
+If your application meets these conditions, then there's pretty good chance its application is vulnerable
+
+114
+00:09:44,000 --> 00:09:46,000
+to common injections.
+
+115
+00:09:46,000 --> 00:09:48,000
+You can't always trust the user.
+
+116
+00:09:49,000 --> 00:09:52,000
+Let's review an example now to understand it better.
+
+117
+00:09:53,000 --> 00:10:00,000
+Let's imagine that we are, Sarah, that allow us to check the content of the folder that is associated
+
+118
+00:10:00,000 --> 00:10:01,000
+with some sort of category.
+
+119
+00:10:02,000 --> 00:10:06,000
+When I can post product category to get the content of that folder.
+
+120
+00:10:07,000 --> 00:10:08,000
+I opened the browser.
+
+121
+00:10:09,000 --> 00:10:11,000
+I have my web server up and running.
+
+122
+00:10:11,000 --> 00:10:14,000
+I call my service page with product category parameter.
+
+123
+00:10:14,000 --> 00:10:19,000
+It is equal to laptops when I submit this query.
+
+124
+00:10:19,000 --> 00:10:21,000
+Then I see a list of the folder.
+
+125
+00:10:21,000 --> 00:10:23,000
+It is not critically important.
+
+126
+00:10:24,000 --> 00:10:30,000
+The main thing is that this thing that does what I expect it to do, my application has permissions
+
+127
+00:10:30,000 --> 00:10:37,000
+to execute system commands and application uses provided by user data as it was of system.
+
+128
+00:10:37,000 --> 00:10:38,000
+Come on.
+
+129
+00:10:38,000 --> 00:10:41,000
+And we don't verify them in any way.
+
+130
+00:10:41,000 --> 00:10:44,000
+And what if I would execute the following command?
+
+131
+00:10:45,000 --> 00:10:48,000
+I will slightly adjust the value of the parameter cost.
+
+132
+00:10:49,000 --> 00:10:54,000
+I will pass ampersand IP config instead of ampersand.
+
+133
+00:10:54,000 --> 00:10:56,000
+I use person sun 26.
+
+134
+00:10:57,000 --> 00:11:04,000
+I keep ampersand character because otherwise it will be treated as query string parameters separate
+
+135
+00:11:04,000 --> 00:11:04,000
+them.
+
+136
+00:11:04,000 --> 00:11:06,000
+And you see now what is here.
+
+137
+00:11:07,000 --> 00:11:09,000
+Don't pay attention to question marks.
+
+138
+00:11:10,000 --> 00:11:13,000
+I wasn't bother too much was encoding for this example.
+
+139
+00:11:13,000 --> 00:11:19,000
+The main thing is that I managed to get IP address by executing IP config.
+
+140
+00:11:19,000 --> 00:11:22,000
+Command is a command line of my server.
+
+141
+00:11:22,000 --> 00:11:25,000
+But what if I would execute something more dangerous?
+
+142
+00:11:26,000 --> 00:11:33,000
+Not as simple and harmless as chrome on the known IP address was a help of ampersand.
+
+143
+00:11:33,000 --> 00:11:36,000
+I can pass another command to be executed.
+
+144
+00:11:36,000 --> 00:11:39,000
+That is how command injection works.
+
+145
+00:11:39,000 --> 00:11:41,000
+Let me show you the source code.
+
+146
+00:11:42,000 --> 00:11:42,000
+All source code.
+
+147
+00:11:42,000 --> 00:11:46,000
+For this lesson you will be able to find in attachments to the video.
+
+148
+00:11:46,000 --> 00:11:48,000
+I created separate packages.
+
+149
+00:11:48,000 --> 00:11:49,000
+It is called I.
+
+150
+00:11:50,000 --> 00:11:52,000
+I stands for injection.
+
+151
+00:11:52,000 --> 00:11:59,000
+You can see how I built the past as a directory and the reads parameter passed to the of that.
+
+152
+00:11:59,000 --> 00:12:05,000
+But I don't need any validations to validate that the input parameters will not harm my system.
+
+153
+00:12:06,000 --> 00:12:11,000
+I get runtime time and executes a command in case pass was found.
+
+154
+00:12:11,000 --> 00:12:16,000
+We print the content of directory in case pass is invalid.
+
+155
+00:12:16,000 --> 00:12:22,000
+We enter catch block and as you can see, my query parameter is not validated.
+
+156
+00:12:23,000 --> 00:12:25,000
+I just concatenated execute this.
+
+157
+00:12:25,000 --> 00:12:26,000
+Come on.
+
+158
+00:12:27,000 --> 00:12:30,000
+And what shall we do in this case to eliminate this ability?
+
+159
+00:12:31,000 --> 00:12:35,000
+There is no master key to prevent common transactions.
+
+160
+00:12:35,000 --> 00:12:41,000
+It means is that you can just implement one soon and expect to be secure.
+
+161
+00:12:41,000 --> 00:12:47,000
+You need to add multiple layers of security when it comes to security.
+
+162
+00:12:47,000 --> 00:12:48,000
+Is a more z matter?
+
+163
+00:12:49,000 --> 00:12:52,000
+So here are some common uses for prevention methods.
+
+164
+00:12:53,000 --> 00:12:55,000
+The first one is the most simple one.
+
+165
+00:12:56,000 --> 00:13:01,000
+If you are not using system commands that common injections are not possible.
+
+166
+00:13:02,000 --> 00:13:09,000
+The second solution is to substitute common line operations with using some library, for example.
+
+167
+00:13:09,000 --> 00:13:13,000
+In this particular case, why should we use common line?
+
+168
+00:13:13,000 --> 00:13:17,000
+Why don't we use file across Java from Java IO package?
+
+169
+00:13:18,000 --> 00:13:20,000
+Always ask yourself.
+
+170
+00:13:20,000 --> 00:13:24,000
+They used to use command line to execute operations.
+
+171
+00:13:24,000 --> 00:13:28,000
+You need all you have, I think to perform required actions in another way.
+
+172
+00:13:29,000 --> 00:13:33,000
+Another solution might be additional verifications you can validate.
+
+173
+00:13:34,000 --> 00:13:38,000
+You must keep all special characters and leave on the text.
+
+174
+00:13:39,000 --> 00:13:43,000
+The next solution would be implementation of principle of this privilege.
+
+175
+00:13:43,000 --> 00:13:47,000
+Well, you talked about it in our previous classes.
+
+176
+00:13:48,000 --> 00:13:54,000
+The principle of this process is that you should give an entity the least amount of privilege necessary,
+
+177
+00:13:55,000 --> 00:13:57,000
+just enough to do what's needed.
+
+178
+00:13:57,000 --> 00:14:04,000
+For example, if the application or user needs access to just one folder, give access to only that
+
+179
+00:14:04,000 --> 00:14:05,000
+folder.
+
+180
+00:14:06,000 --> 00:14:10,000
+Given the operations of superuser privileges is not at all smart.
+
+181
+00:14:11,000 --> 00:14:13,000
+Implement this principle everywhere.
+
+182
+00:14:14,000 --> 00:14:20,000
+You could also create a separate user for the application and you've only required permissions to zap
+
+183
+00:14:20,000 --> 00:14:20,000
+user.
+
+184
+00:14:21,000 --> 00:14:23,000
+This might not be feasible everywhere.
+
+185
+00:14:24,000 --> 00:14:31,000
+It depends on the use case, but you should consider prepare to allow based on the denialist seamless
+
+186
+00:14:31,000 --> 00:14:35,000
+solution we reviewed in our broken access control lesson.
+
+187
+00:14:35,000 --> 00:14:37,000
+We implemented safely.
+
+188
+00:14:37,000 --> 00:14:40,000
+In that lesson, the principle is very similar.
+
+189
+00:14:41,000 --> 00:14:46,000
+That's why I don't believe that I need to repeat myself and create similar examples.
+
+190
+00:14:47,000 --> 00:14:53,000
+If you know what comments must be used, what commands must not be used, you could allow blocks out.
+
+191
+00:14:54,000 --> 00:15:00,000
+If your application needs to execute only one command, then you could use logic.
+
+192
+00:15:00,000 --> 00:15:01,000
+Caps.
+
+193
+00:15:01,000 --> 00:15:05,000
+Is a command being sent to the coming line for execution?
+
+194
+00:15:05,000 --> 00:15:09,000
+Is that one command you intend to execute?
+
+195
+00:15:09,000 --> 00:15:12,000
+You can implement this with single statement.
+
+196
+00:15:13,000 --> 00:15:17,000
+That's all what I wanted to show you regarding the comment in Jackson.
+
+197
+00:15:17,000 --> 00:15:18,000
+That's my one.
+

73 - OWASP Top 10 2021/006 Source-code-examples-from-the-lesson.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/AndriiPiatakha/java-learnit-web-online-store/tree/master/online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/i/problem

73 - OWASP Top 10 2021/007 Injection (Cross Site Scripting, Types of XSS, SQL, JPA, NoSQL Injections)_en.srt

@@ -0,0 +1,740 @@
+1
+00:00:02,000 --> 00:00:04,000
+Let's learn now cross-site scripting.
+
+2
+00:00:05,000 --> 00:00:10,000
+So let's learn first what it is and why we shouldn't advisor about this at all.
+
+3
+00:00:11,000 --> 00:00:18,000
+Cross-Site scripting is an attack performed on vulnerable web applications that manipulates the app
+
+4
+00:00:18,000 --> 00:00:20,000
+to send malicious scripts to users.
+
+5
+00:00:21,000 --> 00:00:25,000
+In short, an attacker injects malicious script into a website.
+
+6
+00:00:26,000 --> 00:00:28,000
+The impact can be different.
+
+7
+00:00:28,000 --> 00:00:37,000
+For example, attacker wants to access personal data of other users, controls a browser or in severe
+
+8
+00:00:37,000 --> 00:00:40,000
+cases, controls the application itself.
+
+9
+00:00:41,000 --> 00:00:45,000
+Cross-Site scripting attacks consist from two parts.
+
+10
+00:00:45,000 --> 00:00:47,000
+Initialization of the attack.
+
+11
+00:00:48,000 --> 00:00:55,000
+The attacker sends the most often a malicious script through a trusted source and web application,
+
+12
+00:00:55,000 --> 00:00:57,000
+like a text field or a URL.
+
+13
+00:00:58,000 --> 00:01:01,000
+Execution of an attack is the second part.
+
+14
+00:01:02,000 --> 00:01:09,000
+The data is received by an unsuspecting user without being followed data as the user opens and executes.
+
+15
+00:01:11,000 --> 00:01:15,000
+Cross-Site scripting attacks are typically written as JavaScript segments.
+
+16
+00:01:16,000 --> 00:01:22,000
+Even something as simple as can be manipulated by attackers, if not handled properly.
+
+17
+00:01:23,000 --> 00:01:26,000
+There are different types of cross-site scripting attacks.
+
+18
+00:01:26,000 --> 00:01:35,000
+The CIA reflected the excess attacks, persistent excess attacks and DOM based excess attacks.
+
+19
+00:01:36,000 --> 00:01:44,000
+Let us briefly review each of these types reflects the excess attacks, also known as non persistent.
+
+20
+00:01:44,000 --> 00:01:49,000
+The excess attacks are considered to be the simplest form of exercise.
+
+21
+00:01:50,000 --> 00:01:57,000
+In these attacks, an attacker poses a malicious script query, which is typically within a euro.
+
+22
+00:01:57,000 --> 00:02:05,000
+Basically, attacker puts JavaScript into zero and the attacker makes a victim to create a euro.
+
+23
+00:02:06,000 --> 00:02:10,000
+This can be done with the help of social engineering techniques.
+
+24
+00:02:11,000 --> 00:02:18,000
+For example, some email was hyper reference or random link on forums or in common somewhere.
+
+25
+00:02:18,000 --> 00:02:25,000
+The main issue here is to make victims click on the euro to execute the malicious script in.
+
+26
+00:02:26,000 --> 00:02:31,000
+In a few minutes I am going to show you an example of a a6's attack.
+
+27
+00:02:32,000 --> 00:02:34,000
+Persistent access attacks.
+
+28
+00:02:34,000 --> 00:02:37,000
+Also known as Thor, the excess SAS attacks.
+
+29
+00:02:38,000 --> 00:02:47,000
+Q Or when an attacker identifies ability in a web application that allows for script injection, the
+
+30
+00:02:47,000 --> 00:02:54,000
+attacker is able to inject a malicious create into verification to make it executed each time.
+
+31
+00:02:54,000 --> 00:02:57,000
+One The victim is open of that page of an application.
+
+32
+00:02:58,000 --> 00:03:02,000
+For example, a target left to comment on your website.
+
+33
+00:03:03,000 --> 00:03:06,000
+And Coleman's content is a JavaScript code.
+
+34
+00:03:07,000 --> 00:03:14,000
+Once com is added, it is stored in the database and law that each time one of the users open a web
+
+35
+00:03:14,000 --> 00:03:17,000
+page with that common script is executed.
+
+36
+00:03:18,000 --> 00:03:22,000
+That's why these kinds of attacks are called persistent.
+
+37
+00:03:22,000 --> 00:03:30,000
+The excess SAS attacks, a document object model, is an interface to treat and document as a logical
+
+38
+00:03:30,000 --> 00:03:34,000
+tree structure where each node represents an object.
+
+39
+00:03:35,000 --> 00:03:41,000
+And because of the document, DOM based excess attacks actually write data to the DOM.
+
+40
+00:03:42,000 --> 00:03:46,000
+Attackers can use this to add a malicious script to that page.
+
+41
+00:03:47,000 --> 00:03:56,000
+DOM based exercise or as it is called in some tax time, all exercise using exercise attack variant
+
+42
+00:03:56,000 --> 00:04:04,000
+at targeting load is executed as a result of modifying the known environment in the victim's browser
+
+43
+00:04:04,000 --> 00:04:12,000
+used by the original client side script so that the inside side code arose in an unexpected manner.
+
+44
+00:04:13,000 --> 00:04:20,000
+That is, the page itself doesn't change, but the client's side code contains the needs of page, executes
+
+45
+00:04:21,000 --> 00:04:26,000
+from the uses and malicious modifications that have a keyword is a DOM environment.
+
+46
+00:04:27,000 --> 00:04:30,000
+Let me demo reflected the excess attack.
+
+47
+00:04:31,000 --> 00:04:38,000
+Just to remind you that this is kind of attack where we use you around to inject JavaScript and we use
+
+48
+00:04:38,000 --> 00:04:43,000
+social engineering techniques to force victim using to use our lead.
+
+49
+00:04:44,000 --> 00:04:46,000
+My server is up and running.
+
+50
+00:04:46,000 --> 00:04:50,000
+Imagine that I'm successfully logged in.
+
+51
+00:04:50,000 --> 00:04:59,000
+Let me use some saved credentials to log in on the side and all of a sudden I receive an email that
+
+52
+00:04:59,000 --> 00:05:04,000
+tells me that I need to use the link from the email to get the 90% discount.
+
+53
+00:05:04,000 --> 00:05:08,000
+I click on it and they're redirected to go to the details page.
+
+54
+00:05:09,000 --> 00:05:09,000
+Here it is.
+
+55
+00:05:10,000 --> 00:05:16,000
+You can see that to request parameters, the ID and discount code.
+
+56
+00:05:16,000 --> 00:05:19,000
+And here is the name of discount coupon.
+
+57
+00:05:19,000 --> 00:05:21,000
+Let's imagine that.
+
+58
+00:05:21,000 --> 00:05:23,000
+And again, this is just an example.
+
+59
+00:05:24,000 --> 00:05:27,000
+There can be different variations in different cases.
+
+60
+00:05:27,000 --> 00:05:32,000
+But the main thing here is that query parameter may be displayed tons of page.
+
+61
+00:05:33,000 --> 00:05:35,000
+This allows the inject script.
+
+62
+00:05:36,000 --> 00:05:44,000
+So I'm logged in user and the margins as you see if you read on your email, it contains injected screen.
+
+63
+00:05:45,000 --> 00:05:46,000
+Let me paste it here.
+
+64
+00:05:47,000 --> 00:05:55,000
+And when a click and the last thing that happened to me at first glance but realize this zero contains
+
+65
+00:05:55,000 --> 00:06:03,000
+JavaScript code that tweets my cookies and sends the analysis server, lets me use the source code of
+
+66
+00:06:03,000 --> 00:06:04,000
+the page.
+
+67
+00:06:04,000 --> 00:06:12,000
+Now let me search for script tag and you can find that my script has been injected into the page.
+
+68
+00:06:13,000 --> 00:06:14,000
+Can you see this?
+
+69
+00:06:14,000 --> 00:06:16,000
+Write those across.
+
+70
+00:06:17,000 --> 00:06:24,000
+I sent the cookies where I post mass does this or that and they print printed the console here largely
+
+71
+00:06:24,000 --> 00:06:26,000
+copies this session.
+
+72
+00:06:26,000 --> 00:06:26,000
+They did.
+
+73
+00:06:27,000 --> 00:06:35,000
+And in that a browser, let's say in Mozilla Firefox, I will open my application what I am going to
+
+74
+00:06:35,000 --> 00:06:35,000
+do next.
+
+75
+00:06:36,000 --> 00:06:44,000
+I open development tools by clicking the F12 key and I find JS session and equal key in the storage
+
+76
+00:06:44,000 --> 00:06:44,000
+tab.
+
+77
+00:06:45,000 --> 00:06:48,000
+I will just substitute the value of our code.
+
+78
+00:06:48,000 --> 00:06:56,000
+Key to the one I received was a help of injection and after that I refresh page and here it is.
+
+79
+00:06:57,000 --> 00:06:59,000
+I logged in was another user.
+
+80
+00:07:00,000 --> 00:07:01,000
+I stole this session.
+
+81
+00:07:02,000 --> 00:07:03,000
+Can you imagine that?
+
+82
+00:07:04,000 --> 00:07:08,000
+That's why cross-site scripting injections are so dangerous.
+
+83
+00:07:08,000 --> 00:07:14,000
+That's why you need to be very cautious with the links that you open in the browser.
+
+84
+00:07:15,000 --> 00:07:16,000
+Let me open the source code.
+
+85
+00:07:17,000 --> 00:07:19,000
+Is there a threat that requires us to read them?
+
+86
+00:07:19,000 --> 00:07:24,000
+First of all, you can find JavaScript code that I injected into the euro.
+
+87
+00:07:25,000 --> 00:07:33,000
+I keep a command and here you can find actually the JavaScript code and then the code euro and they
+
+88
+00:07:33,000 --> 00:07:34,000
+do get massive.
+
+89
+00:07:34,000 --> 00:07:42,000
+You can see that they take parameters and codes into the request code and after that I for once request
+
+90
+00:07:42,000 --> 00:07:49,000
+the my view and discount component is injected into the page in zero number 55.
+
+91
+00:07:50,000 --> 00:07:51,000
+Can you see this?
+
+92
+00:07:52,000 --> 00:07:54,000
+What to do and how to solve this?
+
+93
+00:07:55,000 --> 00:08:04,000
+In most application service default configuration, we can use a response handler to help prevent cross-site
+
+94
+00:08:04,000 --> 00:08:11,000
+scripting attacks and by default we use DPI on the flag for circle be response header.
+
+95
+00:08:12,000 --> 00:08:19,000
+In simple words, that means that cookies can be read and sent or made by a web server.
+
+96
+00:08:19,000 --> 00:08:27,000
+That's why, by default it is hard to extract cookies set by Tomcat Web server, but this easy to store
+
+97
+00:08:27,000 --> 00:08:28,000
+application cookies.
+
+98
+00:08:29,000 --> 00:08:37,000
+I mean cookies that we set from the application and not cookies that were set by web server and also
+
+99
+00:08:37,000 --> 00:08:44,000
+as a sync will consider this course and this class in particular designed not only for Java developers,
+
+100
+00:08:45,000 --> 00:08:46,000
+it can happen.
+
+101
+00:08:46,000 --> 00:08:53,000
+Is that web server that you selected for your application doesn't add a CTP on the flag and by default
+
+102
+00:08:53,000 --> 00:08:57,000
+in said cookie response had it to prevent cross-site scripting.
+
+103
+00:08:58,000 --> 00:09:01,000
+So we be to here and do not forget to check this.
+
+104
+00:09:02,000 --> 00:09:08,000
+I will share with you example of Tomcat configuration and you will be able to find similar configuration
+
+105
+00:09:08,000 --> 00:09:10,000
+on this service.
+
+106
+00:09:10,000 --> 00:09:18,000
+To reproduce a case where I stole your cookies, I set use based on the attributes value to false.
+
+107
+00:09:18,000 --> 00:09:23,000
+We can configure this in the context XML file on the Tomcat level.
+
+108
+00:09:24,000 --> 00:09:33,000
+Context sex symbol is located in the folder of the Tomcat in case you run Tomcat from eclipse context.
+
+109
+00:09:33,000 --> 00:09:36,000
+S.O. is located in the middle is folder.
+
+110
+00:09:36,000 --> 00:09:46,000
+Here you can see I said use only attitude of context element to false and after this tomcat doesn't
+
+111
+00:09:46,000 --> 00:09:50,000
+prevent the cross-site scripting for cookies set by the server.
+
+112
+00:09:51,000 --> 00:09:59,000
+To fix this, I need to remove this attribute because it is true by default or to set true vividly here.
+
+113
+00:10:00,000 --> 00:10:04,000
+I am sure that you can find similar configuration on the web server.
+
+114
+00:10:06,000 --> 00:10:11,000
+Another way of preventing such attacks is a key point of our tools.
+
+115
+00:10:11,000 --> 00:10:20,000
+In this particular example, we use GCP and G isto ingest with out attack that allows us to escape out.
+
+116
+00:10:21,000 --> 00:10:27,000
+Let me on Coleman's slide and I will refresh the page in browser.
+
+117
+00:10:27,000 --> 00:10:35,000
+As you can see, when I escape tax, then JavaScript will not be injected into the page script.
+
+118
+00:10:36,000 --> 00:10:39,000
+It will be injected as text and will not be executed.
+
+119
+00:10:40,000 --> 00:10:47,000
+Talking about persistent exercise, attacks and lives, there is no sense to imitate other cases because
+
+120
+00:10:47,000 --> 00:10:49,000
+they will be almost similar.
+
+121
+00:10:49,000 --> 00:10:57,000
+Imagine that somebody left a comment on the PDP page and the comment contains JavaScript code.
+
+122
+00:10:57,000 --> 00:11:03,000
+This code will be stored in the database and obviously one page will be loaded.
+
+123
+00:11:03,000 --> 00:11:08,000
+The JavaScript code will be loaded on the page and executed.
+
+124
+00:11:08,000 --> 00:11:11,000
+And again, also second examples from this lesson.
+
+125
+00:11:11,000 --> 00:11:13,000
+You can find an attachment to the lesson.
+
+126
+00:11:14,000 --> 00:11:21,000
+Take your time, investigate all examples provided and remember, this is amazing.
+
+127
+00:11:21,000 --> 00:11:27,000
+To Prevent Access Attack is to never trust the data as it comes from outside of the application.
+
+128
+00:11:28,000 --> 00:11:36,000
+Always treat any kind of vehicle as a suspect until you capable to avoid cases like this.
+
+129
+00:11:36,000 --> 00:11:46,000
+Make sure you escape all HTML tags before you store it in the database or when you send data from that
+
+130
+00:11:47,000 --> 00:11:48,000
+before escaping.
+
+131
+00:11:48,000 --> 00:11:51,000
+Input validation is another valuable strategy.
+
+132
+00:11:51,000 --> 00:11:58,000
+When dealing with user input for some kinds of data, it might make sense to use an allow based approach
+
+133
+00:11:59,000 --> 00:12:03,000
+interview to allow this approach few times already, including our previous lesson.
+
+134
+00:12:04,000 --> 00:12:06,000
+One We talked about broken access control.
+
+135
+00:12:07,000 --> 00:12:13,000
+So I believe you are familiar with this technique is allowing the use of at least of the validate as
+
+136
+00:12:13,000 --> 00:12:17,000
+it can be accepted and everyone else is not.
+
+137
+00:12:18,000 --> 00:12:26,000
+And also there are tools that can be integrated into this is useful and can help you to detect and prevent
+
+138
+00:12:26,000 --> 00:12:31,000
+not only excess attacks but also other potential threats.
+
+139
+00:12:32,000 --> 00:12:36,000
+Let's now talk about sequel GP and those sequel injections.
+
+140
+00:12:37,000 --> 00:12:43,000
+I decided to discuss these types of injections together as a group because all of them I am both and
+
+141
+00:12:44,000 --> 00:12:46,000
+seeing all these kinds of injections.
+
+142
+00:12:46,000 --> 00:12:52,000
+The record on Impact and Persistence Stores talking about SQL injections.
+
+143
+00:12:52,000 --> 00:12:54,000
+I would like to do even advice.
+
+144
+00:12:54,000 --> 00:12:58,000
+Please check our previous lesson about cryptographic failures.
+
+145
+00:12:59,000 --> 00:13:07,000
+In that lesson I showed example wisdom of situation of impact of sun passports in the database in not
+
+146
+00:13:07,000 --> 00:13:08,000
+encrypted form.
+
+147
+00:13:08,000 --> 00:13:14,000
+And in the example, I used SQL injection to retrieve data from persistent storage.
+
+148
+00:13:15,000 --> 00:13:19,000
+So please check with those lessons to learn more about SQL injection.
+
+149
+00:13:20,000 --> 00:13:23,000
+And in general, we have not the easiest topics to them.
+
+150
+00:13:24,000 --> 00:13:31,000
+Security questions never very easy once place the notes, skip lessons to not be lost in the context.
+
+151
+00:13:32,000 --> 00:13:38,000
+And again you will be able to find source code of SQL injection examples in the previous lessons.
+
+152
+00:13:39,000 --> 00:13:41,000
+As you can see, vulnerabilities.
+
+153
+00:13:41,000 --> 00:13:43,000
+I used to guess it was possible.
+
+154
+00:13:44,000 --> 00:13:50,000
+For example, SQL injection where immunity may be used to discover cryptographic servers.
+
+155
+00:13:50,000 --> 00:13:57,000
+That's why I don't see and the access to duplicate demo of examples, but instead I will help you to
+
+156
+00:13:57,000 --> 00:13:59,000
+connect the dots together.
+
+157
+00:14:00,000 --> 00:14:01,000
+Ensure.
+
+158
+00:14:01,000 --> 00:14:07,000
+I'd like to recalls the course of injections SQL injection accuracy ones.
+
+159
+00:14:07,000 --> 00:14:15,000
+The application uses untrusted user input to build and SQL query using the string and executable.
+
+160
+00:14:16,000 --> 00:14:20,000
+It is recommended to use query parameters in order to prevent injection.
+
+161
+00:14:21,000 --> 00:14:29,000
+Also use name and also SQL controls was increased to prevent most disclosure of records in case of secure
+
+162
+00:14:29,000 --> 00:14:30,000
+injection.
+
+163
+00:14:31,000 --> 00:14:38,000
+We're going to have a separate lesson about the persistence API and I will cover all the specifics in
+
+164
+00:14:38,000 --> 00:14:39,000
+those lessons.
+
+165
+00:14:40,000 --> 00:14:47,000
+But talking about injections, I can say that the root cause of GP injection is very similar to the
+
+166
+00:14:47,000 --> 00:14:48,000
+sequel injections.
+
+167
+00:14:48,000 --> 00:14:51,000
+GP injection cures ones.
+
+168
+00:14:51,000 --> 00:14:58,000
+The application uses untrusted user to build the GP query using S3 and executed.
+
+169
+00:14:59,000 --> 00:15:06,000
+It's quite similar to sequel injection, but the ultimate language isn't sequel but the GP where it
+
+170
+00:15:06,000 --> 00:15:06,000
+went.
+
+171
+00:15:07,000 --> 00:15:15,000
+And again, to prevent the GP injection, it is recommended to use a persistent square and causation.
+
+172
+00:15:16,000 --> 00:15:23,000
+A few words about no SQL injection injection of this type of queue or was the application uses untrusted
+
+173
+00:15:23,000 --> 00:15:32,000
+use of the input to build and no SQL API call expression as many no of this system and each one to use
+
+174
+00:15:32,000 --> 00:15:33,000
+API for call.
+
+175
+00:15:34,000 --> 00:15:40,000
+It is important to ensure that user input received and is used to build the API.
+
+176
+00:15:40,000 --> 00:15:46,000
+Call expression does not contain any characters that have the special name is a target API.
+
+177
+00:15:46,000 --> 00:15:47,000
+See this.
+
+178
+00:15:48,000 --> 00:15:51,000
+We need to check this in order to avoid that.
+
+179
+00:15:51,000 --> 00:15:59,000
+Some characters will be used to escape the initial call expression in order to create another one based
+
+180
+00:15:59,000 --> 00:16:01,000
+on crafted user input.
+
+181
+00:16:02,000 --> 00:16:10,000
+It is also important to not use String Nation to build API call expression, but to use the API to create
+
+182
+00:16:10,000 --> 00:16:19,000
+an expression similar to the way how we use to prepare a statement instead of statement in Java in example
+
+183
+00:16:19,000 --> 00:16:21,000
+about sequel injections.
+
+184
+00:16:22,000 --> 00:16:24,000
+That states got injections.
+
+185
+00:16:24,000 --> 00:16:26,000
+That can impact our database storage.
+

73 - OWASP Top 10 2021/007 Source-code-examples-from-the-lesson.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/AndriiPiatakha/java-learnit-web-online-store/tree/master/online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/i/problem

73 - OWASP Top 10 2021/008 Injection (XPath Injection, Log Injection, Input Validation)_en.srt

@@ -0,0 +1,716 @@
+1
+00:00:02,000 --> 00:00:10,000
+Let's talk now about exports, injection, web applications, store and access data in various ways
+
+2
+00:00:10,000 --> 00:00:13,000
+and for us, dependent upon the use cases.
+
+3
+00:00:14,000 --> 00:00:21,000
+Historically, relational databases have been the popular choice among various databases to store large
+
+4
+00:00:21,000 --> 00:00:22,000
+amounts of data.
+
+5
+00:00:23,000 --> 00:00:29,000
+However, sometimes we still prefer to use Excel for storing some kind of data.
+
+6
+00:00:29,000 --> 00:00:34,000
+It can be configurations, but not only on the using maximum.
+
+7
+00:00:34,000 --> 00:00:41,000
+The data is stored in master structure is a form of trees rather than columns and rows.
+
+8
+00:00:42,000 --> 00:00:50,000
+To understand what each sparse injection we need to understand, what makes us is the data store of
+
+9
+00:00:50,000 --> 00:00:53,000
+the x amount can be queried x plus.
+
+10
+00:00:54,000 --> 00:01:00,000
+It is a query language and is used to locate specific elements in an accidental document.
+
+11
+00:01:00,000 --> 00:01:07,000
+There are no access level permissions and it is possible to refer almost any parts of an excellent document.
+
+12
+00:01:07,000 --> 00:01:15,000
+Unlike SIC, which allows restrictions on databases, tables or columns similar to single injection
+
+13
+00:01:15,000 --> 00:01:23,000
+POS injections operate on websites that use a user supplied information to construct an express query.
+
+14
+00:01:23,000 --> 00:01:31,000
+For example, data by sending intentionally malformed information into the website and a target can
+
+15
+00:01:31,000 --> 00:01:42,000
+find out how x small data is structured or x data that he may not normally have access to experts injections
+
+16
+00:01:42,000 --> 00:01:50,000
+might be even more dangerous than SQL injections since the X Plus Blocks Access Control allows querying
+
+17
+00:01:50,000 --> 00:01:53,000
+of the complete X amount document.
+
+18
+00:01:53,000 --> 00:02:02,000
+Whereas many SQL databases have metal tables that can be accessed by regular queries before reviewing
+
+19
+00:02:02,000 --> 00:02:03,000
+the express injection.
+
+20
+00:02:03,000 --> 00:02:10,000
+Examples, I have to say that it is important to you to know what maximum on the x plus is taking into
+
+21
+00:02:10,000 --> 00:02:11,000
+account.
+
+22
+00:02:11,000 --> 00:02:19,000
+This is why the topic I want to warn you is in this lesson we are not going to loan x amount and x pass.
+
+23
+00:02:19,000 --> 00:02:23,000
+We're going to have a separate lesson about eczema and expose.
+
+24
+00:02:24,000 --> 00:02:26,000
+Let's review X plus injection demo.
+
+25
+00:02:26,000 --> 00:02:31,000
+Now we will use the excellent sequence that you see in the slide for the examples.
+
+26
+00:02:32,000 --> 00:02:38,000
+So this is a collection of employees and believe that excellent example is self describing.
+
+27
+00:02:39,000 --> 00:02:46,000
+Suppose we have a user authentication system on a web page that used a data file of this sort to log
+
+28
+00:02:46,000 --> 00:02:47,000
+in users.
+
+29
+00:02:48,000 --> 00:02:54,000
+Once username and password have been supplied, the software might use x pos to load copies.
+
+30
+00:02:54,000 --> 00:02:57,000
+The user like you can see on this slide.
+
+31
+00:02:57,000 --> 00:03:00,000
+These are examples.
+
+32
+00:03:00,000 --> 00:03:08,000
+You can see that I get username from request and I get the personal request was a normal username and
+
+33
+00:03:08,000 --> 00:03:08,000
+password.
+
+34
+00:03:08,000 --> 00:03:17,000
+This is possible work, but an attacker may send that username and password and they get an example.
+
+35
+00:03:17,000 --> 00:03:17,000
+No.
+
+36
+00:03:17,000 --> 00:03:20,000
+So access will result in a user name or password.
+
+37
+00:03:20,000 --> 00:03:24,000
+Like this you can see example of username and password.
+
+38
+00:03:24,000 --> 00:03:28,000
+Sam Z give us and ASICs expression.
+
+39
+00:03:28,000 --> 00:03:35,000
+The express expression was Well, this now looks like this, which is logically equivalent to what you
+
+40
+00:03:35,000 --> 00:03:36,000
+see on the slide.
+
+41
+00:03:37,000 --> 00:03:41,000
+In this case, one of the first parts of the X plus needs to be true.
+
+42
+00:03:42,000 --> 00:03:50,000
+Is it possible part becomes irrelevant and the username part will match all employees because of the
+
+43
+00:03:50,000 --> 00:03:51,000
+one equal one path.
+
+44
+00:03:52,000 --> 00:03:54,000
+How to prevent x pos injection.
+
+45
+00:03:55,000 --> 00:04:02,000
+Just slides the techniques with secure injection you need to use it tries to expose the interface if
+
+46
+00:04:02,000 --> 00:04:10,000
+one is available or escapes the user input to make it safe to load in dynamically constructed query.
+
+47
+00:04:11,000 --> 00:04:19,000
+If you use calls to terminate untrusted input in a dynamic constructed x POS query, then you use cables
+
+48
+00:04:19,000 --> 00:04:28,000
+that quote these untrusted inputs to ensure that untrusted data can try to break out of that quoted
+
+49
+00:04:28,000 --> 00:04:30,000
+context in the following example.
+
+50
+00:04:30,000 --> 00:04:38,000
+Single quotes are used to terminate the user name and password parameters, and thus a better mitigation
+
+51
+00:04:38,000 --> 00:04:41,000
+option is to use a compiled POS query.
+
+52
+00:04:42,000 --> 00:04:50,000
+Click on coiled expose queries already preset before the program executes, whereas than create on the
+
+53
+00:04:50,000 --> 00:04:54,000
+fly after the user's input has been added to the stream.
+
+54
+00:04:55,000 --> 00:05:01,000
+This is a better world because you don't have to worry about making a character that should have been.
+
+55
+00:05:01,000 --> 00:05:02,000
+Kate.
+
+56
+00:05:03,000 --> 00:05:07,000
+And the last but not least example for today is a log injection.
+
+57
+00:05:07,000 --> 00:05:15,000
+Applications typically used to lock files to store a history of events or transactions for later review
+
+58
+00:05:15,000 --> 00:05:18,000
+statistics, revising or debugging.
+
+59
+00:05:18,000 --> 00:05:25,000
+Dependent on the nature of the application, the task of reviewing the log files may be performed manually
+
+60
+00:05:26,000 --> 00:05:34,000
+on an as needed basis for automated was a tool that automatically calls for important events or trend
+
+61
+00:05:34,000 --> 00:05:35,000
+information.
+
+62
+00:05:36,000 --> 00:05:40,000
+What is a log injection logging action?
+
+63
+00:05:40,000 --> 00:05:47,000
+How often called log forgery is a vulnerability that arises when untrusted and validated.
+
+64
+00:05:48,000 --> 00:05:51,000
+Input is allowed to be created in system log files.
+
+65
+00:05:52,000 --> 00:06:00,000
+As a result, an attacker can insert malicious data and false entries into the logs and also to corrupt
+
+66
+00:06:00,000 --> 00:06:01,000
+the file.
+
+67
+00:06:02,000 --> 00:06:11,000
+The corrupted files can be used to cover the tracks of a heart attack path injection with just a Q when
+
+68
+00:06:11,000 --> 00:06:18,000
+data and there's an application from an and trusted source, the data is written to an application or
+
+69
+00:06:18,000 --> 00:06:19,000
+system log file.
+
+70
+00:06:20,000 --> 00:06:27,000
+Successful lock injection attacks can cause injection of new bogus events.
+
+71
+00:06:28,000 --> 00:06:30,000
+Look for an injection.
+
+72
+00:06:31,000 --> 00:06:38,000
+Injection of excess attacks opens as a malicious or current is of use in a vulnerable web application
+
+73
+00:06:39,000 --> 00:06:45,000
+injection of commands that parsers like HP passes could execute.
+
+74
+00:06:45,000 --> 00:06:48,000
+Let's review log injection demo.
+
+75
+00:06:48,000 --> 00:06:51,000
+Now these are most benign case.
+
+76
+00:06:51,000 --> 00:06:55,000
+An attacker may be able to serve false answers to the log file.
+
+77
+00:06:56,000 --> 00:07:02,000
+By providing that application, we see that we can lose a copy of characters.
+
+78
+00:07:02,000 --> 00:07:10,000
+If the log file is processed automatically, the attacker can render the file unusable by corrupting
+
+79
+00:07:10,000 --> 00:07:16,000
+the format of the file or inject an unexpected characters or more subtle attack.
+
+80
+00:07:16,000 --> 00:07:18,000
+Might be old school.
+
+81
+00:07:18,000 --> 00:07:27,000
+The log file statistics forged or otherwise corrupted log files can be used to cover and attackers tracks
+
+82
+00:07:27,000 --> 00:07:32,000
+or even to implicate another party in the commission of a malicious act.
+
+83
+00:07:32,000 --> 00:07:35,000
+Let's review quote examples was log for you.
+
+84
+00:07:36,000 --> 00:07:40,000
+On this slide you can see the source code of web application.
+
+85
+00:07:40,000 --> 00:07:47,000
+This particular piece of code application reads parameter from the request and passes it to integer.
+
+86
+00:07:48,000 --> 00:07:51,000
+It is parameter can be passed.
+
+87
+00:07:51,000 --> 00:07:57,000
+Xen will input if a user submits just 31234.
+
+88
+00:07:58,000 --> 00:08:03,000
+The following entry is locked, fails to pass and one is me.
+
+89
+00:08:04,000 --> 00:08:15,000
+However, if an attacker submits a313 info user logged out and user name, the following entry is locked.
+
+90
+00:08:16,000 --> 00:08:18,000
+Failed to pass a new one.
+
+91
+00:08:18,000 --> 00:08:20,000
+Sweet user walked out.
+
+92
+00:08:20,000 --> 00:08:23,000
+That got me on it.
+
+93
+00:08:23,000 --> 00:08:27,000
+Attackers can use this same mechanism to insert arbitrary lock.
+
+94
+00:08:27,000 --> 00:08:35,000
+ANDREWS So how to prevent lock injection to prevent an attacker from writing malicious content into
+
+95
+00:08:35,000 --> 00:08:36,000
+the application log?
+
+96
+00:08:36,000 --> 00:08:45,000
+Applied sciences such as as a user input is used to prevent injection of carriage return on the characters
+
+97
+00:08:46,000 --> 00:08:50,000
+limit the size of the user equals value used to create the lock message.
+
+98
+00:08:51,000 --> 00:08:58,000
+Make sure all exercise defenses are applied when you invoke files in the browser that sits with current
+
+99
+00:08:59,000 --> 00:08:59,000
+injection.
+
+100
+00:09:00,000 --> 00:09:01,000
+Let's continue.
+
+101
+00:09:02,000 --> 00:09:09,000
+We reviewed a lot of different injections for ambulances, also learned how to prevent each particular
+
+102
+00:09:09,000 --> 00:09:10,000
+injection.
+
+103
+00:09:10,000 --> 00:09:17,000
+But still, let's sum it up and make some general statements that you need to follow to prevent injections.
+
+104
+00:09:18,000 --> 00:09:23,000
+The following points can be applied in a general way to prevent injection issue.
+
+105
+00:09:24,000 --> 00:09:33,000
+Apply input validation using arrow based approach combined was out with some Tyson plus escape and user
+
+106
+00:09:33,000 --> 00:09:34,000
+input output.
+
+107
+00:09:35,000 --> 00:09:41,000
+If you interact with the system, try to use API features provided by a technology stack.
+
+108
+00:09:42,000 --> 00:09:44,000
+Java but not the key.
+
+109
+00:09:44,000 --> 00:09:49,000
+Instead of give them command and execute an aid in the command line.
+
+110
+00:09:49,000 --> 00:09:49,000
+So.
+
+111
+00:09:50,000 --> 00:09:58,000
+For any residual, then that requires of special characters using the specific escape syntax for that
+
+112
+00:09:58,000 --> 00:09:58,000
+interpreter.
+
+113
+00:09:59,000 --> 00:10:07,000
+So the general idea was, is to work with the input, let's input validation strategies.
+
+114
+00:10:07,000 --> 00:10:13,000
+I believe that by this moment, unless you understand what is the goal of the input validation.
+
+115
+00:10:14,000 --> 00:10:21,000
+But let's make it crystal clear what main goals of input validation are and when we should use information
+
+116
+00:10:21,000 --> 00:10:23,000
+to use input validation.
+
+117
+00:10:23,000 --> 00:10:33,000
+This performed to ensure all of the data is entries of workflow information system programs and malformed
+
+118
+00:10:33,000 --> 00:10:39,000
+data from persistent database and triggering malfunction of various downstream components.
+
+119
+00:10:40,000 --> 00:10:48,000
+Input validation should happen as early as possible and the data flow perform as soon as a data is received
+
+120
+00:10:48,000 --> 00:10:49,000
+from the external party.
+
+121
+00:10:50,000 --> 00:10:57,000
+Data from all potentially untrusted sources should be subject to input validation, including not only
+
+122
+00:10:57,000 --> 00:11:07,000
+internet facing web clients, but also by hand feeds over extra Nats from suppliers or vendors or regulators,
+
+123
+00:11:08,000 --> 00:11:15,000
+each of which may be compromised on their own and starts sending multiple data input.
+
+124
+00:11:15,000 --> 00:11:23,000
+Validation should not be used as a primary method of preventing the excess cycle injection and other
+
+125
+00:11:23,000 --> 00:11:30,000
+attacks which are covered in respective cheat sheets but can significantly contribute to reducing the
+
+126
+00:11:30,000 --> 00:11:32,000
+impact if implemented properly.
+
+127
+00:11:33,000 --> 00:11:37,000
+There are different input validation strategies that we have to consider.
+
+128
+00:11:37,000 --> 00:11:43,000
+Input validation should be applied on both syntactical and semantic level.
+
+129
+00:11:44,000 --> 00:11:49,000
+Syntactic validation should enforce correct syntax of structured fields.
+
+130
+00:11:49,000 --> 00:11:57,000
+For example, date formal semantic validation should enforce correctness of the values in a specific
+
+131
+00:11:57,000 --> 00:11:58,000
+business context.
+
+132
+00:11:59,000 --> 00:12:04,000
+For example, start date is before and the price is wasn't expected to change.
+
+133
+00:12:05,000 --> 00:12:12,000
+It is always recommended to prevent attacks as early as possible as it causes some of the user's attackers
+
+134
+00:12:12,000 --> 00:12:14,000
+request in code.
+
+135
+00:12:14,000 --> 00:12:18,000
+Validation can be used to detect unauthorized input.
+
+136
+00:12:18,000 --> 00:12:21,000
+Before this process was application.
+
+137
+00:12:22,000 --> 00:12:28,000
+You can implement input validation in different programming language by using existing toolset.
+
+138
+00:12:28,000 --> 00:12:37,000
+All external libraries enforce syntactic and semantic correctness validation against the source schema
+
+139
+00:12:37,000 --> 00:12:40,000
+and XML schema x as the four e.
+
+140
+00:12:40,000 --> 00:12:46,000
+In these four months, you stop conversions that is available in your programming language with strict
+
+141
+00:12:46,000 --> 00:12:54,000
+exception handling for example in Java or seems massive in integer type supports integers.
+
+142
+00:12:55,000 --> 00:13:02,000
+Minimum and maximum value rank checks on numerical parameters, some dates minimum and maximum lengths.
+
+143
+00:13:02,000 --> 00:13:08,000
+Check for strings array of allowed values for small sets of string parameters.
+
+144
+00:13:08,000 --> 00:13:15,000
+For example, if you need to validate inputs of days of week, regular expressions for plays and characters
+
+145
+00:13:15,000 --> 00:13:16,000
+if needed.
+
+146
+00:13:16,000 --> 00:13:23,000
+For example, if you need to substitute some content or escape some characters, we also use the zoo
+
+147
+00:13:23,000 --> 00:13:29,000
+technique of allow us to look and never forget about civilization.
+
+148
+00:13:29,000 --> 00:13:36,000
+Remember that a tiger can bypass front and foundation, so never forget to implement flotation on your
+
+149
+00:13:36,000 --> 00:13:36,000
+Samsung.
+
+150
+00:13:38,000 --> 00:13:41,000
+Separately, I'd like to talk about file upload.
+
+151
+00:13:41,000 --> 00:13:47,000
+This is also important that should be validated very often in web applications.
+
+152
+00:13:47,000 --> 00:13:51,000
+We can upload a user profile picture or some archive data.
+
+153
+00:13:52,000 --> 00:13:53,000
+Here are some rules.
+
+154
+00:13:54,000 --> 00:14:00,000
+Use input validation to ensure that upload file name uses and expected extension.
+
+155
+00:14:00,000 --> 00:14:00,000
+But.
+
+156
+00:14:01,000 --> 00:14:06,000
+Ensures that promoted file is not larger than a defined maximum file size.
+
+157
+00:14:07,000 --> 00:14:15,000
+By the way, this is important because attackers can break a server by uploading huge files intentionally.
+
+158
+00:14:15,000 --> 00:14:22,000
+If the website supports zip file, upload the validation check before unzip the file.
+
+159
+00:14:22,000 --> 00:14:32,000
+The check includes a target pass level of compressed estimated zip size use image the writing libraries
+
+160
+00:14:32,000 --> 00:14:40,000
+to verify the image is valid and to strip away extraneous content said the extension of the image could
+
+161
+00:14:40,000 --> 00:14:46,000
+be about the image extension based on the detected content type of the image from the image processing,
+
+162
+00:14:47,000 --> 00:14:54,000
+namely the not just trust is a header from SAP for insurers of the Texas content, part of the image
+
+163
+00:14:54,000 --> 00:14:57,000
+is within a list of defined image types.
+
+164
+00:14:58,000 --> 00:15:01,000
+JPG, dng, etc..
+
+165
+00:15:02,000 --> 00:15:04,000
+That's all what I wanted to share with you in this lesson.
+
+166
+00:15:05,000 --> 00:15:07,000
+Let's recap what we have learned.
+
+167
+00:15:08,000 --> 00:15:16,000
+In this licensing and injection risk category, we make a comparison of the risk category in our top
+
+168
+00:15:16,000 --> 00:15:16,000
+ten.
+
+169
+00:15:16,000 --> 00:15:20,000
+2021 was top ten 2017.
+
+170
+00:15:20,000 --> 00:15:29,000
+We reviewed different injection types, namely command injection, cross-site scripting and by the way,
+
+171
+00:15:29,000 --> 00:15:32,000
+we reviewed different types of cross-site scripting.
+
+172
+00:15:33,000 --> 00:15:40,000
+SQL Injection injection no injection x amount x pass injection, walk injection.
+
+173
+00:15:41,000 --> 00:15:43,000
+And at the end of the lesson was summarized.
+
+174
+00:15:43,000 --> 00:15:50,000
+The key sense is that we need to remember to prevent injection liabilities and relevant input validation
+
+175
+00:15:50,000 --> 00:15:52,000
+strategies and techniques.
+
+176
+00:15:53,000 --> 00:15:55,000
+That's all what I wanted to share with you in this lesson.
+
+177
+00:15:56,000 --> 00:15:57,000
+Thanks a lot for your attention.
+
+178
+00:15:58,000 --> 00:16:00,000
+Have a great day and see things.
+
+179
+00:16:00,000 --> 00:16:01,000
+The next lesson.
+

73 - OWASP Top 10 2021/008 Source-code-examples-from-the-lesson.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/AndriiPiatakha/java-learnit-web-online-store/tree/master/online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/i/problem

73 - OWASP Top 10 2021/009 Insecure Design (Overivew, CWEs, Shift Left Security, Threat Modeling Manifesto)_en.srt

@@ -0,0 +1,868 @@
+1
+00:00:06,000 --> 00:00:06,000
+Hello.
+
+2
+00:00:06,000 --> 00:00:08,000
+The day we start new topic.
+
+3
+00:00:09,000 --> 00:00:15,000
+This time we're going to discuss insecure design risk category from a loss that as always, we're going
+
+4
+00:00:15,000 --> 00:00:22,000
+to start our lesson from the general overview to help you understand that what this risk category is
+
+5
+00:00:22,000 --> 00:00:23,000
+about.
+
+6
+00:00:23,000 --> 00:00:30,000
+We're going to compare insecure design and insecure implementation and we are going to understand the
+
+7
+00:00:30,000 --> 00:00:31,000
+difference.
+
+8
+00:00:31,000 --> 00:00:37,000
+Your insurance will then you chance, for example, shift left approach.
+
+9
+00:00:37,000 --> 00:00:39,000
+I will explain what it is.
+
+10
+00:00:40,000 --> 00:00:46,000
+We'll discuss the most notable common weakness enumerations that are associated with this risk category.
+
+11
+00:00:47,000 --> 00:00:55,000
+Significant part of our today's lesson will talk about threat modeling will learn what threat modeling
+
+12
+00:00:55,000 --> 00:00:58,000
+manifest is its values and principles.
+
+13
+00:00:58,000 --> 00:01:05,000
+In this lesson, I will teach you how to build and secure design process during the learning of security
+
+14
+00:01:05,000 --> 00:01:06,000
+design process.
+
+15
+00:01:06,000 --> 00:01:10,000
+I will also cover such topic as business impact analysis.
+
+16
+00:01:11,000 --> 00:01:15,000
+I will provide you with a template that you can use during the business impact analysis.
+
+17
+00:01:16,000 --> 00:01:19,000
+We'll review how we can work with Threat Register.
+
+18
+00:01:20,000 --> 00:01:27,000
+Also, I'm going to explain the concept of security controls will learn what security design document
+
+19
+00:01:27,000 --> 00:01:29,000
+is and what it can contain.
+
+20
+00:01:30,000 --> 00:01:37,000
+And on top of all this, I will suggest madness is, as you can imagine, on a regular basis to measure
+
+21
+00:01:37,000 --> 00:01:39,000
+and evaluate security design process.
+
+22
+00:01:39,000 --> 00:01:43,000
+We'll review example of attacks and rules on how to prevent those.
+
+23
+00:01:44,000 --> 00:01:47,000
+As you can see, we have solid agenda for this lesson.
+
+24
+00:01:48,000 --> 00:01:49,000
+Let's get it started.
+
+25
+00:01:50,000 --> 00:01:54,000
+Let's start from the high level overview of this category.
+
+26
+00:01:54,000 --> 00:01:59,000
+The first things that I have to say is that this is a new risk category inside of us.
+
+27
+00:01:59,000 --> 00:02:07,000
+The top ten, 20, 21 zip was absent in our top ten 2017 and was top ten 2021.
+
+28
+00:02:07,000 --> 00:02:14,000
+The risk category directly started on place for it covers architectural flaws and design.
+
+29
+00:02:14,000 --> 00:02:23,000
+The states that result in the mason or use the security control implementation while an insecure implementation
+
+30
+00:02:23,000 --> 00:02:24,000
+could be easily fixed.
+
+31
+00:02:25,000 --> 00:02:29,000
+Fixing and insecure design is no complicated thing to do.
+
+32
+00:02:29,000 --> 00:02:35,000
+Today we're going to discuss processes that we have to follow in order to create secure design.
+
+33
+00:02:35,000 --> 00:02:39,000
+Now understand what insecure design risk category is about.
+
+34
+00:02:40,000 --> 00:02:40,000
+Let me explain.
+
+35
+00:02:40,000 --> 00:02:49,000
+It was example there no such a feature in the web applications as a store password and very often user
+
+36
+00:02:49,000 --> 00:02:57,000
+registration user is asked to name a favorite or name of the path on Mars's maiden name.
+
+37
+00:02:57,000 --> 00:03:05,000
+This is not secure design by default, no matter how it will be implemented because many people know
+
+38
+00:03:05,000 --> 00:03:08,000
+the name of the pad or maiden name of your mesa.
+
+39
+00:03:09,000 --> 00:03:15,000
+In the era of social networks, it is easy to find all necessary information about the person and the
+
+40
+00:03:15,000 --> 00:03:19,000
+security vulnerability is not in the implementation of this feature.
+
+41
+00:03:20,000 --> 00:03:27,000
+No matter how you will implement this part of the application will still remain vulnerable.
+
+42
+00:03:28,000 --> 00:03:35,000
+So you can fix security vulnerability just by implementing it in a normal way.
+
+43
+00:03:36,000 --> 00:03:42,000
+It is insecure, but it's design, and what you can do to make it more secure is to substitute this
+
+44
+00:03:42,000 --> 00:03:46,000
+piece of application, complete with something more secure.
+
+45
+00:03:47,000 --> 00:03:51,000
+We can say that this is a new category is of massive importance.
+
+46
+00:03:52,000 --> 00:03:58,000
+Many projects start without the real design phase and don't have security in focus.
+
+47
+00:03:58,000 --> 00:04:05,000
+Even prototypes and proof of concept implementations with completely different nonfunctional requirements
+
+48
+00:04:05,000 --> 00:04:12,000
+for security and maintainability often go into production mainly because of business priorities and
+
+49
+00:04:12,000 --> 00:04:13,000
+to achieve some business goals.
+
+50
+00:04:14,000 --> 00:04:22,000
+But as I say, technology should go together with business hand to hand, because our goal is to deliver
+
+51
+00:04:22,000 --> 00:04:30,000
+fast wins market and opposite to the leadership by avoiding unsatisfied customers, lawsuits and so
+
+52
+00:04:30,000 --> 00:04:30,000
+on.
+
+53
+00:04:31,000 --> 00:04:38,000
+Work on secure design after implementation and the release can be very expensive and cost a lot of hours
+
+54
+00:04:38,000 --> 00:04:42,000
+of significant factor of completing a work of some modules.
+
+55
+00:04:43,000 --> 00:04:49,000
+And in this sense, label is extremely complicated and needs a lot of expensive refactoring time.
+
+56
+00:04:50,000 --> 00:04:54,000
+You can only prevent insecure design with insecure development.
+
+57
+00:04:54,000 --> 00:05:04,000
+Lifecycle Bootstrap Model Best Practices and Source User Design Face Mask recommends that organizations
+
+58
+00:05:04,000 --> 00:05:07,000
+use threats in order to achieve secure design.
+
+59
+00:05:07,000 --> 00:05:12,000
+Significant parts of our lesson we're going to talk about threat modelling.
+
+60
+00:05:12,000 --> 00:05:19,000
+There is also call for more use of security design patterns and reference architectures.
+
+61
+00:05:19,000 --> 00:05:25,000
+Avast suggests to move beyond shift that is important space the project core that the team.
+
+62
+00:05:26,000 --> 00:05:32,000
+It is critical for the principles of security by design identifying flaw.
+
+63
+00:05:32,000 --> 00:05:39,000
+So the design phase is what we call starting left in security, which is a progression of the popular
+
+64
+00:05:39,000 --> 00:05:42,000
+devsecops same pushing left.
+
+65
+00:05:42,000 --> 00:05:48,000
+In a few minutes I will explain in the details what does she have left means as I was?
+
+66
+00:05:48,000 --> 00:05:54,000
+Highlights Secure design is a management culture as well as methodology.
+
+67
+00:05:54,000 --> 00:06:01,000
+This is about changing the mindset around what stage security needs to end as application development
+
+68
+00:06:01,000 --> 00:06:02,000
+parties.
+
+69
+00:06:02,000 --> 00:06:11,000
+And it is our fundamental belief that true devsecops can only be achieved if security is factored in
+
+70
+00:06:11,000 --> 00:06:12,000
+right at the outset.
+
+71
+00:06:13,000 --> 00:06:20,000
+I would like to highlight one more time the difference between insecure design and insecure implementation.
+
+72
+00:06:20,000 --> 00:06:25,000
+Insecure design is not the source for all of the top primaries categories.
+
+73
+00:06:26,000 --> 00:06:30,000
+There is a difference between insecure design and insecure implementation.
+
+74
+00:06:30,000 --> 00:06:36,000
+I want to differentiates between design flaws and implementation defects for a reason.
+
+75
+00:06:37,000 --> 00:06:44,000
+These two concepts have different causes and remediation and secure design can still have implementation
+
+76
+00:06:44,000 --> 00:06:48,000
+defects leading to abilities that may be exploited.
+
+77
+00:06:49,000 --> 00:06:56,000
+And the security zone can be fixed by perfect implementation as by definition needed.
+
+78
+00:06:56,000 --> 00:07:01,000
+Security controls were never created to defend against specific attacks.
+
+79
+00:07:01,000 --> 00:07:09,000
+One of the factors that contribute to insecure design is the lack of business risk profile inherent
+
+80
+00:07:09,000 --> 00:07:15,000
+in the software or system being developed, and thus is a failure to determine what level of security
+
+81
+00:07:15,000 --> 00:07:17,000
+design is required.
+
+82
+00:07:17,000 --> 00:07:24,000
+Insecure design means risks related to design and architecture flaws with a built in right from the
+
+83
+00:07:24,000 --> 00:07:29,000
+beginning of software development gives up, propensity and mitigations are not taken.
+
+84
+00:07:30,000 --> 00:07:37,000
+I promised to explain what the shift to left approaches to shift left means to move the process to the
+
+85
+00:07:37,000 --> 00:07:42,000
+left of the traditional linear depiction of the software development lifecycle.
+
+86
+00:07:43,000 --> 00:07:50,000
+That's a common subjects of shift left initiatives in DevOps security and testing.
+
+87
+00:07:50,000 --> 00:07:57,000
+The term shift graph refers to the efforts of DevOps teams to guarantee application security at the
+
+88
+00:07:57,000 --> 00:08:00,000
+earliest stages of development lifecycle.
+
+89
+00:08:01,000 --> 00:08:08,000
+As part of an organizational path known as Devsecops collaboration between development, security and
+
+90
+00:08:08,000 --> 00:08:09,000
+operations.
+
+91
+00:08:10,000 --> 00:08:16,000
+Until recently, years security testing was implemented at the end of the development cycle following
+
+92
+00:08:16,000 --> 00:08:18,000
+application testing.
+
+93
+00:08:18,000 --> 00:08:25,000
+At this stage, security teams would perform various types of analysis and security testing, such as
+
+94
+00:08:25,000 --> 00:08:28,000
+static analysis and dynamic analysis.
+
+95
+00:08:28,000 --> 00:08:34,000
+The results of security tests would use a permit application to proceed for deployment into production
+
+96
+00:08:35,000 --> 00:08:39,000
+or reject the application and pass it back to developers for remediation.
+
+97
+00:08:40,000 --> 00:08:47,000
+This resulted in long delays in development or increased risk of revision software without necessary
+
+98
+00:08:47,000 --> 00:08:55,000
+security measures to shift security and left means to implement security measures your entire development
+
+99
+00:08:55,000 --> 00:08:59,000
+lifecycle rather than as the end of the cycle.
+
+100
+00:08:59,000 --> 00:09:06,000
+The goal of shifting security to left is to design software with security best practices built in and
+
+101
+00:09:06,000 --> 00:09:12,000
+to detect and fix potential security issues and vulnerabilities as early as a development process as
+
+102
+00:09:12,000 --> 00:09:19,000
+possible, making it easier, faster, and more affordable to address security issues.
+
+103
+00:09:20,000 --> 00:09:25,000
+The difference from the weakness and limitations that are associated with this category.
+
+104
+00:09:25,000 --> 00:09:29,000
+But as always, let's review on this and multiple common weakness.
+
+105
+00:09:29,000 --> 00:09:39,000
+Enumerations then include but not limited to CW e 209 generation of error message contains sensitive
+
+106
+00:09:39,000 --> 00:09:40,000
+information.
+
+107
+00:09:40,000 --> 00:09:47,000
+This may happen in case you handle exception and you need a full locks of exception.
+
+108
+00:09:48,000 --> 00:09:49,000
+This is just an example.
+
+109
+00:09:49,000 --> 00:09:53,000
+The full walk of exception may contain sensitive information.
+
+110
+00:09:54,000 --> 00:09:59,000
+cwe2 hundred 56 Unprotected storage of credentials.
+
+111
+00:10:00,000 --> 00:10:07,000
+Password management issues appear when the password is stored in plain text, in applications, properties,
+
+112
+00:10:07,000 --> 00:10:09,000
+configuration, file or memory.
+
+113
+00:10:10,000 --> 00:10:17,000
+We partially touched this topic in our lesson about cryptographic failures, and I told you even that
+
+114
+00:10:17,000 --> 00:10:25,000
+the storage sensitive data is in non encrypted form is not the best design decision that you can take.
+
+115
+00:10:25,000 --> 00:10:28,000
+This is also one of the cases of insecure design.
+
+116
+00:10:29,000 --> 00:10:36,000
+Storing the plaintext possible in a configuration file allows anyone who can reads a file accessed as
+
+117
+00:10:36,000 --> 00:10:38,000
+a password protected to source.
+
+118
+00:10:38,000 --> 00:10:46,000
+In some contexts, even storage of a plaintext passwords in memory is considered the security is the
+
+119
+00:10:46,000 --> 00:10:49,000
+password is not immediately updated.
+
+120
+00:10:49,000 --> 00:10:55,000
+ccwe5 hundred one Trust memory violation.
+
+121
+00:10:55,000 --> 00:11:05,000
+A transboundary can be thought of as a line drawn, so a program on one side of the line data is untrusted.
+
+122
+00:11:05,000 --> 00:11:10,000
+On the other side of the line, data is assumed to be trustworthy.
+
+123
+00:11:10,000 --> 00:11:18,000
+The purpose of validation logic is to allow data to safely cross the trust boundary, to move from trusted
+
+124
+00:11:18,000 --> 00:11:19,000
+to trust.
+
+125
+00:11:20,000 --> 00:11:26,000
+A trust boundary violation occurs when a program blurs the line between what is trusted and what isn't
+
+126
+00:11:26,000 --> 00:11:27,000
+trusted.
+
+127
+00:11:28,000 --> 00:11:34,000
+By combining trusted and trusted data in the same data structure, it becomes easier for programmers
+
+128
+00:11:34,000 --> 00:11:37,000
+to mistakenly trust and validate data.
+
+129
+00:11:38,000 --> 00:11:43,000
+ce5 hundred 22 Insufficiently Protected Credentials.
+
+130
+00:11:44,000 --> 00:11:51,000
+The Port of Trust meets all sorts of syndication credentials, but it uses an insecure mass that is
+
+131
+00:11:51,000 --> 00:11:55,000
+susceptible to unauthorized interception and or retrieval.
+
+132
+00:11:57,000 --> 00:12:01,000
+When progress of that now what is insecure design risk category?
+
+133
+00:12:02,000 --> 00:12:06,000
+But let's learn now more what action insecure design is.
+
+134
+00:12:07,000 --> 00:12:13,000
+Secure design is a culture and muscle knowledge is constantly evolving its threats and ensures that
+
+135
+00:12:13,000 --> 00:12:22,000
+code is robustly designed and tested to prevent known attack methods, security design concerns, processes
+
+136
+00:12:22,000 --> 00:12:30,000
+and activities related to how an organization defines goals and creates software within development
+
+137
+00:12:30,000 --> 00:12:31,000
+projects.
+
+138
+00:12:31,000 --> 00:12:39,000
+In general, this includes requirements gathering, high level architecture specifications and detailed
+
+139
+00:12:39,000 --> 00:12:40,000
+design.
+
+140
+00:12:41,000 --> 00:12:46,000
+Secure design is about the whole process where different parties are involved.
+
+141
+00:12:46,000 --> 00:12:53,000
+Namely, threat modelling should be integrated into refinement sessions or other similar activities.
+
+142
+00:12:53,000 --> 00:12:58,000
+We should be advising about security design on the stage and requirements refinement.
+
+143
+00:12:59,000 --> 00:13:07,000
+We should also look for changes in data flows and access control or other security controls, user development
+
+144
+00:13:07,000 --> 00:13:09,000
+and implementation.
+
+145
+00:13:09,000 --> 00:13:14,000
+We should always check different states of the system, including failing states.
+
+146
+00:13:14,000 --> 00:13:21,000
+We need to ensure that they are well-understood and agreed upon by responsible and important parties,
+
+147
+00:13:21,000 --> 00:13:29,000
+analyze assumptions and conditions for expected and failure flows, ensure they are still accurate and
+
+148
+00:13:29,000 --> 00:13:29,000
+desirable.
+
+149
+00:13:30,000 --> 00:13:37,000
+The to learn how to validate the assumptions and enforce conditions needed for proper behaviors, not
+
+150
+00:13:37,000 --> 00:13:41,000
+for mistakes, offer positive incentives to promote improvements.
+
+151
+00:13:42,000 --> 00:13:47,000
+Security design is used and on more tools that we can add to software.
+
+152
+00:13:48,000 --> 00:13:51,000
+We talked a few times already about smart modeling.
+
+153
+00:13:52,000 --> 00:13:55,000
+Let's learn what is it and how it can help us.
+
+154
+00:13:56,000 --> 00:14:03,000
+The Smith model practice focuses on identification and understanding of project model, at least based
+
+155
+00:14:03,000 --> 00:14:09,000
+on the functionality of the software being developed as the characteristics of the runtime environment.
+
+156
+00:14:09,000 --> 00:14:17,000
+From details about smarts and the likely attacks against each project, organization operates more effectively.
+
+157
+00:14:17,000 --> 00:14:22,000
+So better decisions about the prioritization of initiatives for security.
+
+158
+00:14:22,000 --> 00:14:30,000
+Additionally, decisions for these samples are more informed, therefore better aligned to the business
+
+159
+00:14:30,000 --> 00:14:33,000
+at the highest levels of the threat model.
+
+160
+00:14:33,000 --> 00:14:38,000
+We ask four key questions What are we working on?
+
+161
+00:14:38,000 --> 00:14:39,000
+What can go wrong?
+
+162
+00:14:40,000 --> 00:14:42,000
+What are we going to do about it?
+
+163
+00:14:43,000 --> 00:14:51,000
+Did we do a good enough job or was recommends that organizations under threat want them to identify
+
+164
+00:14:51,000 --> 00:14:53,000
+vulnerabilities in the design phase?
+
+165
+00:14:54,000 --> 00:15:01,000
+This allows developers and security teams to avoid those design mistakes that might not be identified,
+
+166
+00:15:01,000 --> 00:15:02,000
+but later down the line.
+
+167
+00:15:03,000 --> 00:15:10,000
+It also saves organizations time and money by finding and addressing all the potential threats.
+
+168
+00:15:11,000 --> 00:15:17,000
+Where do you work with escalations later in the development process by implementing threat models as
+
+169
+00:15:17,000 --> 00:15:18,000
+a design phase.
+
+170
+00:15:19,000 --> 00:15:27,000
+Security starts to be baked into new code first and more so automation and access to comprehensive standards.
+
+171
+00:15:27,000 --> 00:15:28,000
+Libraries.
+
+172
+00:15:28,000 --> 00:15:35,000
+Swet models can go on throughout the secure development lifecycle, ensuring that the owner abilities
+
+173
+00:15:35,000 --> 00:15:38,000
+are continuously mitigated by quantum matters.
+
+174
+00:15:38,000 --> 00:15:41,000
+So why do we have to do threat modeling?
+
+175
+00:15:42,000 --> 00:15:44,000
+What glow we want to achieve?
+
+176
+00:15:44,000 --> 00:15:50,000
+One of the performs threat modeling would begin to recognize what can go wrong in the system.
+
+177
+00:15:50,000 --> 00:15:57,000
+And this is the main role of strength modeling, because knowing what potentially can go wrong, you
+
+178
+00:15:57,000 --> 00:16:03,000
+start thinking about how you would deal with this in your system and you take this into account in your
+
+179
+00:16:03,000 --> 00:16:04,000
+design.
+
+180
+00:16:05,000 --> 00:16:12,000
+The outputs of the sweat model, which are known as threats, informs decisions that you might make
+
+181
+00:16:12,000 --> 00:16:17,000
+in subsequent design, development, testing and post-deployment phases.
+
+182
+00:16:17,000 --> 00:16:25,000
+I also would like to highlight everyone in the team whose concerns about safety and security of your
+
+183
+00:16:25,000 --> 00:16:28,000
+system is empowered to conduct threats.
+
+184
+00:16:28,000 --> 00:16:36,000
+More of them who can work on threats together as a refinement session or during any other similar turbulence.
+
+185
+00:16:37,000 --> 00:16:41,000
+There's also threats, modeling, manifestos that I'd like to discuss with you too.
+
+186
+00:16:42,000 --> 00:16:44,000
+What these threats model the manifesto.
+
+187
+00:16:45,000 --> 00:16:53,000
+First of all, mentions manifesto is a guide to develop or find a missile that best suits your needs
+
+188
+00:16:53,000 --> 00:17:00,000
+greater than manifest, and believe that all of that guidance is a manifesto will result in more effective
+
+189
+00:17:00,000 --> 00:17:04,000
+and more productive threats, one of them in charge.
+
+190
+00:17:04,000 --> 00:17:10,000
+This will help you to successfully develop more secure applications, systems and organizations and
+
+191
+00:17:10,000 --> 00:17:14,000
+protect them from threats and services.
+
+192
+00:17:15,000 --> 00:17:23,000
+The manifesto contains ideas but is not how to handle business and knowledge agnostic the threat model
+
+193
+00:17:24,000 --> 00:17:26,000
+that includes values and principles.
+
+194
+00:17:27,000 --> 00:17:29,000
+Let's review values first.
+
+195
+00:17:29,000 --> 00:17:30,000
+Values threats.
+
+196
+00:17:30,000 --> 00:17:35,000
+Modeling is something that has relative US merit or importance.
+
+197
+00:17:35,000 --> 00:17:42,000
+It is sad and manifest is that while there is a value in the items on the right, you values the items
+
+198
+00:17:42,000 --> 00:17:43,000
+on the left more.
+
+199
+00:17:44,000 --> 00:17:52,000
+A Culture of finding and fixing design issues over check checkbooks, compliance, people, and collaboration
+
+200
+00:17:52,000 --> 00:17:54,000
+over processes for the religious impulse.
+
+201
+00:17:55,000 --> 00:17:59,000
+A journey of understanding of a security or progress.
+
+202
+00:17:59,000 --> 00:18:07,000
+A snapshot bootstrap model of a talking about continuous refinement over a C of the label.
+
+203
+00:18:08,000 --> 00:18:09,000
+If you are from you I was a gentleman.
+
+204
+00:18:09,000 --> 00:18:16,000
+The first thing you can notice that he used similar format as it is used in Agile Manifesto.
+
+205
+00:18:17,000 --> 00:18:21,000
+Let's review principles of stress modeling manifesting now.
+
+206
+00:18:21,000 --> 00:18:25,000
+A principle describes the fundamental truths of sports modelling.
+
+207
+00:18:26,000 --> 00:18:33,000
+There are three types of principles from the manual, primary or general tools that enable successful
+
+208
+00:18:33,000 --> 00:18:39,000
+modelling part of the highly recommended and onto parts that should be avoided.
+
+209
+00:18:40,000 --> 00:18:47,000
+There are the following principles in the manifesto The best use of sweat modelling is to improve the
+
+210
+00:18:47,000 --> 00:18:49,000
+security and privacy of the systems.
+
+211
+00:18:50,000 --> 00:18:58,000
+Early on, analysis threat modelling must align with an organisation's development practices and follow
+
+212
+00:18:58,000 --> 00:19:04,000
+design changes and iterations that each scope to manageable portions of the system.
+
+213
+00:19:05,000 --> 00:19:11,000
+The outcomes of threat model are meaningful once they are of value to stakeholders.
+
+214
+00:19:12,000 --> 00:19:19,000
+Dialogue is key that establishes a common understandings that meet the value, while documents, record
+
+215
+00:19:19,000 --> 00:19:22,000
+results, understandings and enable measurement.
+
+216
+00:19:23,000 --> 00:19:29,000
+As I already said, values and principles is more like these methods that will determine the opportunities.
+
+217
+00:19:30,000 --> 00:19:37,000
+They don't contain any specifics and just to set their actions and their technology agnostic.
+

73 - OWASP Top 10 2021/010 Insecure Design (Secure Design Process, Security Controls, Metrics, Examples)_en.srt

@@ -0,0 +1,1036 @@
+1
+00:00:03,000 --> 00:00:07,000
+I want to highlight that security design is not a one time action.
+
+2
+00:00:08,000 --> 00:00:11,000
+It is not something you can do in one hour or so.
+
+3
+00:00:12,000 --> 00:00:18,000
+It is a systematic, regular set of actions directed on creation of the sea floor design.
+
+4
+00:00:19,000 --> 00:00:21,000
+And I want you on the stands then.
+
+5
+00:00:22,000 --> 00:00:25,000
+That's why now I'd like to start with you.
+
+6
+00:00:25,000 --> 00:00:26,000
+Was you castles?
+
+7
+00:00:26,000 --> 00:00:30,000
+Do you have to build to ensure secure design on your project?
+
+8
+00:00:30,000 --> 00:00:37,000
+This process includes steps and actions and artifacts that will help you to avoid creation of insecure
+
+9
+00:00:37,000 --> 00:00:46,000
+design and will significantly decrease the community of introducing vulnerabilities related to insecure
+
+10
+00:00:46,000 --> 00:00:46,000
+design.
+
+11
+00:00:47,000 --> 00:00:50,000
+The whole process consists of the following steps.
+
+12
+00:00:51,000 --> 00:00:55,000
+Security Requirements Gathering Definition of compliance requirements.
+
+13
+00:00:55,000 --> 00:00:59,000
+According to the Project on the Market, specific actions.
+
+14
+00:00:59,000 --> 00:01:06,000
+Business Impact Analysis Turning security requirements into regular tickets according to the Selected
+
+15
+00:01:06,000 --> 00:01:08,000
+Software Development Lifecycle.
+
+16
+00:01:09,000 --> 00:01:13,000
+Creation of Architecture of Application, Feature or component.
+
+17
+00:01:14,000 --> 00:01:22,000
+Once requirements will summarize the requirements of code, refinement and estimation of security requirements.
+
+18
+00:01:23,000 --> 00:01:25,000
+Holdings, Threat Modeling Activities.
+
+19
+00:01:26,000 --> 00:01:31,000
+Creation of Threat Register Creation of List of Security Controls.
+
+20
+00:01:32,000 --> 00:01:33,000
+Execution of Gap Analysis.
+
+21
+00:01:34,000 --> 00:01:36,000
+Creation of Security Design Document.
+
+22
+00:01:37,000 --> 00:01:43,000
+We're going to review each step in our lesson one by one, probably.
+
+23
+00:01:43,000 --> 00:01:49,000
+If you'll watch my courses and you'll be aware that I have my consultancy company and that I perform
+
+24
+00:01:49,000 --> 00:01:51,000
+audits of software projects.
+
+25
+00:01:52,000 --> 00:01:58,000
+Usually I make the review of different sides of the project maturity level of engineering, excellence
+
+26
+00:01:58,000 --> 00:02:02,000
+practices, engineering, project management courses.
+
+27
+00:02:02,000 --> 00:02:11,000
+I developed my own delivery model to assess software projects and framework that I develop goes together
+
+28
+00:02:11,000 --> 00:02:15,000
+with guidelines it is recommended to follow to build mature courses.
+
+29
+00:02:16,000 --> 00:02:22,000
+Now I'd like to review is your one of such guidelines dedicated to building mature processes in the
+
+30
+00:02:22,000 --> 00:02:30,000
+organization, the delivery team that will ensure secure design, no matter whether you are developer,
+
+31
+00:02:30,000 --> 00:02:37,000
+faculty or delivery manager understanding of suggested guideline will bring the team to the next quality
+
+32
+00:02:38,000 --> 00:02:38,000
+level.
+
+33
+00:02:39,000 --> 00:02:40,000
+Definitely.
+
+34
+00:02:40,000 --> 00:02:46,000
+I will not share with you all the details, including causal samples, process outputs, responsible
+
+35
+00:02:46,000 --> 00:02:52,000
+people, occurrences, arrests and matches because there is no need in this at the moment.
+
+36
+00:02:53,000 --> 00:02:56,000
+So this assumption would encourage you in my consultancy role.
+
+37
+00:02:56,000 --> 00:03:03,000
+But instead I will highlight the main steps and main goals that we want and that we need to achieve
+
+38
+00:03:03,000 --> 00:03:05,000
+while building civil design of our system.
+
+39
+00:03:06,000 --> 00:03:07,000
+Let's stop.
+
+40
+00:03:08,000 --> 00:03:15,000
+The first step in our process is to identify and gather security requirements, collect and negotiate.
+
+41
+00:03:15,000 --> 00:03:21,000
+The business requirements for an application with the business includes the protection requirements
+
+42
+00:03:21,000 --> 00:03:30,000
+concerning confidentiality, integrity of of ability and authenticity of all data assets on the expected
+
+43
+00:03:30,000 --> 00:03:40,000
+business logic take into account how exposed your application will be and conservation of tenants compiles
+
+44
+00:03:40,000 --> 00:03:44,000
+the technical requirements, including functional and nonfunctional security requirements.
+
+45
+00:03:45,000 --> 00:03:50,000
+On this slide, you can see suggested four months for the security requirements list.
+
+46
+00:03:50,000 --> 00:03:59,000
+There are concerns that are used to suggest a template c stands for confidentiality, IE stands for
+
+47
+00:03:59,000 --> 00:04:02,000
+integrity and stands for availability.
+
+48
+00:04:02,000 --> 00:04:08,000
+A use stands for authenticity and stands for repudiation.
+
+49
+00:04:09,000 --> 00:04:17,000
+Not of reconciliation is an assurance that someone can deny the validity of something basic human right,
+
+50
+00:04:17,000 --> 00:04:20,000
+business requirement, functional or nonfunctional.
+
+51
+00:04:20,000 --> 00:04:28,000
+You map it was a component and you specify a requirements associated with this business requirement.
+
+52
+00:04:29,000 --> 00:04:31,000
+All team participates in this process.
+
+53
+00:04:32,000 --> 00:04:37,000
+Separately, I'd like to highlight the role of the compliance team and business analysis team.
+
+54
+00:04:38,000 --> 00:04:44,000
+The business analyst should define the list of compliance requirements, according to the project and
+
+55
+00:04:44,000 --> 00:04:46,000
+market specific achievements.
+
+56
+00:04:46,000 --> 00:04:54,000
+While compliance security requirements, we should also hold a business impact analysis because some
+
+57
+00:04:54,000 --> 00:04:57,000
+of the requirements will come from the business impact analysis.
+
+58
+00:04:58,000 --> 00:05:03,000
+Once you hold, you will be able to understand security requirements better.
+
+59
+00:05:04,000 --> 00:05:12,000
+That's why I believe it's my big idea to show you how impact analysis can be, how on this slide you
+
+60
+00:05:12,000 --> 00:05:14,000
+can see example of business impact analysis.
+
+61
+00:05:15,000 --> 00:05:18,000
+You can think about different business impact types.
+
+62
+00:05:19,000 --> 00:05:24,000
+After that, you can classify level of impact from 0 to 5.
+
+63
+00:05:25,000 --> 00:05:30,000
+Zero means no impact at all and five means catastrophic impact.
+
+64
+00:05:31,000 --> 00:05:38,000
+And you can map specific impact criteria next to each level of impact and having a list of security
+
+65
+00:05:38,000 --> 00:05:39,000
+requirements.
+
+66
+00:05:39,000 --> 00:05:46,000
+You can prioritize those by business, impact the business panels to come the compliance requirements
+
+67
+00:05:46,000 --> 00:05:49,000
+and results of business impact analysis.
+
+68
+00:05:49,000 --> 00:05:52,000
+The full set of internal security requirements.
+
+69
+00:05:53,000 --> 00:05:54,000
+In the move.
+
+70
+00:05:54,000 --> 00:06:02,000
+I'm going to show you where and how we use this impact classification will use it as a threat modeling
+
+71
+00:06:02,000 --> 00:06:09,000
+to feel free to explore a suggested template for business impact analysis.
+
+72
+00:06:10,000 --> 00:06:17,000
+In this particular case, I show the example only for business impact types, legal and financial.
+
+73
+00:06:18,000 --> 00:06:21,000
+But you can also specify all the business impact types.
+
+74
+00:06:22,000 --> 00:06:30,000
+One year that was the view of this slide resumes if you do and let's move on all this that once you
+
+75
+00:06:30,000 --> 00:06:37,000
+gather security requirements in this list it is better to translate into regular status according to
+
+76
+00:06:37,000 --> 00:06:43,000
+the selected software development lifecycle on track implementation of the security requirements on
+
+77
+00:06:43,000 --> 00:06:50,000
+the same level and in the same way as tracking implementation of the functional and functional requirements.
+
+78
+00:06:50,000 --> 00:06:58,000
+Because usually when I ask teams, what are your store security requirements, we find that some security
+
+79
+00:06:58,000 --> 00:07:01,000
+requirements are stored in the emails.
+
+80
+00:07:01,000 --> 00:07:07,000
+Something was discussed in the messenger, something was documented in conference or other kind of knowledge
+
+81
+00:07:07,000 --> 00:07:08,000
+base.
+
+82
+00:07:08,000 --> 00:07:10,000
+Something was captured and taken.
+
+83
+00:07:11,000 --> 00:07:13,000
+This is not how this should work.
+
+84
+00:07:13,000 --> 00:07:19,000
+You should apply the same workflow for security requirements as for other requirements.
+
+85
+00:07:19,000 --> 00:07:21,000
+That is a key to success.
+
+86
+00:07:22,000 --> 00:07:26,000
+Architect should define architecture of your application feature or component.
+
+87
+00:07:27,000 --> 00:07:33,000
+This is designing courses that should already take into account security requirements for events or
+
+88
+00:07:33,000 --> 00:07:34,000
+regular flow.
+
+89
+00:07:34,000 --> 00:07:37,000
+Tickets should be refined and estimated.
+
+90
+00:07:37,000 --> 00:07:44,000
+Sometimes it is hard to separate functional implementation and security inquiries, so it is also possible
+
+91
+00:07:45,000 --> 00:07:50,000
+that most often security requirements will become part of the feature implementation.
+
+92
+00:07:50,000 --> 00:07:51,000
+And that is fine.
+
+93
+00:07:52,000 --> 00:07:53,000
+You shouldn't be afraid of that.
+
+94
+00:07:54,000 --> 00:07:54,000
+Definitely.
+
+95
+00:07:54,000 --> 00:08:02,000
+There will be owners, managers and marketers who ask you to decrease development estimates constantly
+
+96
+00:08:02,000 --> 00:08:03,000
+challenging you.
+
+97
+00:08:03,000 --> 00:08:09,000
+Whether you need to spend some time on the implementation of security controls right now, or it can
+
+98
+00:08:09,000 --> 00:08:16,000
+be put into separate, taken and left as a technical debt, then me, once you create technical date,
+
+99
+00:08:16,000 --> 00:08:18,000
+that means you can forget about it.
+
+100
+00:08:19,000 --> 00:08:25,000
+The dynamic of I.T and software development doesn't allow to look back.
+
+101
+00:08:25,000 --> 00:08:26,000
+Never.
+
+102
+00:08:26,000 --> 00:08:33,000
+That's why I want to ask you to stay strong and highlight the importance and necessity of implementation
+
+103
+00:08:33,000 --> 00:08:37,000
+of security controls and secure design during the future.
+
+104
+00:08:37,000 --> 00:08:45,000
+Development program is always a matter of tradeoffs between business and technology and speed and quality.
+
+105
+00:08:45,000 --> 00:08:52,000
+Let's remember, business and technology should go hand in hand with each other, and you will win the
+
+106
+00:08:52,000 --> 00:08:59,000
+market only if you can find the right balance based on all information, gather the action that can
+
+107
+00:08:59,000 --> 00:09:01,000
+conduct smart modeling.
+
+108
+00:09:01,000 --> 00:09:07,000
+Having all this information means that we have enough information to model different threats.
+
+109
+00:09:07,000 --> 00:09:13,000
+Like I already said, this experience, it can be done by all team or any team member.
+
+110
+00:09:13,000 --> 00:09:19,000
+But definitely if you have security using your team, this person has enough skills.
+
+111
+00:09:19,000 --> 00:09:23,000
+Someone knows threats based on his or her experience.
+
+112
+00:09:24,000 --> 00:09:28,000
+On this slide, you can see an example of Sweat's register and how it can look.
+
+113
+00:09:29,000 --> 00:09:34,000
+Basically you can come up with your own way to search for sweat register.
+
+114
+00:09:34,000 --> 00:09:38,000
+I just suggest the one that I use on my projects.
+
+115
+00:09:39,000 --> 00:09:44,000
+Most of the columns are self-described sweat type and go one of the following.
+
+116
+00:09:44,000 --> 00:09:54,000
+See confidentiality, integrity, a availability, a you authenticity and non reconciliation.
+
+117
+00:09:55,000 --> 00:09:58,000
+The following columns US Red Thread Description.
+
+118
+00:09:59,000 --> 00:10:06,000
+If you don't have any questions regarding Zeus, in case there are any questions, please do not hesitate
+
+119
+00:10:06,000 --> 00:10:11,000
+to ask your questions below this video and I will be happy to answer.
+
+120
+00:10:12,000 --> 00:10:17,000
+And acid is an integral device as a component of an organization's systems.
+
+121
+00:10:18,000 --> 00:10:25,000
+It is valuable often because it contains sensitive data or can be used to access such information,
+
+122
+00:10:26,000 --> 00:10:30,000
+or that impact will review and learns how to classify and pack.
+
+123
+00:10:31,000 --> 00:10:38,000
+For example, you can see that sensitive data leakage is catastrophic, legal and regulatory impact.
+
+124
+00:10:39,000 --> 00:10:44,000
+Thus, this is critical importance of this security requirement.
+
+125
+00:10:44,000 --> 00:10:47,000
+Is it clear that's how it works?
+
+126
+00:10:48,000 --> 00:10:51,000
+Probability is basically probability of stress.
+
+127
+00:10:51,000 --> 00:10:56,000
+Assume in most cases this is most subjective evaluation.
+
+128
+00:10:56,000 --> 00:11:02,000
+Whereas as an objective is a mitigation column, you can just paste idea of security control.
+
+129
+00:11:03,000 --> 00:11:10,000
+In a minute we are going to review how the lethal security controls can look like and basically risk
+
+130
+00:11:10,000 --> 00:11:13,000
+corner is a person who is in charge of managing this threat.
+
+131
+00:11:13,000 --> 00:11:21,000
+Thought the security engineer should identify and understand project level threats based on the functionality
+
+132
+00:11:21,000 --> 00:11:25,000
+of the software being developed on the characteristics of the runtime environment.
+
+133
+00:11:26,000 --> 00:11:31,000
+I also promised to show you how the list of security controls can look good.
+
+134
+00:11:32,000 --> 00:11:36,000
+On this slide, you can see just the structure of the security control list.
+
+135
+00:11:37,000 --> 00:11:40,000
+You can refer to each security control by its ID.
+
+136
+00:11:41,000 --> 00:11:45,000
+So this is also one of the steps in our process to create a design.
+
+137
+00:11:46,000 --> 00:11:50,000
+And this step is called Great List of Security Controls.
+
+138
+00:11:50,000 --> 00:11:57,000
+One more time let's formalize the term of security control and need to define what it is.
+
+139
+00:11:58,000 --> 00:12:06,000
+Security controls are parameters implemented to protect various forms of data and infrastructure important
+
+140
+00:12:06,000 --> 00:12:15,000
+to an organization and any type of safeguard as it used to avoid, detect, contract or minimize security
+
+141
+00:12:15,000 --> 00:12:22,000
+risks to physical property information, computer systems or other assets is considered as security
+
+142
+00:12:22,000 --> 00:12:23,000
+control.
+
+143
+00:12:24,000 --> 00:12:32,000
+There are different types of security controls, zero physical security controls that include such things
+
+144
+00:12:32,000 --> 00:12:39,000
+as Staples Center, perimeter fence and locks, guards access control cards, biometric access control
+
+145
+00:12:39,000 --> 00:12:45,000
+systems, surveillance cameras and intrusion detection sensors.
+
+146
+00:12:46,000 --> 00:12:51,000
+Digital security controls include such things as usernames and passwords.
+
+147
+00:12:51,000 --> 00:12:56,000
+Two factor authentication antivirus software and firewalls.
+
+148
+00:12:57,000 --> 00:13:04,000
+Cybersecurity controls include anything specifically designed to prevent attacks on data, including
+
+149
+00:13:04,000 --> 00:13:08,000
+the loss mitigation and intrusion prevention systems.
+
+150
+00:13:09,000 --> 00:13:17,000
+Cloud security controls include measures it takes in cooperation with a cloud services provider to ensure
+
+151
+00:13:17,000 --> 00:13:20,000
+the necessary protection for data and workloads.
+
+152
+00:13:21,000 --> 00:13:24,000
+Improvisation runs workloads on the cloud.
+
+153
+00:13:25,000 --> 00:13:31,000
+You must needs a corporate or business policy, security requirements and industry regulations.
+
+154
+00:13:32,000 --> 00:13:41,000
+And just as a reference a cloud work log Zen is an application service type ability or a specified amount
+
+155
+00:13:41,000 --> 00:13:47,000
+of work that consumes cloud based resources such as computing or memory power.
+
+156
+00:13:48,000 --> 00:13:54,000
+Also, it is recommended to do a few things to ensure a secure design defines the current status of
+
+157
+00:13:54,000 --> 00:14:02,000
+security controls, covering integrity, confidentiality, access, control, etc. defines the current
+
+158
+00:14:02,000 --> 00:14:08,000
+status of security controls, conference ID, Business Continuity Plan, Disaster Recovery Plan, Project
+
+159
+00:14:08,000 --> 00:14:10,000
+Management, Change Management.
+
+160
+00:14:10,000 --> 00:14:15,000
+So security controls can look like you see on the slide.
+
+161
+00:14:16,000 --> 00:14:20,000
+Security engineers should also perform gap analysis.
+
+162
+00:14:21,000 --> 00:14:28,000
+The security engineer should compare the required security controls and existing legacy controls of
+
+163
+00:14:28,000 --> 00:14:28,000
+the project.
+
+164
+00:14:29,000 --> 00:14:36,000
+On this slide, you can see suggested data structure, whereas the results of this analysis can be stored.
+
+165
+00:14:37,000 --> 00:14:42,000
+After gaps are identified, the team has to work on resolving these gaps.
+
+166
+00:14:43,000 --> 00:14:48,000
+All the steps that we have reviewed should be summarized in the security design document.
+
+167
+00:14:49,000 --> 00:14:56,000
+Security Design document is a comprehensive artifact that I would be able to put on the one single slot.
+
+168
+00:14:57,000 --> 00:14:59,000
+It contains different sections.
+
+169
+00:14:59,000 --> 00:15:07,000
+The main sections should be covered in a document approach conceptual infrastructure security, interview
+
+170
+00:15:07,000 --> 00:15:11,000
+areas, conceptual security design processes.
+
+171
+00:15:11,000 --> 00:15:12,000
+Conceptual Situation.
+
+172
+00:15:12,000 --> 00:15:15,000
+Infrastructure Architecture Design.
+
+173
+00:15:15,000 --> 00:15:16,000
+Security Design.
+
+174
+00:15:17,000 --> 00:15:21,000
+Each of these sections may contain all sections.
+
+175
+00:15:21,000 --> 00:15:28,000
+For example, as a conceptual security infrastructure, architecture design can also cover security
+
+176
+00:15:28,000 --> 00:15:35,000
+policy, security threats, network security, software, application security and others.
+
+177
+00:15:35,000 --> 00:15:42,000
+I would say that the content of this document depends on the actual project that the work on.
+
+178
+00:15:42,000 --> 00:15:49,000
+This is also part of my job as a consultant on the licenses on the project and support team was the
+
+179
+00:15:49,000 --> 00:15:56,000
+summation of the direction where all the team were to go, including software engineering team.
+
+180
+00:15:56,000 --> 00:16:03,000
+All this process that we have discussed should go together with measure and causal metrics and understand
+
+181
+00:16:03,000 --> 00:16:10,000
+that chance and dynamics, because without it, we won't be able to answer whether we are doing a good
+
+182
+00:16:10,000 --> 00:16:11,000
+job or not.
+
+183
+00:16:12,000 --> 00:16:18,000
+Zircon, the different magics applied to measure the effectiveness of the causes of build insecure design.
+
+184
+00:16:19,000 --> 00:16:26,000
+But some of them are metrics of threats, religious, the number of threats, open number of threats,
+
+185
+00:16:26,000 --> 00:16:34,000
+closed number of sites, mitigated metrics of requirements list number of requirements not process number
+
+186
+00:16:34,000 --> 00:16:42,000
+of requirements importance number of requirements done matchups of control list number of controls to
+
+187
+00:16:42,000 --> 00:16:49,000
+do number of controls and process number of controls in review number of controls.
+
+188
+00:16:49,000 --> 00:16:56,000
+Don't measure these metrics, store them, add them into this system or regular reports.
+
+189
+00:16:56,000 --> 00:17:01,000
+Builds trends to understand how efficiency and the team work on secure design.
+
+190
+00:17:02,000 --> 00:17:05,000
+Now let's review example of parts.
+
+191
+00:17:06,000 --> 00:17:12,000
+Example number one will review reviewed with one example as the beginning of this lesson.
+
+192
+00:17:12,000 --> 00:17:19,000
+Let me recall, not so long ago, questions were used to restore access.
+
+193
+00:17:19,000 --> 00:17:25,000
+I if you are familiar with this scenario, you and registration, you are asked about secret question,
+
+194
+00:17:26,000 --> 00:17:28,000
+the name of your pad or something like this.
+
+195
+00:17:29,000 --> 00:17:33,000
+And the answer is used when you need to restore access to your account.
+
+196
+00:17:34,000 --> 00:17:40,000
+It is not a mainstream anymore, primarily because of the potential vulnerabilities caused by insecure
+
+197
+00:17:40,000 --> 00:17:41,000
+design.
+
+198
+00:17:42,000 --> 00:17:45,000
+I must top them, have lots of questions and answers.
+
+199
+00:17:45,000 --> 00:17:53,000
+Can't be trusted as evidence of identity, as more than one person can knows the answers, which is
+
+200
+00:17:53,000 --> 00:17:54,000
+why they are prohibited.
+
+201
+00:17:55,000 --> 00:17:59,000
+Such codes should be removed and replaced with a more secure design.
+
+202
+00:18:00,000 --> 00:18:08,000
+Example number two Imagine that we developed software for cinema chain and according to design required
+
+203
+00:18:08,000 --> 00:18:12,000
+the only in case 50 attendees book tickets together at once.
+
+204
+00:18:13,000 --> 00:18:18,000
+In all other cases, we trust our customers and they can book tickets.
+
+205
+00:18:18,000 --> 00:18:22,000
+And why the ticket office once they will come to the cinema.
+
+206
+00:18:23,000 --> 00:18:25,000
+This is also an example of insecure design.
+
+207
+00:18:26,000 --> 00:18:33,000
+If all of the analyzed business impact, discuss different scenarios, gather security requirements
+
+208
+00:18:33,000 --> 00:18:40,000
+and hold threats more, then we will discover that using this behavior, attackers can cause significant
+
+209
+00:18:40,000 --> 00:18:42,000
+impact on our business.
+
+210
+00:18:42,000 --> 00:18:50,000
+I can create a script that will book 1000 seats in the cinema chain, placing orders for 14 tickets
+
+211
+00:18:50,000 --> 00:18:51,000
+for major cinema.
+
+212
+00:18:51,000 --> 00:18:54,000
+This will cause a massive loss of income.
+
+213
+00:18:55,000 --> 00:19:04,000
+Example number three A retail chain e-commerce website doesn't have protection against was run by scalpers
+
+214
+00:19:04,000 --> 00:19:07,000
+buying high end video cards to sell them.
+
+215
+00:19:08,000 --> 00:19:15,000
+This creates terrible publicity for the video parts makers and retail chain owners and doesn't allow
+
+216
+00:19:15,000 --> 00:19:18,000
+people to buy video cards for analysis.
+
+217
+00:19:18,000 --> 00:19:25,000
+And their attackers can write a script, registers accounts and constantly place orders without binds
+
+218
+00:19:25,000 --> 00:19:25,000
+them.
+
+219
+00:19:26,000 --> 00:19:31,000
+Thus, the product is always not in stock and also not sold.
+
+220
+00:19:32,000 --> 00:19:39,000
+People can't buy product because there was 20 minutes to pay order once it was placed.
+
+221
+00:19:40,000 --> 00:19:44,000
+This is also insecure design and attackers can use zuse.
+
+222
+00:19:44,000 --> 00:19:52,000
+When I do this careful and towards design and domain logic rules such as purchases made within a few
+
+223
+00:19:52,000 --> 00:19:59,000
+seconds of availability might identify email sending purchases and reject such transactions.
+
+224
+00:19:59,000 --> 00:20:08,000
+Even this part we have discussed already how to setup causes of any ensure secure design and avoid vulnerability
+
+225
+00:20:08,000 --> 00:20:15,000
+simulated was insecure design even despite all this still, I would like to summarize rules, guides
+
+226
+00:20:15,000 --> 00:20:18,000
+and viruses how to prevent insecure design.
+
+227
+00:20:19,000 --> 00:20:26,000
+Establish and use a secure development lifecycle with security professionals to help evaluate and design
+
+228
+00:20:26,000 --> 00:20:29,000
+security and privacy related controls.
+
+229
+00:20:30,000 --> 00:20:33,000
+This is something we have talked about in all the lesson.
+
+230
+00:20:34,000 --> 00:20:41,000
+Use threat modeling for critical authentication, access control, business logic and key flows.
+
+231
+00:20:41,000 --> 00:20:46,000
+Integrate security and controls into user stories.
+
+232
+00:20:46,000 --> 00:20:48,000
+I also highlighted this one.
+
+233
+00:20:48,000 --> 00:20:55,000
+We talked about the causes we should make work on security items, part of our general development flow.
+
+234
+00:20:56,000 --> 00:21:03,000
+Write an integration test to validate that all critical flows are resistant to this threat model.
+
+235
+00:21:04,000 --> 00:21:04,000
+Compound.
+
+236
+00:21:04,000 --> 00:21:10,000
+Use cases and misuse cases for each type of application.
+
+237
+00:21:10,000 --> 00:21:17,000
+Segregate tilers on the system that requires dependent on the exposure and protection needs.
+
+238
+00:21:18,000 --> 00:21:21,000
+That's all what I wanted to share with you in this lesson.
+
+239
+00:21:22,000 --> 00:21:24,000
+Let's recap what we have learned.
+
+240
+00:21:25,000 --> 00:21:28,000
+This was long, but I'm sure a very useful lesson.
+
+241
+00:21:29,000 --> 00:21:30,000
+I hope you enjoyed it.
+
+242
+00:21:31,000 --> 00:21:37,000
+Today we learned what insecure design is after this lesson, even though there's a difference between
+
+243
+00:21:37,000 --> 00:21:41,000
+insecure design and insecure implementation.
+
+244
+00:21:42,000 --> 00:21:49,000
+Goodman's shift left approach, I explained, is a most notable common defense enumerations.
+
+245
+00:21:50,000 --> 00:21:58,000
+We also learned what a secure design is significant because of our less educated to smart modern vendors,
+
+246
+00:21:58,000 --> 00:22:04,000
+whether this is go freelance or model and manifesto.
+
+247
+00:22:05,000 --> 00:22:06,000
+Now you know what it is.
+
+248
+00:22:06,000 --> 00:22:09,000
+We learned its values and principles.
+
+249
+00:22:10,000 --> 00:22:17,000
+Also use the lesson I explained to how to build a secure design process while talking about security
+
+250
+00:22:17,000 --> 00:22:18,000
+and process.
+
+251
+00:22:18,000 --> 00:22:21,000
+We learned what a business impact analysis is.
+
+252
+00:22:22,000 --> 00:22:27,000
+I even shared a template that you can use as a business impact analysis.
+
+253
+00:22:28,000 --> 00:22:35,000
+I showed you on example how works in a work with sweats, register the learn the concept of security
+
+254
+00:22:35,000 --> 00:22:39,000
+controls and we learned how to create a list of security controls.
+
+255
+00:22:40,000 --> 00:22:44,000
+I explained what a security design document is.
+
+256
+00:22:44,000 --> 00:22:49,000
+We have used examples of attacks and we learned how to prevent them.
+
+257
+00:22:50,000 --> 00:22:51,000
+That's all for this lesson.
+
+258
+00:22:52,000 --> 00:22:53,000
+Thanks for your attention.
+
+259
+00:22:54,000 --> 00:22:56,000
+Have a great day and see you in the next lesson.
+

73 - OWASP Top 10 2021/011 NIST-800-123-Guide-to-General-Server-Security.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-123.pdf

73 - OWASP Top 10 2021/011 NIST-800-207-Zero-Trust-Architecture.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf

73 - OWASP Top 10 2021/011 Security Misconfiguration (Overview, CWEs, Types, Real-life attacks)_en.srt

@@ -0,0 +1,828 @@
+1
+00:00:06,000 --> 00:00:06,000
+Hello Tim.
+
+2
+00:00:06,000 --> 00:00:13,000
+And this has background to talk about security misconfiguration risk category from a wasp top ten will
+
+3
+00:00:13,000 --> 00:00:17,000
+start the lesson from the general overview of this risk category.
+
+4
+00:00:17,000 --> 00:00:22,000
+Probably explain what the potential impact may be caused by security in this configuration.
+
+5
+00:00:23,000 --> 00:00:26,000
+To gather, we'll review the most notable common weakness.
+
+6
+00:00:26,000 --> 00:00:34,000
+Enumerations, as always, will make a comparison between of US Top ten, 20, 21 and 2017.
+
+7
+00:00:35,000 --> 00:00:38,000
+I will explain the different types of security in this configuration.
+
+8
+00:00:39,000 --> 00:00:45,000
+Will reviews the most popular examples of attacks that says Cessful because of the security in this
+
+9
+00:00:45,000 --> 00:00:46,000
+configuration.
+
+10
+00:00:46,000 --> 00:00:54,000
+Also, as we will keep on new topic, I will explain what security hardening is, what zero trust security
+
+11
+00:00:54,000 --> 00:01:03,000
+model is, and what defense and gaps this will learn these new concepts because I believe it is really
+
+12
+00:01:03,000 --> 00:01:08,000
+important to know that will also review best practices for system hardening.
+
+13
+00:01:09,000 --> 00:01:16,000
+And after all this, I'm going to show you them on the example of general web application and review,
+
+14
+00:01:16,000 --> 00:01:22,000
+as is some examples of security misconfiguration vulnerabilities and the zant of this lesson.
+
+15
+00:01:22,000 --> 00:01:28,000
+We're going to make a summary with all what we have learned and will discuss how to prevent security.
+
+16
+00:01:28,000 --> 00:01:32,000
+Misconfigurations Let's start our lesson.
+
+17
+00:01:32,000 --> 00:01:36,000
+Let's name first what security Misconfigurations category is all about.
+
+18
+00:01:37,000 --> 00:01:43,000
+Security Misconfiguration happens when security settings are not properly set during the configuration
+
+19
+00:01:43,000 --> 00:01:48,000
+process or deployed and mine was default settings.
+
+20
+00:01:48,000 --> 00:01:55,000
+One of the most common and frequent occurrence is to configure systems that could affect any of the
+
+21
+00:01:55,000 --> 00:02:02,000
+applications stack, network, layer and cloud misconfigured cloud central core.
+
+22
+00:02:02,000 --> 00:02:09,000
+So data breaches customer organizations millions of dollars common misconfiguration vulnerabilities
+
+23
+00:02:09,000 --> 00:02:16,000
+arise was the use of the following default passwords open database instances.
+
+24
+00:02:16,000 --> 00:02:22,000
+This mode allows any valid user to connect as a database and perform data access operations.
+
+25
+00:02:23,000 --> 00:02:31,000
+Deprecate the protocols and encryption error messages, revealing sensitive information, directly enabled
+
+26
+00:02:32,000 --> 00:02:40,000
+default certificates, misconfigured cloud settings and necessary features such as pages, ports services
+
+27
+00:02:40,000 --> 00:02:48,000
+enabled due to default installation leading to force browsing comments, injection, brute force credential,
+
+28
+00:02:48,000 --> 00:02:49,000
+stuffing, etc..
+
+29
+00:02:50,000 --> 00:02:56,000
+To understand better why security misconfiguration may be dangerous, let's review just some of the
+
+30
+00:02:56,000 --> 00:02:59,000
+potential impacts that may be caused by security.
+
+31
+00:02:59,000 --> 00:03:00,000
+Misconfiguration.
+
+32
+00:03:01,000 --> 00:03:09,000
+Misconfiguration of web server database storage buckets, applications libraries, operating system
+
+33
+00:03:09,000 --> 00:03:15,000
+coding frameworks platforms, virtual machines certificates, encryption settings.
+
+34
+00:03:15,000 --> 00:03:23,000
+Cloud impacts different aspects of vulnerability, integrity and confidentiality triad.
+
+35
+00:03:23,000 --> 00:03:31,000
+Depending on the nature of the vulnerability, this could lead to unauthorized access, account takeover,
+
+36
+00:03:31,000 --> 00:03:39,000
+sensitive data exposure, data, system compromise, and legal and financial implications.
+
+37
+00:03:39,000 --> 00:03:46,000
+As a result of this vulnerability, security misconfigurations can be a result of relatively simple
+
+38
+00:03:46,000 --> 00:03:52,000
+oversights, but can expose an application to attack in certain instances.
+
+39
+00:03:53,000 --> 00:04:01,000
+Use configuration mainly information in schools so a cybercriminal won't even need to carry out an active
+
+40
+00:04:01,000 --> 00:04:02,000
+attack.
+
+41
+00:04:03,000 --> 00:04:09,000
+The low code and data exposed to users big Uris for application security.
+
+42
+00:04:10,000 --> 00:04:17,000
+For example, a misconfigured database server can cause data to be accessible through a basic web search.
+
+43
+00:04:17,000 --> 00:04:25,000
+If this dating pools, administrator, credentials and attack may be able to access the data beyond
+
+44
+00:04:25,000 --> 00:04:29,000
+a database or launch another attack on the company's service.
+
+45
+00:04:30,000 --> 00:04:38,000
+In the case of misconfigured apps and security controls and storage devices, huge amounts of sensitive
+
+46
+00:04:38,000 --> 00:04:41,000
+and personal data can be exposed to the general public.
+
+47
+00:04:41,000 --> 00:04:49,000
+With the internet generally, there is no way of discovering who might have access to this information
+
+48
+00:04:49,000 --> 00:04:50,000
+before it was secure.
+
+49
+00:04:51,000 --> 00:05:00,000
+If you can't block access an application structure attackers can exploit to modify parts of our reverse
+
+50
+00:05:00,000 --> 00:05:03,000
+engineer application attackers.
+
+51
+00:05:03,000 --> 00:05:08,000
+Can exploit it to modify parts of or reverse engineer the application.
+
+52
+00:05:09,000 --> 00:05:15,000
+This might be hard to control if an application is meant for delivery to mobile devices.
+
+53
+00:05:16,000 --> 00:05:22,000
+These are just some potential impacts that may be caused by security misconfiguration.
+
+54
+00:05:22,000 --> 00:05:29,000
+During the last year we're going to review different cases and examples and you will be able to understand
+
+55
+00:05:29,000 --> 00:05:32,000
+all potential impact data by the end of the lesson.
+
+56
+00:05:32,000 --> 00:05:39,000
+As always, let's review notable common weakness enumerations that are associated with this risk category.
+
+57
+00:05:40,000 --> 00:05:40,000
+Zero.
+
+58
+00:05:41,000 --> 00:05:45,000
+CW e6 sim configuration weakness.
+
+59
+00:05:46,000 --> 00:05:50,000
+In this category, I typically introduce as a configuration of the software.
+
+60
+00:05:51,000 --> 00:06:00,000
+This includes but not limited to such vulnerabilities as remote code execution, insecure proxy configuration,
+
+61
+00:06:00,000 --> 00:06:03,000
+denial of service, etc..
+
+62
+00:06:04,000 --> 00:06:06,000
+S.W.A.T. 611.
+
+63
+00:06:07,000 --> 00:06:15,000
+Improper restriction of X amount external entity reference the software processes and excellent documents
+
+64
+00:06:15,000 --> 00:06:23,000
+that contain excellent entities was your eyes that resolve the documents outside of the intense sphere
+
+65
+00:06:23,000 --> 00:06:31,000
+of control, causing all of them that incorrect documents entities output x amount documents optionally
+
+66
+00:06:31,000 --> 00:06:40,000
+contain and document type definition date to the which among closet features labels is a definition
+
+67
+00:06:40,000 --> 00:06:42,000
+of external entities.
+
+68
+00:06:42,000 --> 00:06:50,000
+It is possible to define an entity by providing a substitution string in the form of a you arrive at
+
+69
+00:06:50,000 --> 00:06:59,000
+smoke pass can access the contents of this array and and that this contents back into excellent documents
+
+70
+00:06:59,000 --> 00:07:00,000
+for further processing.
+
+71
+00:07:01,000 --> 00:07:09,000
+Once the content of the you write is read, it is fed back into the application this process since the
+
+72
+00:07:09,000 --> 00:07:10,000
+x amount.
+
+73
+00:07:10,000 --> 00:07:19,000
+This application may echo bags of data, for example, in an error message is thereby exposing the file
+
+74
+00:07:19,000 --> 00:07:20,000
+contents.
+
+75
+00:07:21,000 --> 00:07:25,000
+Let's compare was top ten, 20, 21 and 2017.
+
+76
+00:07:26,000 --> 00:07:29,000
+Mother in software gets increasingly complex.
+
+77
+00:07:30,000 --> 00:07:38,000
+We moved from Simple Systems was one web server and one database to microservice architecture where
+
+78
+00:07:38,000 --> 00:07:41,000
+we have several services deployed on multiple servers.
+
+79
+00:07:42,000 --> 00:07:50,000
+These are connected to the Internet by clusters of reverse proxies and load balancers, Amazon's reusable
+
+80
+00:07:50,000 --> 00:07:56,000
+and used configurations to fit into different environments and applications with increasing amounts
+
+81
+00:07:56,000 --> 00:07:58,000
+of configuration options.
+
+82
+00:07:58,000 --> 00:08:04,000
+It's no wonder that this category moved up in the top ten 2021.
+
+83
+00:08:04,000 --> 00:08:12,000
+Talking about differences, I want to highlight that I was largest external external entities from OWASP
+
+84
+00:08:12,000 --> 00:08:19,000
+top ten 2017 into security misconfiguration this category in our top ten 2021.
+
+85
+00:08:20,000 --> 00:08:26,000
+We already talked with you about the most common reasons of security in this configuration of the beginning
+
+86
+00:08:26,000 --> 00:08:27,000
+of the lesson.
+
+87
+00:08:27,000 --> 00:08:32,000
+I just suggest you use those in more details and more thoroughly.
+
+88
+00:08:32,000 --> 00:08:34,000
+So let's go one by one.
+
+89
+00:08:35,000 --> 00:08:39,000
+Default accounts, passwords, enabled use.
+
+90
+00:08:39,000 --> 00:08:45,000
+And then this five defaults for system accounts and passwords is a common security misconfiguration
+
+91
+00:08:46,000 --> 00:08:50,000
+and may allow attackers to gain unauthorized access to the system.
+
+92
+00:08:51,000 --> 00:08:54,000
+Secure password policy is not implemented.
+
+93
+00:08:54,000 --> 00:09:01,000
+Failure to implement a password policy may allow attackers to gain unauthorized access to the system
+
+94
+00:09:01,000 --> 00:09:09,000
+by masses, such as using this common username and password to brute force the username and password
+
+95
+00:09:09,000 --> 00:09:19,000
+field until successful authentication software is out of date and loss on failure to update software
+
+96
+00:09:19,000 --> 00:09:19,000
+consciousness.
+
+97
+00:09:19,000 --> 00:09:27,000
+Parts of the software management process might allow attackers to use techniques such as code injection
+
+98
+00:09:27,000 --> 00:09:28,000
+to inject malicious code.
+
+99
+00:09:29,000 --> 00:09:35,000
+The applications executes files and directories unprotected.
+
+100
+00:09:35,000 --> 00:09:43,000
+Leaving files and directories unprotected may allow attackers to use techniques such as forceful browsing
+
+101
+00:09:43,000 --> 00:09:52,000
+to gain access to restricted files or areas in the server director and used features enabled or installed.
+
+102
+00:09:53,000 --> 00:09:59,000
+Failing to remove unnecessary features, components, documentation and samples makes the application
+
+103
+00:09:59,000 --> 00:10:06,000
+susceptible to misconfiguration vulnerabilities and may allow attackers to use techniques such as code
+
+104
+00:10:06,000 --> 00:10:11,000
+injection to inject malicious code creations in executes.
+
+105
+00:10:12,000 --> 00:10:16,000
+Security features not maintained or concealed properly.
+
+106
+00:10:17,000 --> 00:10:23,000
+Failure to properly configure and maintain security features makes the application vulnerable in this
+
+107
+00:10:23,000 --> 00:10:24,000
+configuration.
+
+108
+00:10:24,000 --> 00:10:32,000
+Attacks on published URLs are not blocked from receiving traffic from ordinary users, and published
+
+109
+00:10:33,000 --> 00:10:40,000
+URLs accessed by those who are making applications are not intended to receive traffic from ordinary
+
+110
+00:10:40,000 --> 00:10:41,000
+users.
+
+111
+00:10:41,000 --> 00:10:47,000
+Failure to block this use can pose a significant risk when attackers counsel them.
+
+112
+00:10:49,000 --> 00:10:52,000
+Improper or poor application coding practices.
+
+113
+00:10:53,000 --> 00:10:58,000
+Improper coding practices can lead to security misconfiguration attacks, for example.
+
+114
+00:10:59,000 --> 00:11:06,000
+The lack of proper input out data validation may lead to code injection attacks, which work by injecting
+
+115
+00:11:06,000 --> 00:11:08,000
+codes as application executes.
+
+116
+00:11:09,000 --> 00:11:14,000
+By the way, we have separate less involved injection risk category.
+
+117
+00:11:14,000 --> 00:11:16,000
+Feel free to watch it.
+
+118
+00:11:17,000 --> 00:11:25,000
+Directory traversal allows an attacker to access the directories, files and commands that the outside
+
+119
+00:11:25,000 --> 00:11:32,000
+of the directory arm was to access the application source code or configuration and critical system
+
+120
+00:11:32,000 --> 00:11:33,000
+files.
+
+121
+00:11:33,000 --> 00:11:41,000
+Cybercriminal can change a euro in such a way that the creation could execute or displayed the contents
+
+122
+00:11:41,000 --> 00:11:50,000
+of arbitrary files on the server and any device or application reveals an issue based interface is possible
+
+123
+00:11:50,000 --> 00:11:53,000
+vulnerable to the directory traversal attack.
+
+124
+00:11:54,000 --> 00:12:00,000
+As I always say, it is better to use the experience of other organizations rather than advocacy on
+
+125
+00:12:00,000 --> 00:12:01,000
+your own.
+
+126
+00:12:02,000 --> 00:12:09,000
+That's why I believe it will be interesting and very helpful to review the most popular real life configuration
+
+127
+00:12:09,000 --> 00:12:11,000
+attacks from history.
+
+128
+00:12:11,000 --> 00:12:16,000
+By the way, it is also rule of thumb the storage of lessons learned.
+
+129
+00:12:16,000 --> 00:12:23,000
+You can have such storage in the scope of your all organization or in the scope of just one single project.
+
+130
+00:12:24,000 --> 00:12:31,000
+Archive of Lessons Learned is a priceless knowledge base that can help you with repeatable mistakes
+
+131
+00:12:31,000 --> 00:12:33,000
+and avoid the challenges in the future.
+
+132
+00:12:34,000 --> 00:12:43,000
+Example number one Nossa and Gira the first real examples of a or avidity is about not so humble if
+
+133
+00:12:43,000 --> 00:12:51,000
+you no such organization, Zebra Aviation stands for the National Aeronautics and Space Administration.
+
+134
+00:12:51,000 --> 00:12:58,000
+It is an independent agency of the US federal government responsible for the civil space program.
+
+135
+00:12:59,000 --> 00:13:07,000
+I run Multics research and Space Research and Security Research and discovered a security misconfiguration
+
+136
+00:13:07,000 --> 00:13:09,000
+in the collaboration tool JIRA.
+
+137
+00:13:10,000 --> 00:13:19,000
+This single misconfiguration made many Fortune 500 companies and also vulnerable to the release of personal
+
+138
+00:13:19,000 --> 00:13:24,000
+and corporate data and authorization misconfiguration in the global permissions settings.
+
+139
+00:13:24,000 --> 00:13:33,000
+Of course, this data disclosure ones, the dashboards and filters for the projects developed in JIRA
+
+140
+00:13:33,000 --> 00:13:42,000
+Xen by default is a visibility settings of all users and everyone, rather than sharing road map tasks
+
+141
+00:13:42,000 --> 00:13:44,000
+and the like within the organization.
+
+142
+00:13:45,000 --> 00:13:47,000
+Each shared zoom was a problem.
+
+143
+00:13:47,000 --> 00:13:48,000
+Lessons learned.
+
+144
+00:13:49,000 --> 00:13:56,000
+Look at the file sharing configurations in each software as a service to make sure confidential data
+
+145
+00:13:56,000 --> 00:13:58,000
+is not revealed publicly.
+
+146
+00:13:58,000 --> 00:14:02,000
+Example number two Amazon and data breaches.
+
+147
+00:14:03,000 --> 00:14:11,000
+Many organizations experienced data breaches as a result of unsecured storage buckets on Amazon's popular
+
+148
+00:14:11,000 --> 00:14:13,000
+S3 storage service.
+
+149
+00:14:14,000 --> 00:14:21,000
+For example, the U.S. Army Intelligence and Security Command inadvertently stored sensitive database
+
+150
+00:14:21,000 --> 00:14:28,000
+files, some of them marked top secret in S3 authentication.
+
+151
+00:14:29,000 --> 00:14:36,000
+Some organizations complained about the leakage of hashed passwords, internal resources and keys.
+
+152
+00:14:36,000 --> 00:14:43,000
+Other companies complained about leakage of some vacation information, which included certificates,
+
+153
+00:14:43,000 --> 00:14:48,000
+plaintext passwords, keys and sensitive customer information.
+
+154
+00:14:49,000 --> 00:14:58,000
+Last year, many organizations rely on the data storage technology of Amazon S3, including military
+
+155
+00:14:58,000 --> 00:15:00,000
+and government agencies.
+
+156
+00:15:00,000 --> 00:15:08,000
+However, past security advance indicate that this is a pervasive problem and as we association, should
+
+157
+00:15:08,000 --> 00:15:10,000
+be carefully monitored.
+
+158
+00:15:11,000 --> 00:15:21,000
+Example number three Citrix legacy protocols attacked Citrix use and I'm based cloud email server and
+
+159
+00:15:21,000 --> 00:15:25,000
+became the target of lab based password spraying.
+
+160
+00:15:26,000 --> 00:15:35,000
+I map is the insecure legacy protocol and attackers exploit to get access to cloud based accounts and
+
+161
+00:15:35,000 --> 00:15:40,000
+software as a service applications just as a reference.
+
+162
+00:15:40,000 --> 00:15:41,000
+Few words, but Citrix.
+
+163
+00:15:42,000 --> 00:15:50,000
+Citrix Systems is an American local national cloud computing and virtualization technology company that
+
+164
+00:15:50,000 --> 00:15:58,000
+provides server application and desktop virtualization networking software as a service and cloud computing
+
+165
+00:15:58,000 --> 00:15:59,000
+technologies.
+
+166
+00:15:59,000 --> 00:16:08,000
+And majority of Microsoft Office 365 and GC panels have been the target of my map based password spraying
+
+167
+00:16:08,000 --> 00:16:09,000
+attacks.
+
+168
+00:16:10,000 --> 00:16:12,000
+Few new words in this sentence.
+
+169
+00:16:12,000 --> 00:16:13,000
+Let me explain.
+
+170
+00:16:14,000 --> 00:16:16,000
+First of all, what is.
+
+171
+00:16:16,000 --> 00:16:26,000
+Math in computing the internet message access protocol zebra aviation is I am a p is an Internet standard
+
+172
+00:16:26,000 --> 00:16:35,000
+protocol used by email clients to retrieve email messages from a mail server over to sip IP connection.
+
+173
+00:16:35,000 --> 00:16:42,000
+A password screen attack is a type of brute force attack that a malicious actor attempts is the same
+
+174
+00:16:42,000 --> 00:16:48,000
+password on many accounts before moving on to another one and repeating the process.
+
+175
+00:16:49,000 --> 00:16:58,000
+The cybercriminals target the insecure legacy IMAP protocol to get past multifactor authentication settings.
+
+176
+00:16:58,000 --> 00:17:07,000
+I will refer to them as MFA settings and expose cloud based accounts given access to software as a service
+
+177
+00:17:07,000 --> 00:17:07,000
+applications.
+
+178
+00:17:08,000 --> 00:17:15,000
+Citrix, which specializes in federated architectures, was the target of such attack.
+
+179
+00:17:16,000 --> 00:17:18,000
+What is federated architectures?
+
+180
+00:17:19,000 --> 00:17:27,000
+Federated architecture is upon an enterprise architecture that allows interoperability and information
+
+181
+00:17:27,000 --> 00:17:34,000
+sharing within segment autonomously, that centrally organized slice of business information technology
+
+182
+00:17:34,000 --> 00:17:36,000
+systems and applications.
+
+183
+00:17:37,000 --> 00:17:46,000
+The proposed cybercriminals achieved a foothold by password splitting, and Xen were able to bypass
+
+184
+00:17:46,000 --> 00:17:47,000
+all the layers of security.
+
+185
+00:17:48,000 --> 00:17:56,000
+The termination of legacy protocols, including IMAP and Pop, makes it hard for system administrators
+
+186
+00:17:56,000 --> 00:17:59,000
+to establish and activate MFA.
+
+187
+00:18:00,000 --> 00:18:08,000
+Sure, mailboxes and service cycles can be especially vulnerable and it can be difficult to use MFA
+
+188
+00:18:08,000 --> 00:18:14,000
+to protect GC Cloud and Office 365 accounts easy to use.
+
+189
+00:18:14,000 --> 00:18:24,000
+Now let's make sure that multi-factor authentication is activated for every user in every application,
+
+190
+00:18:24,000 --> 00:18:27,000
+including super administrators.
+
+191
+00:18:27,000 --> 00:18:30,000
+Example number four Mirai.
+
+192
+00:18:30,000 --> 00:18:39,000
+But now Mirai is a type of malware that infects network devices after devices are in fact that they
+
+193
+00:18:39,000 --> 00:18:45,000
+can be remotely controlled by the operator, which uses them as bots.
+
+194
+00:18:45,000 --> 00:18:54,000
+That extends the power of a button that Mirai targeted, namely Iot devices, and managed to execute
+
+195
+00:18:54,000 --> 00:19:01,000
+several high profile attacks even after it was discovered in August 2016.
+
+196
+00:19:01,000 --> 00:19:11,000
+Dimension A released release code as open source on the IN and the technique has since been used in
+
+197
+00:19:11,000 --> 00:19:12,000
+other malware projects.
+
+198
+00:19:13,000 --> 00:19:21,000
+Mirai managed to infect and run on CCTV cameras, home rotors and DVR.
+
+199
+00:19:22,000 --> 00:19:26,000
+It succeeded by trying commonly used passwords.
+
+200
+00:19:26,000 --> 00:19:36,000
+This simple massive enables a new whiteboard to produce 218 minutes of beats per second and 102nd megapixels
+
+201
+00:19:36,000 --> 00:19:37,000
+per second.
+
+202
+00:19:37,000 --> 00:19:42,000
+Indeed, those ability and attack is a genius provided.
+
+203
+00:19:44,000 --> 00:19:53,000
+I also rendered several notable sites inaccessible, including GitHub, Reddit, Airbnb, Netflix and
+
+204
+00:19:53,000 --> 00:19:53,000
+Twitter.
+
+205
+00:19:53,000 --> 00:20:03,000
+The learned and the most common security misconfiguration threat actors actively look for systems and
+
+206
+00:20:03,000 --> 00:20:11,000
+devices thought that making use of lists of commonly used passwords and of course this can quickly include
+
+207
+00:20:11,000 --> 00:20:13,000
+a large number of passwords.
+

73 - OWASP Top 10 2021/012 NIST-800-123-Guide-to-General-Server-Security.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-123.pdf

73 - OWASP Top 10 2021/012 NIST-800-207-Zero-Trust-Architecture.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf

73 - OWASP Top 10 2021/012 Security Misconfiguration (Hardening, Zero Trust, Defense in Depth, Practice)_en.srt

@@ -0,0 +1,1200 @@
+1
+00:00:02,000 --> 00:00:03,000
+In scope of this lesson.
+
+2
+00:00:03,000 --> 00:00:07,000
+We're also going to talk about security hardening.
+
+3
+00:00:07,000 --> 00:00:09,000
+But what does it mean?
+
+4
+00:00:09,000 --> 00:00:10,000
+Let me explain.
+
+5
+00:00:11,000 --> 00:00:19,000
+Hardening when applied to computing is a practice of reducing a system's vulnerability by reducing its
+
+6
+00:00:19,000 --> 00:00:21,000
+attack surface.
+
+7
+00:00:22,000 --> 00:00:28,000
+In principle, a single function system is more secure than a multipurpose one.
+
+8
+00:00:29,000 --> 00:00:36,000
+Reducing available ways of attack typically includes changing default passwords, the removal of unnecessary
+
+9
+00:00:36,000 --> 00:00:44,000
+software, unnecessary use or logging, and the disabling or removal of unnecessary services.
+
+10
+00:00:45,000 --> 00:00:47,000
+What is attack surface?
+
+11
+00:00:48,000 --> 00:00:55,000
+The attacks surface is a combination of all the potential flaws and backdoors and technology that can
+
+12
+00:00:55,000 --> 00:00:57,000
+be exploited by hackers.
+
+13
+00:00:57,000 --> 00:00:58,000
+This.
+
+14
+00:00:58,000 --> 00:01:07,000
+This can occur in multiple ways, including default and hardcoded passwords, passwords and credentials
+
+15
+00:01:07,000 --> 00:01:16,000
+stored in plain text files, unpatched software and firmware vulnerabilities only configure the BIOS,
+
+16
+00:01:16,000 --> 00:01:24,000
+firewalls, ports, servers, switches, routers, or other parts of the infrastructure block or deficiency
+
+17
+00:01:24,000 --> 00:01:27,000
+of privileged access controls.
+
+18
+00:01:27,000 --> 00:01:35,000
+System hardening in the North and the South Dakota approach to identify those and control potential
+
+19
+00:01:35,000 --> 00:01:39,000
+security vulnerabilities throughout your organization.
+
+20
+00:01:40,000 --> 00:01:47,000
+There are several types of system hardening activities, including application harbor, operating system,
+
+21
+00:01:47,000 --> 00:01:57,000
+hardening server, hardening database, and that hardening halving may involve a reduction in attack
+
+22
+00:01:57,000 --> 00:02:03,000
+vectors by cordons at pathways or vectors attackers would use.
+
+23
+00:02:03,000 --> 00:02:06,000
+It may range from adhering to planning.
+
+24
+00:02:06,000 --> 00:02:15,000
+Policies such as zero trust is a principle of this privilege or defence in deps, but also may include
+
+25
+00:02:15,000 --> 00:02:22,000
+such activities as implementation of workforce training, segmentation of resources, automation of
+
+26
+00:02:22,000 --> 00:02:30,000
+security updates, resetting default passwords, asking passwords and stopping storage or transmission
+
+27
+00:02:30,000 --> 00:02:38,000
+of data unless it is encrypted or using attack vectors through hardening and also involves system owners,
+
+28
+00:02:39,000 --> 00:02:41,000
+unnecessary services or processes.
+
+29
+00:02:42,000 --> 00:02:47,000
+Overall, a system that provides most services has a much broader attack.
+
+30
+00:02:47,000 --> 00:02:51,000
+Face is one performing just one function.
+
+31
+00:02:52,000 --> 00:02:59,000
+While explaining this slide, I mentioned some interesting and useful policies in my opinion that I'd
+
+32
+00:02:59,000 --> 00:03:01,000
+like also to discuss with you.
+
+33
+00:03:02,000 --> 00:03:06,000
+Let me explain what zero prosecution model is.
+
+34
+00:03:06,000 --> 00:03:14,000
+The zero trust security model, sometimes known as variance or less security, describes an approach
+
+35
+00:03:14,000 --> 00:03:18,000
+to the design and implementation of I.T systems.
+
+36
+00:03:18,000 --> 00:03:27,000
+The main concept behind the Zero Trust Security model is not trust all this verify, which means that
+
+37
+00:03:27,000 --> 00:03:35,000
+devices should not be trusted by default, even if they are connected to permissioned networks such
+
+38
+00:03:35,000 --> 00:03:39,000
+as corporate along and even invisible privacy.
+
+39
+00:03:39,000 --> 00:03:49,000
+Five zero Trust is a security framework requiring all users was in or outside the organization's network
+
+40
+00:03:49,000 --> 00:03:57,000
+to be authenticated, authorized and continuously validated for security configuration before being
+
+41
+00:03:57,000 --> 00:04:01,000
+granted open access to applications and data.
+
+42
+00:04:01,000 --> 00:04:04,000
+Zero Trust assumes the use.
+
+43
+00:04:04,000 --> 00:04:13,000
+No traditional network edge networks can be code in the cloud or combination or hybrid with resources
+
+44
+00:04:13,000 --> 00:04:17,000
+anywhere, as well as bunkers in any location.
+
+45
+00:04:18,000 --> 00:04:26,000
+Most modern corporate networks consist of many interconnected zones, cloud services and infrastructure,
+
+46
+00:04:27,000 --> 00:04:35,000
+connections to remote and mobile environments, and connections to non-conventional I.T. such as Iot
+
+47
+00:04:35,000 --> 00:04:35,000
+devices.
+
+48
+00:04:36,000 --> 00:04:43,000
+The reasoning for Zero Trust is that the traditional approach trusts and devices with an emotional corporate
+
+49
+00:04:43,000 --> 00:04:51,000
+perimeter or devices connected to VPN is not relevant in the complex environment of a corporate network.
+
+50
+00:04:52,000 --> 00:05:00,000
+Zero trust approach advocates mutual authentication, including checking the identity and integrity
+
+51
+00:05:00,000 --> 00:05:10,000
+of devices with respect to location and providing access to applications and services based on the confidence
+
+52
+00:05:10,000 --> 00:05:13,000
+of device identity and device house.
+
+53
+00:05:13,000 --> 00:05:21,000
+In combination with user authentication, there is a standard from recognized organization that can
+
+54
+00:05:21,000 --> 00:05:23,000
+help you online.
+
+55
+00:05:23,000 --> 00:05:25,000
+Zero Trust with your organization.
+
+56
+00:05:26,000 --> 00:05:33,000
+The standard I'd like to mention is NIST 800 207.
+
+57
+00:05:34,000 --> 00:05:41,000
+This is funded by National Institute of Standards and Technology, dedicated to zero trust architecture.
+
+58
+00:05:42,000 --> 00:05:47,000
+I don't believe that we need to go over it in details and scope of this lesson.
+
+59
+00:05:47,000 --> 00:05:51,000
+I will leaves the reference in attachments to the lesson for you.
+
+60
+00:05:52,000 --> 00:05:54,000
+Feel free to check it after the lesson.
+
+61
+00:05:55,000 --> 00:06:02,000
+This is the most lending neutral, comprehensive standards, not just for government entities, but
+
+62
+00:06:02,000 --> 00:06:04,000
+for any organization.
+
+63
+00:06:05,000 --> 00:06:13,000
+Zero Trust seeks to address the following key principles based on the guidelines.
+
+64
+00:06:14,000 --> 00:06:23,000
+Continuous verification always verify access all the time for all sources, limit the blast radius,
+
+65
+00:06:24,000 --> 00:06:29,000
+minimize impact if an external or inside breach does occur.
+
+66
+00:06:30,000 --> 00:06:33,000
+Automate context, action and response.
+
+67
+00:06:33,000 --> 00:06:42,000
+Incorporate behavioral data and get context from the client, stack identity and the point workload,
+
+68
+00:06:42,000 --> 00:06:45,000
+etc. for the most accurate response.
+
+69
+00:06:46,000 --> 00:06:53,000
+Execution of this framework combines advanced technologies such as risk based, multi-factor authentication,
+
+70
+00:06:54,000 --> 00:07:02,000
+identity protection, next generation endpoint security, and robust cloud workflow technology to verify
+
+71
+00:07:02,000 --> 00:07:04,000
+a user or systems identity.
+
+72
+00:07:05,000 --> 00:07:11,000
+Consideration of access at that moment in time and the maintenance of system security.
+
+73
+00:07:12,000 --> 00:07:20,000
+Zero Trust also requires consideration of encryption of data, secure email and verifying the hygiene
+
+74
+00:07:20,000 --> 00:07:24,000
+of assets and coins before they connect applications.
+
+75
+00:07:25,000 --> 00:07:30,000
+And also I mentioned such approach as defence in depth.
+
+76
+00:07:30,000 --> 00:07:34,000
+This is a concept that I'd like also to discuss with you.
+
+77
+00:07:35,000 --> 00:07:37,000
+So what is the fancy depth?
+
+78
+00:07:38,000 --> 00:07:46,000
+Defensive maps is an approach to cybersecurity in which a serious of defensive mechanisms layers in
+
+79
+00:07:46,000 --> 00:07:50,000
+order to protect available data and information.
+
+80
+00:07:50,000 --> 00:07:57,000
+If one mechanism fails and the other steps up immediately, this or an attack.
+
+81
+00:07:58,000 --> 00:08:06,000
+This maintenance approach was intentional redundancies and raises the security system as a whole and
+
+82
+00:08:06,000 --> 00:08:11,000
+addresses many different attack vectors, defensive gaps.
+
+83
+00:08:11,000 --> 00:08:15,000
+Is it coming through, as it calls the approach?
+
+84
+00:08:16,000 --> 00:08:18,000
+Because it narrows the landscape.
+
+85
+00:08:18,000 --> 00:08:27,000
+Francis of Medieval Castle Before you can penetrate the castle you faced was the North Rampart, Drawbridge
+
+86
+00:08:28,000 --> 00:08:30,000
+Towers, Gotham Mines and so on.
+
+87
+00:08:32,000 --> 00:08:33,000
+Let's approach the security.
+
+88
+00:08:33,000 --> 00:08:36,000
+It can be applied to all levels of i.t.
+
+89
+00:08:36,000 --> 00:08:41,000
+Systems from a single laptop accesses the internet from the coffee shop.
+
+90
+00:08:41,000 --> 00:08:49,000
+This is a 50,000 user enterprise wide area and that's where the fencing maps can significantly improve
+
+91
+00:08:49,000 --> 00:08:51,000
+your security profile.
+
+92
+00:08:52,000 --> 00:08:57,000
+No organization can be ever fully protected by a single layer of security.
+
+93
+00:08:58,000 --> 00:09:00,000
+Well, one door may be closed.
+
+94
+00:09:00,000 --> 00:09:07,000
+Others will be left wide open, and hackers will find it useful and very quickly.
+
+95
+00:09:08,000 --> 00:09:16,000
+However, when you use a serious of different defenses to gather, such as firewalls, commerce, intrusion
+
+96
+00:09:16,000 --> 00:09:24,000
+detection systems, data encryption and the integrity of these solutions, you effectively close the
+
+97
+00:09:24,000 --> 00:09:32,000
+gaps created by relying on a seamless security solution and the different elements of defense in depth.
+
+98
+00:09:33,000 --> 00:09:37,000
+Some of them are network security controls.
+
+99
+00:09:37,000 --> 00:09:44,000
+For example firewalls, antivirus software, the license of data integrity.
+
+100
+00:09:44,000 --> 00:09:52,000
+Data Integrity Solutions can also check the source IP address to ensure it is from a known and trusted
+
+101
+00:09:52,000 --> 00:09:53,000
+source.
+
+102
+00:09:54,000 --> 00:09:55,000
+Behavioral Analysis.
+
+103
+00:09:56,000 --> 00:10:00,000
+That's what I wanted to share with you again in defense and depth.
+
+104
+00:10:01,000 --> 00:10:01,000
+Let's continue.
+
+105
+00:10:03,000 --> 00:10:03,000
+I believe that.
+
+106
+00:10:03,000 --> 00:10:06,000
+Now you understand what Harding means.
+
+107
+00:10:07,000 --> 00:10:10,000
+I suggest to you best practices for System Harding.
+
+108
+00:10:11,000 --> 00:10:18,000
+The type of Harding you point out, the balance of the risks in the existing technology, the resources
+
+109
+00:10:18,000 --> 00:10:22,000
+we have available, and the priority for making fixes.
+
+110
+00:10:23,000 --> 00:10:31,000
+All due to your existing systems, carry out a comprehensive audit of your existing technology, use
+
+111
+00:10:31,000 --> 00:10:39,000
+penetration testing landings, just common simulation management and other security auditing tools to
+
+112
+00:10:39,000 --> 00:10:42,000
+find flaws in the system and prioritize fixes.
+
+113
+00:10:43,000 --> 00:10:50,000
+Conduct system, hardening assessments against sources using industry standards.
+
+114
+00:10:50,000 --> 00:10:57,000
+For example, the National Institute of Standards and Technology that introduced the old standard.
+
+115
+00:10:58,000 --> 00:11:05,000
+It is called the General Service Security Special Number 800 123.
+
+116
+00:11:07,000 --> 00:11:09,000
+Create a strategy for systems hardening.
+
+117
+00:11:10,000 --> 00:11:14,000
+You do not need to harden all of your systems at once.
+
+118
+00:11:15,000 --> 00:11:24,000
+Instead, create a strategy and based on the risks identified within your technology ecosystem and use
+
+119
+00:11:24,000 --> 00:11:27,000
+a phased approach to remediate the biggest flaws.
+
+120
+00:11:29,000 --> 00:11:38,000
+Partial liabilities immediately ensures that an automated and comprehensive identification and blockchain
+
+121
+00:11:38,000 --> 00:11:39,000
+system in place.
+
+122
+00:11:40,000 --> 00:11:49,000
+Network hardening ensure your firewall is properly configured and that all rules are regular in order
+
+123
+00:11:49,000 --> 00:12:00,000
+to secure remote access points and users block any use or new open network ports, disable and remove
+
+124
+00:12:00,000 --> 00:12:07,000
+unnecessary protocols and services, implement access lists and create networks.
+
+125
+00:12:08,000 --> 00:12:08,000
+Track.
+
+126
+00:12:09,000 --> 00:12:18,000
+Sarah Harding, who's also overseeing the Secure Data Centre, never tests Harding on the production
+
+127
+00:12:18,000 --> 00:12:25,000
+servers, always Harman's service before connections to the Internet or external networks.
+
+128
+00:12:26,000 --> 00:12:32,000
+Avoid installing unnecessary software on a server segregates servers appropriately.
+
+129
+00:12:33,000 --> 00:12:42,000
+And sure, so using an administrative axis is properly set up and that provides on access unlimited
+
+130
+00:12:42,000 --> 00:12:44,000
+in line with the principle of this privilege.
+
+131
+00:12:45,000 --> 00:12:52,000
+Application hardening or any components of functions you do not name.
+
+132
+00:12:52,000 --> 00:13:00,000
+Restrict access to applications based on user roles and contacts such as with application control,
+
+133
+00:13:01,000 --> 00:13:04,000
+removable sample files and defaults passwords.
+
+134
+00:13:05,000 --> 00:13:12,000
+Application parcels should then be managed via an application password management in which the password
+
+135
+00:13:12,000 --> 00:13:19,000
+management solution that enforces password best practices, possible quotation marks, etc..
+
+136
+00:13:20,000 --> 00:13:29,000
+Hardening of applications should also entail inspecting integrations with other applications and systems
+
+137
+00:13:29,000 --> 00:13:34,000
+and removing foreign use and unnecessary integration components and privileges.
+
+138
+00:13:35,000 --> 00:13:44,000
+Database hardening create add new restrictions such as by controlling privileged access on what users
+
+139
+00:13:44,000 --> 00:13:52,000
+can do in a database showing on node, checking to verify applications and users and create database
+
+140
+00:13:52,000 --> 00:13:59,000
+information both in transit and at rest and force secure passwords.
+
+141
+00:14:00,000 --> 00:14:02,000
+Introduce roll based access.
+
+142
+00:14:02,000 --> 00:14:03,000
+Control privileges.
+
+143
+00:14:04,000 --> 00:14:06,000
+Free on used accounts.
+
+144
+00:14:07,000 --> 00:14:15,000
+Operating system hardware apply, operating system updates, service bags and watches automatically
+
+145
+00:14:16,000 --> 00:14:25,000
+freeze unnecessary drivers files, sharing libraries, software services and functionality, and great
+
+146
+00:14:25,000 --> 00:14:29,000
+local storage title registry and other systems.
+
+147
+00:14:29,000 --> 00:14:39,000
+Permissions look all of activity errors and warnings implement user controls and eliminate unnecessary
+
+148
+00:14:39,000 --> 00:14:40,000
+accounts and privileges.
+
+149
+00:14:41,000 --> 00:14:50,000
+Enforce this breach removing unnecessary accounts such as orphan accounts and unused accounts and privileges
+
+150
+00:14:50,000 --> 00:14:52,000
+throughout your i.t.
+
+151
+00:14:52,000 --> 00:14:53,000
+Infrastructure.
+
+152
+00:14:54,000 --> 00:14:59,000
+We have learned enough information to be able to understand the past examples.
+
+153
+00:14:59,000 --> 00:15:02,000
+Let's now discuss different attacks scenarios.
+
+154
+00:15:03,000 --> 00:15:09,000
+Example, number one, imagine that we have our verification of the Web.
+
+155
+00:15:09,000 --> 00:15:18,000
+Seven, In our case, I'm talking about our online store together with my students from scratch in life
+
+156
+00:15:18,000 --> 00:15:28,000
+mode in my course java from zero to first job and never seen looks fine application works but if I would
+
+157
+00:15:28,000 --> 00:15:36,000
+change you throw the manager slash email like this then I will be navigating that is in management console
+
+158
+00:15:36,000 --> 00:15:37,000
+of the server.
+
+159
+00:15:37,000 --> 00:15:46,000
+And this is not only related to Tomcat Web server, it may be related to any other server and its default
+
+160
+00:15:46,000 --> 00:15:47,000
+configurations.
+
+161
+00:15:48,000 --> 00:15:53,000
+I can try to guess which server you use and check default applications.
+
+162
+00:15:53,000 --> 00:15:56,000
+Is it installed on the cell facade?
+
+163
+00:15:57,000 --> 00:16:04,000
+I can control the guest defaults passwords or apply brute force to bypass authentication.
+
+164
+00:16:04,000 --> 00:16:10,000
+For example, in case of thought here admin for logging and admin for possible.
+
+165
+00:16:11,000 --> 00:16:18,000
+I would enter a default application that allows me to manage my deployments on the Tomcat.
+
+166
+00:16:18,000 --> 00:16:28,000
+So what we can do with cases like this never leave default or insecure passwords for admin applications,
+
+167
+00:16:28,000 --> 00:16:35,000
+especially in case the reason used to get access to the configurations of the server.
+
+168
+00:16:35,000 --> 00:16:43,000
+Another solution would be completely remove the full applications from the server in case you know that
+
+169
+00:16:43,000 --> 00:16:46,000
+you are not going to use the full web server applications.
+
+170
+00:16:47,000 --> 00:16:49,000
+Just remove them and that's it.
+
+171
+00:16:49,000 --> 00:16:58,000
+In this particular case was a Tomcat, navigate the Map Apps folder and remove all the applications
+
+172
+00:16:58,000 --> 00:17:03,000
+that exist besides applications that he and.
+
+173
+00:17:04,000 --> 00:17:05,000
+Example.
+
+174
+00:17:05,000 --> 00:17:05,000
+Number two.
+
+175
+00:17:06,000 --> 00:17:13,000
+In the second example, let me show you how direct listing can look like on the Sabbath.
+
+176
+00:17:14,000 --> 00:17:21,000
+Imagine that accidentally or by default you have directly enabled on the server.
+
+177
+00:17:21,000 --> 00:17:22,000
+What is it?
+
+178
+00:17:23,000 --> 00:17:24,000
+How does it look like?
+
+179
+00:17:25,000 --> 00:17:27,000
+For example, here's a link.
+
+180
+00:17:27,000 --> 00:17:28,000
+That image is directly.
+
+181
+00:17:29,000 --> 00:17:31,000
+Here is a reference to zip code.
+
+182
+00:17:31,000 --> 00:17:39,000
+It was JavaScript files and it seems like there is no critical harm in direct release.
+
+183
+00:17:40,000 --> 00:17:49,000
+But imagine now that while navigating the directories I found a direct was a content that external users
+
+184
+00:17:49,000 --> 00:17:51,000
+clients shouldn't have access to.
+
+185
+00:17:52,000 --> 00:17:56,000
+Take into account we use Java on Tomcat.
+
+186
+00:17:56,000 --> 00:17:59,000
+So we are part of the huge community.
+
+187
+00:18:00,000 --> 00:18:07,000
+A lot of security controls implementation by default and it is not so easy to download compiled sources
+
+188
+00:18:07,000 --> 00:18:08,000
+from the server.
+
+189
+00:18:08,000 --> 00:18:15,000
+But with all the languages, for example, speech we increase, I will get access to directory.
+
+190
+00:18:16,000 --> 00:18:25,000
+I can get access to the source code and expose the logic inside in case or compile sources locations
+
+191
+00:18:25,000 --> 00:18:25,000
+on the server.
+
+192
+00:18:26,000 --> 00:18:32,000
+I can that compiles and learns internal logic or just stole some technical decisions.
+
+193
+00:18:33,000 --> 00:18:39,000
+That's why Enabled Director can be treated as a serious security liability.
+
+194
+00:18:40,000 --> 00:18:47,000
+Talking in specifics about Tomcat is over the set of security controls implemented by default.
+
+195
+00:18:48,000 --> 00:18:54,000
+And this is one of these because by default the resolution is disabled.
+
+196
+00:18:55,000 --> 00:18:56,000
+You can control.
+
+197
+00:18:56,000 --> 00:19:02,000
+This is a maximum file from home for one of your Tomcat distribution.
+
+198
+00:19:02,000 --> 00:19:11,000
+Just find the km of the defaults in the scope listings and you can change value here.
+
+199
+00:19:11,000 --> 00:19:14,000
+Use a true or false by default.
+
+200
+00:19:14,000 --> 00:19:19,000
+It is false and I recommend you keep it false for production.
+
+201
+00:19:20,000 --> 00:19:26,000
+But just in case you have just learned where this configuration is located in the Tomcat.
+
+202
+00:19:27,000 --> 00:19:27,000
+Example.
+
+203
+00:19:27,000 --> 00:19:28,000
+Number three.
+
+204
+00:19:28,000 --> 00:19:33,000
+This is the last but not least example in is the case.
+
+205
+00:19:33,000 --> 00:19:41,000
+When accidentally is an error message, you expose some sensitive data that might be used by a doctor.
+
+206
+00:19:42,000 --> 00:19:48,000
+For example, imagine that you want to sign the humanity signing page.
+
+207
+00:19:49,000 --> 00:19:54,000
+You use username also user, but you don't know his or her password.
+
+208
+00:19:55,000 --> 00:20:02,000
+You any password and some reason for it is clear for us that password doesn't work.
+
+209
+00:20:03,000 --> 00:20:11,000
+But in case I would open the console but make an F12, I would see error messages in developers.
+
+210
+00:20:11,000 --> 00:20:12,000
+The last zip code.
+
+211
+00:20:13,000 --> 00:20:23,000
+I see the zip passwords and doesn't match with this username because there is another possible way here
+
+212
+00:20:23,000 --> 00:20:24,000
+at this console.
+
+213
+00:20:25,000 --> 00:20:34,000
+I know I oversimplified things, but even cases like this can happen when developers just left some
+
+214
+00:20:34,000 --> 00:20:34,000
+code.
+
+215
+00:20:34,000 --> 00:20:42,000
+So lots of genes involved and one just missed something that can be different variations of this mistake.
+
+216
+00:20:42,000 --> 00:20:50,000
+But the idea is a similar unit, established, efficient process of reviewing the team in order to with
+
+217
+00:20:50,000 --> 00:20:57,000
+cases like this one, accidentally sensitive information is revealed this sort of error message.
+
+218
+00:20:58,000 --> 00:21:06,000
+And now the examples that you also have about if we talk about Java applications and GCP technology
+
+219
+00:21:06,000 --> 00:21:13,000
+in particular, probably you saw a really stark choice when some error in GCP happens, and this is
+
+220
+00:21:13,000 --> 00:21:17,000
+also one of the places where sensitive data may appear.
+
+221
+00:21:18,000 --> 00:21:27,000
+Also, this gives understanding that this web application uses Java technology stack, which might not
+
+222
+00:21:27,000 --> 00:21:35,000
+be like it will not be listed by itself, but this will give thought thought to additional information
+
+223
+00:21:35,000 --> 00:21:41,000
+about internal structure of the application and potential web server configurations.
+
+224
+00:21:42,000 --> 00:21:47,000
+You know how we can prevent shown error loss this season?
+
+225
+00:21:47,000 --> 00:21:56,000
+Just configure air handlers for different kinds of federal, including internal server errors here and
+
+226
+00:21:56,000 --> 00:21:58,000
+WebEx and all of my application.
+
+227
+00:21:58,000 --> 00:21:59,000
+You can see that.
+
+228
+00:21:59,000 --> 00:22:04,000
+I can see the error handlers for some kinds of fair use.
+
+229
+00:22:04,000 --> 00:22:12,000
+Also very good to go with exposure of error logs and using this all examples that I was about to show
+
+230
+00:22:12,000 --> 00:22:17,000
+you some stuff I would like to talk about Java configurations in particular.
+
+231
+00:22:18,000 --> 00:22:25,000
+In general, we should be aware that your general application configuration is the same important as
+
+232
+00:22:25,000 --> 00:22:27,000
+writing code itself.
+
+233
+00:22:28,000 --> 00:22:34,000
+When using frameworks and libraries, we should be aware of what the default configuration settings
+
+234
+00:22:34,000 --> 00:22:38,000
+are and if certain changes have security implications.
+
+235
+00:22:39,000 --> 00:22:46,000
+This is important in relation to application frameworks, libraries and also for settings.
+
+236
+00:22:47,000 --> 00:22:54,000
+So remind yourself that exposing information might not be harmful at first glance.
+
+237
+00:22:55,000 --> 00:23:02,000
+But if you combine all these bits and pieces of information, you will give an attacker enough information
+
+238
+00:23:02,000 --> 00:23:04,000
+to do something malicious.
+
+239
+00:23:05,000 --> 00:23:15,000
+Using libraries and even application service is very useful, but you should be aware of how the Java
+
+240
+00:23:15,000 --> 00:23:19,000
+configuration and this configuration is a serious sin.
+
+241
+00:23:20,000 --> 00:23:27,000
+Make sure that you are not accidentally giving people access to your application because you forgot
+
+242
+00:23:27,000 --> 00:23:30,000
+to set a specific property in your configuration.
+
+243
+00:23:31,000 --> 00:23:38,000
+Unions in the past used a lot of it, and that belief is based on the examples that we have discussed.
+
+244
+00:23:38,000 --> 00:23:45,000
+You already can make some conclusions and understand how you can avoid vulnerabilities from the security
+
+245
+00:23:45,000 --> 00:23:47,000
+misconfiguration category.
+
+246
+00:23:48,000 --> 00:23:55,000
+Let's summarize all the conclusions that we need and create a list of rules and guidelines to follow
+
+247
+00:23:56,000 --> 00:24:01,000
+that can help us to prevent liabilities related to security misconfiguration.
+
+248
+00:24:02,000 --> 00:24:07,000
+First of all, the golden rule that we discussed in the review, each was category.
+
+249
+00:24:07,000 --> 00:24:14,000
+We have to implement the principle of basically everything is off by default.
+
+250
+00:24:15,000 --> 00:24:24,000
+This is not maintenance is to disable administration interfaces, disable debugging, disable use of
+
+251
+00:24:24,000 --> 00:24:33,000
+default accounts, passwords, change all possible default settings, cloud storage permissions, for
+
+252
+00:24:33,000 --> 00:24:34,000
+example.
+
+253
+00:24:34,000 --> 00:24:44,000
+Else we block permissions and civil servant to prevent unauthorized access directly, etc. Consider
+
+254
+00:24:44,000 --> 00:24:51,000
+running scans on the oldest to help detect future misconfigurations on recent patches.
+
+255
+00:24:52,000 --> 00:24:57,000
+That's a powerful thing to do to prevent the issues related to security.
+
+256
+00:24:57,000 --> 00:25:04,000
+Misconfiguration Is education and training your staff members about the latest security trends.
+
+257
+00:25:04,000 --> 00:25:11,000
+This allows them to make smart decisions and adhere to best practices.
+
+258
+00:25:12,000 --> 00:25:20,000
+Never forget the bottom portion of the store is a persistent storage of hard drawers.
+
+259
+00:25:20,000 --> 00:25:21,000
+Laptops of your own.
+
+260
+00:25:21,000 --> 00:25:22,000
+Please.
+
+261
+00:25:22,000 --> 00:25:27,000
+The tools and techniques that allow us to do that too.
+
+262
+00:25:28,000 --> 00:25:33,000
+You can also apply appropriate access controls to the rentals and files.
+
+263
+00:25:34,000 --> 00:25:39,000
+These measures of size is all you need to of susceptible directories and files.
+
+264
+00:25:40,000 --> 00:25:43,000
+I'm a date, so perhaps is the latest version.
+
+265
+00:25:44,000 --> 00:25:50,000
+The use of all data software remains one of the most prevalent security vulnerabilities.
+
+266
+00:25:51,000 --> 00:25:56,000
+Many companies don't appreciate the need to invest in the use of the latest.
+
+267
+00:25:57,000 --> 00:26:03,000
+They may feel it is more cost effective to continue making use of legacy software.
+
+268
+00:26:04,000 --> 00:26:12,000
+However, using data software can actually place an organization to risk of losing assets, as well
+
+269
+00:26:12,000 --> 00:26:15,000
+as the trust of investors and customers.
+
+270
+00:26:16,000 --> 00:26:25,000
+Establishing consistent cost travel and maintaining updated software is essential to use an organization's
+
+271
+00:26:25,000 --> 00:26:26,000
+strength vectors.
+
+272
+00:26:27,000 --> 00:26:34,000
+Establish rigorous content conventions, securities, accounts and systems is an automated message of
+
+273
+00:26:34,000 --> 00:26:44,000
+easily running such scans on a regular schedule to create an architectural changes is a significant
+
+274
+00:26:44,000 --> 00:26:50,000
+step in improving the overall value being utilized instead of consequences.
+
+275
+00:26:50,000 --> 00:26:58,000
+Before you integrate ZIP code into the production environment, security professionals must also perform
+
+276
+00:26:58,000 --> 00:27:01,000
+manual reviews on dynamic testing.
+
+277
+00:27:02,000 --> 00:27:09,000
+Establish a hardening process because it is repeatable so that it is fast and simple to deploy correctly.
+
+278
+00:27:09,000 --> 00:27:11,000
+Configure new environments.
+
+279
+00:27:12,000 --> 00:27:19,000
+The production, development and key environments must all be configured in the same way, but with
+
+280
+00:27:19,000 --> 00:27:22,000
+distant passwords used in every environment.
+
+281
+00:27:23,000 --> 00:27:28,000
+Automate this process to easily establish a secure environment.
+
+282
+00:27:28,000 --> 00:27:29,000
+That's it.
+
+283
+00:27:30,000 --> 00:27:33,000
+Let's recap for Fifth in this lesson.
+
+284
+00:27:34,000 --> 00:27:39,000
+In this city is a misconfiguration in this category.
+
+285
+00:27:40,000 --> 00:27:46,000
+Williams is a most notable common weakness in the narrations related to this category.
+
+286
+00:27:47,000 --> 00:27:51,000
+We compared across the top ten, 20, 21 and 2017.
+
+287
+00:27:52,000 --> 00:27:54,000
+Williams was excellent.
+
+288
+00:27:54,000 --> 00:28:04,000
+So and this are and we also got mentioned in this category from our top ten 2017 is now included in
+
+289
+00:28:04,000 --> 00:28:06,000
+the security misconfiguration risk category.
+
+290
+00:28:07,000 --> 00:28:11,000
+I explained different types of security misconfiguration.
+
+291
+00:28:12,000 --> 00:28:18,000
+We've reviewed examples of the real life attacks because of security misconfiguration.
+
+292
+00:28:19,000 --> 00:28:21,000
+Also we discussed new concepts.
+
+293
+00:28:22,000 --> 00:28:30,000
+Namely, we know what security hardening is, what the Zero Trust Security Module is, what defense
+
+294
+00:28:30,000 --> 00:28:31,000
+in depth is.
+
+295
+00:28:32,000 --> 00:28:41,000
+I explained best practices for system hardening and after we learned all this we had a live demo and
+
+296
+00:28:41,000 --> 00:28:50,000
+I showed you a few examples of attacks and the of as a conclusion we know how to prevent security and
+
+297
+00:28:50,000 --> 00:28:51,000
+configuration.
+
+298
+00:28:52,000 --> 00:28:54,000
+That's all for this lesson.
+
+299
+00:28:54,000 --> 00:28:56,000
+Thank you for your attention.
+
+300
+00:28:56,000 --> 00:28:59,000
+Have a great day and see you in the next lesson.
+

73 - OWASP Top 10 2021/013 Dependency-check-plugin.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://mvnrepository.com/artifact/org.owasp/dependency-check-maven/7.1.0

73 - OWASP Top 10 2021/013 Vulnerable & Outdated Components_en.srt

@@ -0,0 +1,1056 @@
+1
+00:00:06,000 --> 00:00:06,000
+Hello team.
+
+2
+00:00:07,000 --> 00:00:10,000
+We proceed non-secure call and I've asked top that.
+
+3
+00:00:10,000 --> 00:00:17,000
+And in this lesson we're going to talk about such risk category as vulnerable and outdated components.
+
+4
+00:00:18,000 --> 00:00:23,000
+We're going to start the lesson from the general overview about this risk category.
+
+5
+00:00:24,000 --> 00:00:31,000
+After that, I'm going to explain the risk factors that increase the risk of vulnerability of your application.
+
+6
+00:00:32,000 --> 00:00:39,000
+I'm going to explain why it is not so easy to update our data components on a regular basis and the
+
+7
+00:00:39,000 --> 00:00:45,000
+standards a challenge will be easier for us to understand how to avoid it.
+
+8
+00:00:46,000 --> 00:00:51,000
+As usual, we are going to use the most notable common vehicle enumerations.
+
+9
+00:00:52,000 --> 00:00:56,000
+I will explain how attackers use vulnerable components.
+
+10
+00:00:56,000 --> 00:00:59,000
+We'll review real life examples.
+
+11
+00:00:59,000 --> 00:01:08,000
+Also, we're going to compare this risk category and how it was presented in the last ten 2017 versus
+
+12
+00:01:09,000 --> 00:01:10,000
+the top ten, 2021.
+
+13
+00:01:11,000 --> 00:01:17,000
+And that's a very important and useful scenes that you will be able to apply in practice after this
+
+14
+00:01:17,000 --> 00:01:20,000
+lesson is using of the dependency check logging.
+
+15
+00:01:20,000 --> 00:01:26,000
+I'm going to show you how we can integrate that in our online shop web application.
+
+16
+00:01:26,000 --> 00:01:28,000
+We'll discuss security scholars.
+
+17
+00:01:29,000 --> 00:01:36,000
+And at the end of the lesson, we're going to talk about how to prevent abilities from this risk category.
+
+18
+00:01:36,000 --> 00:01:38,000
+Let's start our lesson.
+
+19
+00:01:39,000 --> 00:01:44,000
+Let's hold an overview of colonial and outdated components we have and do it.
+
+20
+00:01:45,000 --> 00:01:51,000
+I will give a little bit more context to help you understand what this risk category is all about.
+
+21
+00:01:52,000 --> 00:01:59,000
+More and more apps are using existing components rather than being quoted completely from scratch.
+
+22
+00:02:00,000 --> 00:02:08,000
+Lab applications often need faster turn around, and with the quantity of open source components available,
+
+23
+00:02:08,000 --> 00:02:11,000
+there is no reason not to make use of them.
+
+24
+00:02:12,000 --> 00:02:19,000
+Analysis indicates that approximately 96% of applications use open source components.
+
+25
+00:02:20,000 --> 00:02:29,000
+On average, more than half of an applications code base consists of open source rather than proprietary
+
+26
+00:02:29,000 --> 00:02:29,000
+code.
+
+27
+00:02:30,000 --> 00:02:38,000
+The interesting thing is that you can write 100% secure code following all the rules, but your program
+
+28
+00:02:38,000 --> 00:02:40,000
+still would remain vulnerable.
+
+29
+00:02:41,000 --> 00:02:42,000
+How it is possible.
+
+30
+00:02:42,000 --> 00:02:49,000
+Unless you are writing a really simple function which doesn't do much, you will reuse software of other
+
+31
+00:02:49,000 --> 00:02:50,000
+people.
+
+32
+00:02:50,000 --> 00:02:57,000
+From development to deployment, you will use libraries, frameworks, technologies, etc. And guess
+
+33
+00:02:57,000 --> 00:02:58,000
+what?
+
+34
+00:02:59,000 --> 00:03:03,000
+Those separate components will also depend on OSR components.
+
+35
+00:03:03,000 --> 00:03:05,000
+This comes at a cost.
+
+36
+00:03:05,000 --> 00:03:12,000
+In fact, part of the third party software components you will re-use will suffer from security vulnerabilities.
+
+37
+00:03:13,000 --> 00:03:18,000
+Besides, you might even be using some malicious components.
+
+38
+00:03:18,000 --> 00:03:26,000
+Therefore, checking your code is a need, not a luxury, and the pressure to deliver at speed.
+
+39
+00:03:27,000 --> 00:03:33,000
+Some components are not sufficiently checked before use as a result can be you.
+
+40
+00:03:33,000 --> 00:03:40,000
+Websites and applications was deeply embedded vulnerabilities known to the application operating.
+
+41
+00:03:41,000 --> 00:03:48,000
+But once that ability is discovered by cybercriminals, applications using the vulnerable component
+
+42
+00:03:49,000 --> 00:03:51,000
+can be found and exploited.
+
+43
+00:03:51,000 --> 00:03:59,000
+It could be a simple flaw in a slow component, but one that ultimately makes the entire system hackable.
+
+44
+00:03:59,000 --> 00:04:05,000
+That's some risk factors related to vulnerabilities, problems of vulnerable and outdated components
+
+45
+00:04:05,000 --> 00:04:06,000
+in this category.
+
+46
+00:04:07,000 --> 00:04:10,000
+First of all, what is a risk factor?
+
+47
+00:04:11,000 --> 00:04:12,000
+Risk factor?
+
+48
+00:04:12,000 --> 00:04:18,000
+Chen widely used in medicine and it is also used in project management and project management.
+
+49
+00:04:18,000 --> 00:04:25,000
+Risk factor may be an issue environment that is associated with an increased risk of consequences.
+
+50
+00:04:26,000 --> 00:04:33,000
+For example, if you are riding a bicycle on the perfect roads, it is less likely to damage your bicycle.
+
+51
+00:04:33,000 --> 00:04:39,000
+Going to mountains on your bike can be already considered as a risk factor, is it?
+
+52
+00:04:39,000 --> 00:04:40,000
+Not necessarily.
+
+53
+00:04:40,000 --> 00:04:48,000
+And the wreck may cause a damage to a bicycle, but this fact significantly increases the risk and probability
+
+54
+00:04:48,000 --> 00:04:50,000
+of negative consequences.
+
+55
+00:04:50,000 --> 00:04:52,000
+In this case is the same as here.
+
+56
+00:04:53,000 --> 00:05:01,000
+Let's review risk factors that can increase risks of becoming vulnerable to threats of finalized security
+
+57
+00:05:02,000 --> 00:05:05,000
+as it can increase the level of utility on your project.
+
+58
+00:05:06,000 --> 00:05:14,000
+So you are likely vulnerable if you don't know the versions of all components you use both client side
+
+59
+00:05:14,000 --> 00:05:15,000
+and Samsung.
+
+60
+00:05:16,000 --> 00:05:23,000
+This includes components you directly use as well as nested dependencies if the software is vulnerable,
+
+61
+00:05:23,000 --> 00:05:25,000
+unsupported or out of date.
+
+62
+00:05:26,000 --> 00:05:33,000
+This includes the operating system, web application server, database management system, applications
+
+63
+00:05:34,000 --> 00:05:39,000
+API and all components, runtime environments and libraries.
+
+64
+00:05:39,000 --> 00:05:48,000
+If you do not have vulnerability to regulatory, if you don't fix or upgrades the underlying platform
+
+65
+00:05:48,000 --> 00:05:52,000
+frameworks and dependencies in the risk based timely fashion.
+
+66
+00:05:53,000 --> 00:06:00,000
+This commonly happens in environments when patching is a monthly or quarterly task on the change control,
+
+67
+00:06:00,000 --> 00:06:08,000
+leaving organizations open two days a month of unnecessary exposure to fixed liabilities.
+
+68
+00:06:08,000 --> 00:06:15,000
+If a software developers don't, does the compatibility of updated upgraded libraries.
+
+69
+00:06:16,000 --> 00:06:23,000
+If you don't secure the components configurations like we discussed in scope of our obsolescence dedicated
+
+70
+00:06:23,000 --> 00:06:25,000
+to security in this configuration.
+
+71
+00:06:26,000 --> 00:06:32,000
+Usually at this point of the class, my students ask me, So what is a big deal out of this?
+
+72
+00:06:33,000 --> 00:06:39,000
+Let's just constantly update our external dependencies to the new versions, and that's it.
+
+73
+00:06:40,000 --> 00:06:46,000
+Each new version should contain patches and updates that should decrease the use of security vulnerabilities.
+
+74
+00:06:47,000 --> 00:06:49,000
+Well, you're right from the one side.
+
+75
+00:06:49,000 --> 00:06:57,000
+If you also see the same one but from another side, let's understand why this behavior is not so common.
+
+76
+00:06:58,000 --> 00:07:01,000
+Keeping our components and modules in the application.
+
+77
+00:07:02,000 --> 00:07:09,000
+It is not so easy to manage all the dependencies and approvals of all the dependency graph and the application
+
+78
+00:07:09,000 --> 00:07:11,000
+and update versions.
+
+79
+00:07:11,000 --> 00:07:17,000
+Each new version of the library may contain renamed masses or removed masses.
+
+80
+00:07:18,000 --> 00:07:22,000
+New version of the library can become incompatible with other dependencies.
+
+81
+00:07:22,000 --> 00:07:26,000
+Since application, some features may become deprecated.
+
+82
+00:07:26,000 --> 00:07:29,000
+Some other features may break existing code.
+
+83
+00:07:30,000 --> 00:07:32,000
+These are just a few examples.
+
+84
+00:07:32,000 --> 00:07:39,000
+The process of updating things and making sure that they remain the latest sounds simple, but it's
+
+85
+00:07:39,000 --> 00:07:47,000
+quite a lot of work and sometimes it is not that straightforward unless you are willing to put in your
+
+86
+00:07:47,000 --> 00:07:52,000
+time and update your code to get it to work well with the latest and greatest updates.
+
+87
+00:07:53,000 --> 00:08:00,000
+At the very least, this is not always feasible and in the worst case, it would be your worst nightmare.
+
+88
+00:08:01,000 --> 00:08:07,000
+At the end of the day, this costs money and like it always happens on practice.
+
+89
+00:08:07,000 --> 00:08:15,000
+Is the responsible person for assigning costs on such activities is technology agnostic and it is hard
+
+90
+00:08:15,000 --> 00:08:22,000
+to convince this person or group of people investing money in something which will not generate income
+
+91
+00:08:22,000 --> 00:08:23,000
+in the near future.
+
+92
+00:08:24,000 --> 00:08:27,000
+If you watched my previous classes, I already sat.
+
+93
+00:08:27,000 --> 00:08:34,000
+The technology should go hand-in-hand with businesses that are supported by such technologies and you
+
+94
+00:08:34,000 --> 00:08:37,000
+have to find this balance within your organisation.
+
+95
+00:08:37,000 --> 00:08:41,000
+I just want to highlight that this was never an easy thing to do.
+
+96
+00:08:42,000 --> 00:08:48,000
+As always, let's discuss the most notable common vehicles, enumerations that are associated with this
+
+97
+00:08:48,000 --> 00:08:56,000
+category c, w e and level for use of online paints or body components.
+
+98
+00:08:57,000 --> 00:09:05,000
+Reliance on components that are no longer maintained can make it difficult or impossible to fix significant
+
+99
+00:09:05,000 --> 00:09:12,000
+bugs or religious or quality issues in the fact and maintained code and become obsolete.
+
+100
+00:09:13,000 --> 00:09:20,000
+The issue makes it more difficult to maintain the software, which indirectly affects security by making
+
+101
+00:09:20,000 --> 00:09:25,000
+it more difficult, time consuming to find smaller abilities.
+
+102
+00:09:26,000 --> 00:09:29,000
+It also might make it easier to introduce vulnerabilities.
+
+103
+00:09:30,000 --> 00:09:36,000
+C w e 1075 using components was known vulnerabilities.
+
+104
+00:09:36,000 --> 00:09:44,000
+Attackers have their own database of vulnerable components and exploits moreover prominent databases.
+
+105
+00:09:45,000 --> 00:09:53,000
+Once attackers would identify that you use outdated components, they will use exploit against your
+
+106
+00:09:53,000 --> 00:09:54,000
+application.
+
+107
+00:09:55,000 --> 00:09:58,000
+In scope of this lesson, I want explain.
+
+108
+00:09:58,000 --> 00:10:01,000
+Use the algorithm that is used by attackers.
+
+109
+00:10:02,000 --> 00:10:03,000
+Learn how they act.
+
+110
+00:10:04,000 --> 00:10:10,000
+We will be able to be better prepared so to detect vulnerable components.
+
+111
+00:10:10,000 --> 00:10:13,000
+Usually attackers follows in next steps.
+
+112
+00:10:14,000 --> 00:10:23,000
+The first one, the tech that as a first step usually attackers one identifier technology stack that
+
+113
+00:10:23,000 --> 00:10:24,000
+is used in application.
+
+114
+00:10:25,000 --> 00:10:28,000
+There are different ways how this can be clarified.
+
+115
+00:10:29,000 --> 00:10:36,000
+For example, an attacker can inspect traffic, focus headers and so on.
+
+116
+00:10:37,000 --> 00:10:44,000
+Based on this, attacker can make an assumption about web server use and thus technologies that use
+
+117
+00:10:45,000 --> 00:10:52,000
+tsarism tools like that provides a browser extension that helps us to identify technologies based on
+
+118
+00:10:52,000 --> 00:10:53,000
+our alliances.
+
+119
+00:10:53,000 --> 00:10:55,000
+Single Page Headers.
+
+120
+00:10:56,000 --> 00:10:59,000
+Such a group of tools are called technology profilers.
+
+121
+00:11:00,000 --> 00:11:03,000
+Also, attacker may trigger an error.
+
+122
+00:11:03,000 --> 00:11:11,000
+Explore this tech trace and get additional information he or she may remove and specify there's some
+
+123
+00:11:11,000 --> 00:11:18,000
+unexpected values, etc. If attacker receives an error, it's usually contains some hints about the
+
+124
+00:11:18,000 --> 00:11:19,000
+stack.
+
+125
+00:11:20,000 --> 00:11:26,000
+If this is an open source project, then attack and explore all the dependencies from your repository.
+
+126
+00:11:27,000 --> 00:11:34,000
+Once technology stack is identified at tack, will try to fund existing exports and vulnerabilities.
+
+127
+00:11:35,000 --> 00:11:38,000
+There are public resources as it describes exports.
+
+128
+00:11:39,000 --> 00:11:45,000
+I will not name such resources at the moment, but just for you to be aware about the potential stress.
+
+129
+00:11:46,000 --> 00:11:52,000
+By the way, this is one of the reasons why secure projects, for example, talk to me.
+
+130
+00:11:52,000 --> 00:11:59,000
+I'm worried of using open source libraries because adding dependencies to your project, you expose
+
+131
+00:11:59,000 --> 00:12:04,000
+yourself to potential abuses that were released with that library.
+
+132
+00:12:04,000 --> 00:12:12,000
+That's why even such an open source framework for Java like screen is not the choice for projects like
+
+133
+00:12:12,000 --> 00:12:13,000
+this.
+
+134
+00:12:13,000 --> 00:12:18,000
+I worked on such projects in different roles and I worked as a consultant.
+
+135
+00:12:18,000 --> 00:12:21,000
+The top syntax pops.
+
+136
+00:12:21,000 --> 00:12:23,000
+I just can't tell you their names.
+
+137
+00:12:23,000 --> 00:12:30,000
+Believe me, these are thin paragraphs that you've heard about, and these are solutions that they use
+
+138
+00:12:30,000 --> 00:12:32,000
+by millions of people worldwide.
+
+139
+00:12:33,000 --> 00:12:35,000
+So believe me, I know what I'm talking about.
+
+140
+00:12:37,000 --> 00:12:42,000
+Let's review example from real life to get experience of our organization.
+
+141
+00:12:42,000 --> 00:12:48,000
+Talking about probably one of the most popular examples among vulnerable and outdated components.
+
+142
+00:12:48,000 --> 00:12:50,000
+Cost significant business impact.
+
+143
+00:12:51,000 --> 00:12:58,000
+With a mansion, Equifax, which is the entry point to this, was a vulnerable version of Struts.
+
+144
+00:12:58,000 --> 00:13:05,000
+Apache Struts is an open source web application framework for developing Java Easy Web applications.
+
+145
+00:13:06,000 --> 00:13:14,000
+It uses and extends the Java API to encourage developers to adopt a model view control architecture.
+
+146
+00:13:15,000 --> 00:13:22,000
+Struts is vulnerable to remote command injection attacks through incorrectly passing and attackers invalid
+
+147
+00:13:22,000 --> 00:13:24,000
+content should be had.
+
+148
+00:13:25,000 --> 00:13:31,000
+This trust vulnerability allows these commands to be executed on the edges of the web server.
+
+149
+00:13:32,000 --> 00:13:34,000
+This is the mode command.
+
+150
+00:13:34,000 --> 00:13:38,000
+Education has been actively exploited from the initial disclosure.
+
+151
+00:13:38,000 --> 00:13:43,000
+You can find more detail about common amenities and exposures.
+
+152
+00:13:43,000 --> 00:13:48,000
+See themselves in 1756 eight.
+
+153
+00:13:49,000 --> 00:13:56,000
+This bridge used to gain access to Equifax Network and steal more than 140 million customers.
+
+154
+00:13:56,000 --> 00:13:58,000
+Personal information.
+
+155
+00:13:59,000 --> 00:14:02,000
+That's also become part of us to stop them.
+
+156
+00:14:02,000 --> 00:14:05,000
+2021 And I was top ten 2017.
+
+157
+00:14:06,000 --> 00:14:14,000
+The risk category, what we are discussing at the moment was also that in the 2017 top ten list, it
+
+158
+00:14:14,000 --> 00:14:20,000
+was in position number nine and different name, as you can see on the slide.
+
+159
+00:14:20,000 --> 00:14:24,000
+It was called using components was no vulnerabilities.
+
+160
+00:14:24,000 --> 00:14:27,000
+While the name is different, the idea is the same.
+
+161
+00:14:28,000 --> 00:14:34,000
+You can see that this risk category placed a higher position in the top ten, 2041.
+
+162
+00:14:35,000 --> 00:14:37,000
+It takes place number six.
+
+163
+00:14:37,000 --> 00:14:44,000
+This is all explained by increased amount of cases vulnerabilities from this risk category we use to
+
+164
+00:14:44,000 --> 00:14:46,000
+attack an application.
+
+165
+00:14:47,000 --> 00:14:48,000
+Now it is time for the demo.
+
+166
+00:14:49,000 --> 00:14:55,000
+In this demo, I'm going to show you the tools that can help you to tax liabilities in the competence.
+
+167
+00:14:56,000 --> 00:15:03,000
+I'm going to start the demo from the great plugins that you can add to your build the scope dependency
+
+168
+00:15:03,000 --> 00:15:11,000
+chat to raise developer awareness and help avoid risks and the technical abilities on early stages of
+
+169
+00:15:11,000 --> 00:15:15,000
+Aosp created plugin for Maven School Dependency Chat.
+
+170
+00:15:16,000 --> 00:15:23,000
+This is a solution which can be used to identify project dependencies and check them against is a national
+
+171
+00:15:23,000 --> 00:15:28,000
+vulnerability database and BD needs reports.
+
+172
+00:15:28,000 --> 00:15:39,000
+Any known publicly disclosed state finds so added to your project just open for maximum fine build plugins.
+
+173
+00:15:39,000 --> 00:15:46,000
+And by the way, if you want to learn more about Maven, please refer to this section about Maven and
+
+174
+00:15:46,000 --> 00:15:50,000
+automation tools in my course Java from 0 to 4 as job.
+
+175
+00:15:51,000 --> 00:15:52,000
+Yeah.
+
+176
+00:15:52,000 --> 00:15:55,000
+We'll just need to add a vast plugin, and that's it.
+
+177
+00:15:56,000 --> 00:15:57,000
+Is a dependency check.
+
+178
+00:15:57,000 --> 00:16:06,000
+Log in is by default tied to the verify or side base, dependent on if it is configured as a build or
+
+179
+00:16:06,000 --> 00:16:07,000
+reporting plugin.
+
+180
+00:16:08,000 --> 00:16:12,000
+In the current case, we can generate a report using and then verify.
+
+181
+00:16:12,000 --> 00:16:14,000
+Come on, I added.
+
+182
+00:16:14,000 --> 00:16:22,000
+This plugin on the top level is a preference for maximum so that all my modules also will be verified.
+
+183
+00:16:23,000 --> 00:16:31,000
+I open the terminal and execute and then verify that it is important to understand is the first time
+
+184
+00:16:31,000 --> 00:16:33,000
+this task is executed.
+
+185
+00:16:33,000 --> 00:16:40,000
+It might take 20 minutes or more as it does loads and processes the data from the National Vulnerability
+
+186
+00:16:40,000 --> 00:16:49,000
+Database hosted by NIST after the first march, though not as long as the plugin is executed at least
+
+187
+00:16:49,000 --> 00:16:54,000
+once every seven days that I'm doing, it will only take a few seconds.
+
+188
+00:16:55,000 --> 00:17:03,000
+Once command is executed, I can navigate the target directory of each of my modules and I will be able
+
+189
+00:17:03,000 --> 00:17:05,000
+to find dependency.
+
+190
+00:17:05,000 --> 00:17:07,000
+Check Report page HTML file.
+
+191
+00:17:07,000 --> 00:17:08,000
+Let's open it.
+
+192
+00:17:09,000 --> 00:17:18,000
+You can find here scan information vulnerabilities detected in each library severity evidence count
+
+193
+00:17:18,000 --> 00:17:23,000
+detailed description of vulnerability and many, many other things.
+
+194
+00:17:23,000 --> 00:17:28,000
+And as I said, you will be able to find such reports in each module.
+
+195
+00:17:29,000 --> 00:17:34,000
+By the way, that can be different variations of consideration of this plugin.
+
+196
+00:17:34,000 --> 00:17:41,000
+For example, you can tell plugin to create the dependency check, report, email and sales and build
+
+197
+00:17:41,000 --> 00:17:47,000
+for CV, assess grateful ZAM or equal to a CV.
+
+198
+00:17:47,000 --> 00:17:55,000
+SS stands for the Common Good Scoring System in the first lesson one we have in front of us and now
+
+199
+00:17:56,000 --> 00:17:59,000
+some basic terms I explain what it is.
+
+200
+00:18:00,000 --> 00:18:05,000
+So just in case you want to refresh in knowledge, just check various classes.
+
+201
+00:18:06,000 --> 00:18:12,000
+Regarding configuration of this body as aberrations are also possible.
+
+202
+00:18:12,000 --> 00:18:20,000
+You can check the temptation of this bargain because really a lot of different court cases that probably
+
+203
+00:18:20,000 --> 00:18:21,000
+is not applicable for everyone.
+
+204
+00:18:22,000 --> 00:18:29,000
+And in all possible cases, you have to use the most common configuration of this plugin and depending
+
+205
+00:18:29,000 --> 00:18:33,000
+on your project specifics, you can configure it in another way.
+
+206
+00:18:34,000 --> 00:18:39,000
+Dependency chart, however, is not the only option available to developers.
+
+207
+00:18:40,000 --> 00:18:44,000
+There are also vulnerability scanners that can help you to scan your code.
+
+208
+00:18:45,000 --> 00:18:49,000
+You can even integrate commerce into your CIC pipeline.
+
+209
+00:18:50,000 --> 00:18:56,000
+For example, let me open the official website of the snake oil snake as a service.
+
+210
+00:18:56,000 --> 00:19:04,000
+It is many things is similar to dependency chat but offers more features in that integration options.
+
+211
+00:19:04,000 --> 00:19:12,000
+For instance, if you are using it, it can forbid merging the request if the changes introduce a new
+
+212
+00:19:12,000 --> 00:19:13,000
+vulnerable dependency.
+
+213
+00:19:14,000 --> 00:19:18,000
+Even more importantly, it suggests a remediation path.
+
+214
+00:19:19,000 --> 00:19:24,000
+This has different pricing models and I am not advertising it.
+
+215
+00:19:24,000 --> 00:19:27,000
+I get nothing from Holdens as some of you really.
+
+216
+00:19:27,000 --> 00:19:32,000
+You can find any similar to and select to utilise the most.
+
+217
+00:19:33,000 --> 00:19:35,000
+Among others, of them religious scholars.
+
+218
+00:19:35,000 --> 00:19:47,000
+I can also name a few of the ones, for example kinetics v secure verbs in Jyothi Lundgaard Frontline
+
+219
+00:19:47,000 --> 00:19:57,000
+NASA's next posts and map open V.A. s, sane, Hannibal and many, many others.
+
+220
+00:19:58,000 --> 00:20:03,000
+It will be really hard to make an overview of each of the mentioned tools because they have a lot of
+
+221
+00:20:03,000 --> 00:20:11,000
+different features and sometimes some unique features so as to make your own research.
+
+222
+00:20:11,000 --> 00:20:14,000
+At least now you have a starting point.
+
+223
+00:20:14,000 --> 00:20:20,000
+And even in case you have any questions, please do not be shy to ask your questions.
+
+224
+00:20:20,000 --> 00:20:24,000
+Below is a video and I will be happy to answer.
+
+225
+00:20:24,000 --> 00:20:25,000
+Let's continue.
+
+226
+00:20:26,000 --> 00:20:33,000
+Let's talk about how to prevent negative consequences that might arise because of vulnerable and outdated
+
+227
+00:20:33,000 --> 00:20:34,000
+components.
+
+228
+00:20:35,000 --> 00:20:42,000
+To prevent this issue, the ideal solution would be to never trust set party components unless you are
+
+229
+00:20:42,000 --> 00:20:44,000
+sure of their safety.
+
+230
+00:20:44,000 --> 00:20:48,000
+Unfortunately, this is easier said than done.
+
+231
+00:20:48,000 --> 00:20:57,000
+In fact, it is not realistic to manually verify all the models you use in your quote have a party management
+
+232
+00:20:57,000 --> 00:21:04,000
+process which helps you sit back and watch all components using public vulnerabilities and exposure
+
+233
+00:21:05,000 --> 00:21:05,000
+databases.
+
+234
+00:21:06,000 --> 00:21:12,000
+Today as a demo, we learned some tools that you can use to detect vulnerabilities.
+
+235
+00:21:13,000 --> 00:21:15,000
+Use services like Snoop IO.
+
+236
+00:21:16,000 --> 00:21:17,000
+Integrate those.
+
+237
+00:21:17,000 --> 00:21:17,000
+And to use the.
+
+238
+00:21:19,000 --> 00:21:22,000
+Use of all logging to check dependencies like.
+
+239
+00:21:22,000 --> 00:21:22,000
+Shows.
+
+240
+00:21:23,000 --> 00:21:24,000
+The use of demo.
+
+241
+00:21:25,000 --> 00:21:32,000
+Installs the components with trusted channels, remove unused dependencies, unnecessary features,
+
+242
+00:21:33,000 --> 00:21:36,000
+components and files to use the surface.
+
+243
+00:21:38,000 --> 00:21:38,000
+Continuous.
+
+244
+00:21:38,000 --> 00:21:43,000
+The inventor is versions of both client side and server side components.
+
+245
+00:21:44,000 --> 00:21:45,000
+For example frameworks.
+
+246
+00:21:45,000 --> 00:21:46,000
+Libraries.
+
+247
+00:21:47,000 --> 00:21:54,000
+Continuous monitoring, monitor sources like common vulnerabilities and exposures and national vulnerability,
+
+248
+00:21:54,000 --> 00:22:01,000
+not the base vulnerabilities in the components use software composition analysis tools to automate the
+
+249
+00:22:01,000 --> 00:22:02,000
+process.
+
+250
+00:22:03,000 --> 00:22:06,000
+That's all what I wanted to discuss with you in this lesson.
+
+251
+00:22:06,000 --> 00:22:09,000
+Let's recap what we have learned today.
+
+252
+00:22:10,000 --> 00:22:17,000
+In this lesson, we have gone for vulnerable and outdated risk categories about redesigned risk factors
+
+253
+00:22:17,000 --> 00:22:21,000
+that can increase probability of negative consequences.
+
+254
+00:22:21,000 --> 00:22:25,000
+Also, you used multiple common vehicles enumerations.
+
+255
+00:22:25,000 --> 00:22:29,000
+I explained how attackers use movable components.
+
+256
+00:22:30,000 --> 00:22:33,000
+You use the real life example of attack.
+
+257
+00:22:33,000 --> 00:22:40,000
+Besides, they compare the risk category in a top down 2017 and 2021.
+
+258
+00:22:41,000 --> 00:22:46,000
+We learned how to use the tendency check login in your application.
+
+259
+00:22:46,000 --> 00:22:53,000
+Now you know what the liability scammers are, and the examples of lesson was summarized what we have
+
+260
+00:22:53,000 --> 00:22:54,000
+learned and discussed.
+
+261
+00:22:54,000 --> 00:22:56,000
+How to prevent vulnerabilities.
+
+262
+00:22:57,000 --> 00:22:59,000
+Central for your attention.
+
+263
+00:22:59,000 --> 00:23:00,000
+Have a great day and see you.
+
+264
+00:23:01,000 --> 00:23:02,000
+Next lesson.
+

73 - OWASP Top 10 2021/013 pom.xml-from-the-lesson-with-OWASP-plugin.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/AndriiPiatakha/java-learnit-web-online-store/blob/master/pom.xml

73 - OWASP Top 10 2021/014 Identification & Authentication Failures_en.srt

@@ -0,0 +1,1432 @@
+1
+00:00:05,000 --> 00:00:06,000
+Hello, team.
+
+2
+00:00:06,000 --> 00:00:14,000
+In this last we proceed loans and next risk category from OWASP Top ten, we're going to learn ID and
+
+3
+00:00:14,000 --> 00:00:15,000
+some education payloads.
+
+4
+00:00:16,000 --> 00:00:20,000
+We'll start from the general overview of this risk category.
+
+5
+00:00:21,000 --> 00:00:27,000
+I will explain potential impacts that may be caused by identification and authentication payloads.
+
+6
+00:00:28,000 --> 00:00:30,000
+We're going to review a notable common weakness.
+
+7
+00:00:30,000 --> 00:00:40,000
+Enumerations after that will compare this risk category in August of 2017 versus avast top ten 2021.
+
+8
+00:00:41,000 --> 00:00:49,000
+In the last hour, explain how attackers may exploit broken authentication to gather on new concepts
+
+9
+00:00:49,000 --> 00:00:57,000
+like session fixation, cross-site request, forgery, execution after writing checks specially for
+
+10
+00:00:57,000 --> 00:01:03,000
+this lesson, I guess there is a risk factors that can increase the risk of potential attack.
+
+11
+00:01:04,000 --> 00:01:08,000
+Separately, we're going to talk about multi-factor authentication.
+
+12
+00:01:08,000 --> 00:01:11,000
+I will explain what session ID entropy is.
+
+13
+00:01:12,000 --> 00:01:16,000
+And as always, we're going to review examples of attacks.
+
+14
+00:01:17,000 --> 00:01:23,000
+You will learn what credential stuffing, brute force access and session hijacking are.
+
+15
+00:01:24,000 --> 00:01:30,000
+At the end of the lesson, we're going to discuss how to prevent attacks related to unification and
+
+16
+00:01:30,000 --> 00:01:31,000
+authentication failures.
+
+17
+00:01:32,000 --> 00:01:35,000
+Let's start our lesson as always.
+
+18
+00:01:35,000 --> 00:01:40,000
+Let's start from high level overview to understand what this risk category is all about.
+
+19
+00:01:41,000 --> 00:01:48,000
+Identification and authentication failures can occur when functions are related to a user's identity.
+
+20
+00:01:49,000 --> 00:01:57,000
+Authentication or session management are not implemented correctly or not adequately protected by application.
+
+21
+00:01:58,000 --> 00:02:05,000
+Attackers may be able to exploit identification and authentication failures by compromising passwords,
+
+22
+00:02:06,000 --> 00:02:11,000
+keys, session tokens or exploit OSI implementation flaws.
+
+23
+00:02:11,000 --> 00:02:17,000
+To assume the user's identity is a temporary or permanently broken.
+
+24
+00:02:17,000 --> 00:02:25,000
+Authentication means an attacker can gain access to restricted data by pretending to be a different
+
+25
+00:02:25,000 --> 00:02:25,000
+user.
+
+26
+00:02:26,000 --> 00:02:33,000
+The attacker provides authentication credentials of a different user and logs into the system.
+
+27
+00:02:34,000 --> 00:02:41,000
+In this way, the attack against access to all the data and functionality of the user keeper has to
+
+28
+00:02:41,000 --> 00:02:41,000
+be.
+
+29
+00:02:42,000 --> 00:02:49,000
+For instance, if an attacker provides the credentials of the admin user, he will have total control
+
+30
+00:02:49,000 --> 00:02:51,000
+or was a compromised system.
+
+31
+00:02:52,000 --> 00:02:59,000
+Authentication means you are who you say you are and ID is also the same.
+
+32
+00:03:00,000 --> 00:03:07,000
+That's why in my opinion the name is a little bit confusing so we will not dive deeper.
+
+33
+00:03:07,000 --> 00:03:10,000
+It is a syntactical difference between these two camps.
+
+34
+00:03:11,000 --> 00:03:14,000
+Basically, this risk category describes cases.
+
+35
+00:03:14,000 --> 00:03:22,000
+One attacker acts on behalf of the user because of the broken system or vulnerabilities found in the
+
+36
+00:03:22,000 --> 00:03:23,000
+system.
+
+37
+00:03:24,000 --> 00:03:31,000
+Let's review potential impacts that may be caused by vulnerabilities related to the identification and
+
+38
+00:03:31,000 --> 00:03:35,000
+authentication failures and more potential impact.
+
+39
+00:03:35,000 --> 00:03:36,000
+It is worse.
+
+40
+00:03:36,000 --> 00:03:44,000
+Two names of following ones loss of administrative access in case authentication will be broken and
+
+41
+00:03:44,000 --> 00:03:51,000
+the attacker will get access to the account with admin role, then the whole system may be compromised.
+
+42
+00:03:52,000 --> 00:03:59,000
+It only takes a single account was administrative access to be compromised and the attackers have access
+
+43
+00:03:59,000 --> 00:04:01,000
+to the entire system.
+
+44
+00:04:01,000 --> 00:04:10,000
+On that full disclosure of sensitive information, unauthorized access may disclose sensitive information
+
+45
+00:04:10,000 --> 00:04:15,000
+in the previous lesson learned already what can be considered a sensitive information.
+
+46
+00:04:16,000 --> 00:04:24,000
+That's why I wouldn't stop on this performing actions on behalf of OSI users getting access to accounts
+
+47
+00:04:24,000 --> 00:04:25,000
+of other users.
+
+48
+00:04:25,000 --> 00:04:32,000
+Attackers can perform actions on their behalf depending on the domain of the application.
+
+49
+00:04:32,000 --> 00:04:40,000
+This may lead to losing money his account of the user money laundering, Social Security fraud and identity
+
+50
+00:04:40,000 --> 00:04:46,000
+theft or disclosure of legally protected, highly sensitive information.
+
+51
+00:04:46,000 --> 00:04:52,000
+Any of mentioned impacts can cost a lot to your company and your organization.
+
+52
+00:04:52,000 --> 00:05:01,000
+For example, losing the personal data of European citizens could invoke GBR fines of up to 4% of a
+
+53
+00:05:01,000 --> 00:05:03,000
+company's annual global revenue.
+
+54
+00:05:04,000 --> 00:05:08,000
+For large companies, this could run to billions of dollars.
+
+55
+00:05:08,000 --> 00:05:15,000
+Broken authentication is a serious threat to application and website developers have made.
+
+56
+00:05:15,000 --> 00:05:17,000
+Strikers and owners.
+
+57
+00:05:18,000 --> 00:05:27,000
+Let's discuss now notable common weakness enumerations associated with this category notable c w e included
+
+58
+00:05:27,000 --> 00:05:31,000
+rcwe2 hundred 97.
+
+59
+00:05:32,000 --> 00:05:36,000
+Improper validation of scientific hat was host mismatch.
+
+60
+00:05:37,000 --> 00:05:45,000
+Even if a certificate is well-formed sign and follows the chain of trust, it may simply be a valid
+
+61
+00:05:45,000 --> 00:05:48,000
+certificate for a different site.
+
+62
+00:05:48,000 --> 00:05:57,000
+Then the site is in the software is interacting with user certificates, hosts specific data is not
+
+63
+00:05:57,000 --> 00:06:05,000
+properly checked, such as a common name in the subject or is a subject alternatively extension of an
+
+64
+00:06:05,000 --> 00:06:08,000
+X point 509 certificate.
+
+65
+00:06:08,000 --> 00:06:15,000
+It may be possible for a redirection or spoofing an that allow a malicious host with a valid certificate
+
+66
+00:06:16,000 --> 00:06:17,000
+to provide data.
+
+67
+00:06:18,000 --> 00:06:20,000
+Impersonate a trusted host.
+
+68
+00:06:21,000 --> 00:06:28,000
+In order to ensure data integrity, the certificate must be valid and that must pertain to the site
+
+69
+00:06:29,000 --> 00:06:35,000
+that is being accessed even if the software attempts to check the hostname.
+
+70
+00:06:36,000 --> 00:06:40,000
+It is still possible to incorrectly check the hostname.
+
+71
+00:06:40,000 --> 00:06:48,000
+For example, attackers could create a certificate with a name begins with a trusted name, followed
+
+72
+00:06:48,000 --> 00:06:54,000
+by a load by which could cause some string based comparisons to only eggs and lines.
+
+73
+00:06:54,000 --> 00:06:57,000
+A portion that contains a trusted name.
+
+74
+00:06:58,000 --> 00:06:59,000
+What is new?
+
+75
+00:06:59,000 --> 00:07:02,000
+By also reviewed in our previous lessons.
+
+76
+00:07:03,000 --> 00:07:09,000
+And anyway, in case something is not clear, do not hesitate to ask your questions below.
+
+77
+00:07:09,000 --> 00:07:12,000
+Xavier and I will be happy to answer.
+
+78
+00:07:13,000 --> 00:07:15,000
+cwe2 hundred 87.
+
+79
+00:07:16,000 --> 00:07:18,000
+Improper Authentication.
+
+80
+00:07:19,000 --> 00:07:25,000
+This c describes a case when an actor claims to have a given identity.
+
+81
+00:07:25,000 --> 00:07:32,000
+This software doesn't prove or insufficiently proves that the claim is correct.
+
+82
+00:07:33,000 --> 00:07:37,000
+CWA e 384 session fixation.
+
+83
+00:07:38,000 --> 00:07:47,000
+Such scenario is commonly observed when advocation authenticates a user without first invalidating the
+
+84
+00:07:47,000 --> 00:07:54,000
+existence session, thereby continuing to use the session already associated with the user.
+
+85
+00:07:55,000 --> 00:08:03,000
+An attacker is able to force the null session identifier on the user so that once the user authenticates,
+
+86
+00:08:04,000 --> 00:08:07,000
+that talker has access to the authenticated session.
+
+87
+00:08:08,000 --> 00:08:16,000
+The application will contain the user's projected will session identifiers in the generic excluded of
+
+88
+00:08:16,000 --> 00:08:19,000
+the session fixation or immunities and attack.
+
+89
+00:08:19,000 --> 00:08:27,000
+It creates and use session on a valid location and the recourse associated session identify the attackers
+
+90
+00:08:27,000 --> 00:08:33,000
+and causes the victim to associate and possibly authenticate against the server.
+
+91
+00:08:33,000 --> 00:08:41,000
+Using that session event file gives the attacker access to the user's account through the active session.
+
+92
+00:08:41,000 --> 00:08:45,000
+These are the most notable common vacancies enumerations.
+
+93
+00:08:45,000 --> 00:08:46,000
+Let's move on.
+
+94
+00:08:47,000 --> 00:08:53,000
+Let's compare our last top ten, 2017 versus 2021.
+
+95
+00:08:54,000 --> 00:09:04,000
+As you can see on this slide, broken authentication was on the second position in 2017 inches 2021.
+
+96
+00:09:04,000 --> 00:09:12,000
+It was renamed the identification and Authentication Failures and was moved to the position number seven.
+
+97
+00:09:13,000 --> 00:09:21,000
+Now, this risk category includes common weakness, nominations related to ID failures less known what
+
+98
+00:09:21,000 --> 00:09:29,000
+techniques are used by attackers to exploit broken authentication lines the way how attackers act.
+
+99
+00:09:30,000 --> 00:09:39,000
+We will be ready to react on this and we are going to run source of impacts first and after the lesson
+
+100
+00:09:39,000 --> 00:09:42,000
+we're going to know how to mitigate these attacks.
+
+101
+00:09:43,000 --> 00:09:47,000
+So attackers use a range of techniques, including the fallen.
+
+102
+00:09:49,000 --> 00:09:56,000
+Brute force or credential stuffing in one of the previous last real working years was a brute force
+
+103
+00:09:56,000 --> 00:10:04,000
+is and brute force attack consists of an attacker submitting many passwords or pass phrases with the
+
+104
+00:10:04,000 --> 00:10:07,000
+hope of eventually guessing correctly.
+
+105
+00:10:08,000 --> 00:10:15,000
+Credential stuff is a type of cyber attack in which that target collects stolen account credentials
+
+106
+00:10:16,000 --> 00:10:25,000
+typically consists of lists of usernames and or email addresses and the corresponding passwords, often
+
+107
+00:10:25,000 --> 00:10:32,000
+from a data breach, and then uses the credentials to gain unauthorized access to user accounts.
+
+108
+00:10:32,000 --> 00:10:37,000
+So large scale automated logging requests directed against a web application.
+
+109
+00:10:38,000 --> 00:10:45,000
+Session hijacking, session hijacking, sometimes also known as kook hijacking.
+
+110
+00:10:45,000 --> 00:10:54,000
+It is the exploitation of a valid computer session to gain unauthorized access to information or services
+
+111
+00:10:54,000 --> 00:10:55,000
+in the computer system.
+
+112
+00:10:56,000 --> 00:11:03,000
+In particular, this channel is used to refer to the zest of the cookie used to authenticate the user
+
+113
+00:11:03,000 --> 00:11:04,000
+to a remote server.
+
+114
+00:11:05,000 --> 00:11:07,000
+Do you remember this lesson I showed you?
+
+115
+00:11:07,000 --> 00:11:14,000
+How a topic and steal a session, a cookie, and after that just be authorized in the application.
+
+116
+00:11:15,000 --> 00:11:18,000
+So this is exactly about describe in this case.
+
+117
+00:11:20,000 --> 00:11:27,000
+Session fixation will really talked about session fixation when we reviewed the common vehicles enumerations.
+
+118
+00:11:28,000 --> 00:11:30,000
+But let's recap one more time.
+
+119
+00:11:31,000 --> 00:11:38,000
+Session fixation is a type of attack on web application users, where an attacker is able to trick the
+
+120
+00:11:38,000 --> 00:11:45,000
+victim into using the session they need, which is previously known to zap the attacker.
+
+121
+00:11:45,000 --> 00:11:52,000
+Tweaks the user into using a specific session ID after the user walks into the web application using
+
+122
+00:11:52,000 --> 00:12:00,000
+the provided session and the attacker uses this method session ID to gain access to the user's account.
+
+123
+00:12:01,000 --> 00:12:08,000
+This attack, the first from session hijacking, ends the fact that the session ID is previously known
+
+124
+00:12:08,000 --> 00:12:15,000
+as the attacker and is forced onto the victim as opposed to the attacker discovering the tokens through
+
+125
+00:12:15,000 --> 00:12:17,000
+another ability.
+
+126
+00:12:18,000 --> 00:12:27,000
+Cross sides request forgery in a C as F attack and innocent and user is tweaked by an attack into submitting
+
+127
+00:12:27,000 --> 00:12:31,000
+a web request that they did not intend.
+
+128
+00:12:31,000 --> 00:12:39,000
+This may cause actions to be performed on the website that can change session, state or operation often
+
+129
+00:12:39,000 --> 00:12:40,000
+and users account.
+
+130
+00:12:41,000 --> 00:12:48,000
+Cross sides request forgery is an attack that forces an end user to execute unwanted actions on the
+
+131
+00:12:48,000 --> 00:12:52,000
+web application in which they are currently authenticated.
+
+132
+00:12:53,000 --> 00:13:01,000
+With a little help of social engineering, such as sending an email or chat, an attacker may twigs
+
+133
+00:13:01,000 --> 00:13:08,000
+that users of a web application into executing actions of the attacker's choosing gives a victim is
+
+134
+00:13:08,000 --> 00:13:17,000
+a normal use of a successful CSR attack can force the user to perform state changing requests like transferring
+
+135
+00:13:17,000 --> 00:13:25,000
+fonts, changing the email address and so force if the victim is an administrative account.
+
+136
+00:13:25,000 --> 00:13:29,000
+See SRF can compromise in time of their application.
+
+137
+00:13:30,000 --> 00:13:37,000
+Execution after redirect execution of the rhetoric is an attack where an attacker ignores, redirects
+
+138
+00:13:38,000 --> 00:13:43,000
+and retrieves sensitive content intended for authenticated users.
+
+139
+00:13:43,000 --> 00:13:44,000
+Let me explain.
+
+140
+00:13:45,000 --> 00:13:49,000
+Consider web application that has logging functionality.
+
+141
+00:13:49,000 --> 00:13:58,000
+Users who have an account can access content features in this web application only by logging in on
+
+142
+00:13:58,000 --> 00:14:06,000
+authenticated users are redirected to the login page for them the first to log in and get an authenticated
+
+143
+00:14:06,000 --> 00:14:06,000
+session.
+
+144
+00:14:07,000 --> 00:14:15,000
+This is one of the many situations where the execute after redirect vulnerability may create, and this
+
+145
+00:14:15,000 --> 00:14:23,000
+vulnerability arises in an improper implementation of court where the developer assumes the execution
+
+146
+00:14:23,000 --> 00:14:25,000
+stops after redirect.
+
+147
+00:14:25,000 --> 00:14:34,000
+However, it is not always true the remaining port of the page or several also gets executed.
+
+148
+00:14:34,000 --> 00:14:37,000
+This is about a case when you resurrect the user.
+
+149
+00:14:38,000 --> 00:14:45,000
+You shouldn't forget the call over char massive to stop execution of the mass in order to not execute
+
+150
+00:14:45,000 --> 00:14:51,000
+any line of code that is not supposed to be executed if the user is not, log in.
+
+151
+00:14:52,000 --> 00:14:57,000
+These are the main ways that attackers will use to exploit growth and authentication.
+
+152
+00:14:58,000 --> 00:15:04,000
+Let's continue with a view of how attackers will try to exploit the application.
+
+153
+00:15:04,000 --> 00:15:07,000
+And now let's review another side of the model.
+
+154
+00:15:07,000 --> 00:15:11,000
+Let's take a look what can increase the risk of attack.
+
+155
+00:15:12,000 --> 00:15:18,000
+Let's review risk factors that we have to avoid in order to make our application more secure.
+
+156
+00:15:19,000 --> 00:15:26,000
+So among risk factors that can increase the risk of broken or syndication attacks, it is worse to mention
+
+157
+00:15:26,000 --> 00:15:30,000
+is a following once using weak and standard passwords.
+
+158
+00:15:31,000 --> 00:15:37,000
+I know that this is a very common risk factor, but it is not an exclusion for this case.
+
+159
+00:15:37,000 --> 00:15:45,000
+Is a username and password for your admin panel are at me and admin an attacker can easily guys and
+
+160
+00:15:45,000 --> 00:15:47,000
+whole system will be compromised.
+
+161
+00:15:48,000 --> 00:15:53,000
+Hackers have broken into a lot of systems in the past because of weak passwords.
+
+162
+00:15:54,000 --> 00:16:01,000
+We can implement the password limitation policies to force our users to change password each month for
+
+163
+00:16:01,000 --> 00:16:02,000
+three months.
+
+164
+00:16:02,000 --> 00:16:05,000
+For example, looking to implement weak password check.
+
+165
+00:16:05,000 --> 00:16:08,000
+And so the creation of accounts was weak passwords.
+
+166
+00:16:09,000 --> 00:16:11,000
+As you can see, we have different options here.
+
+167
+00:16:12,000 --> 00:16:16,000
+Has missing or ineffective multi-factor authentication.
+
+168
+00:16:17,000 --> 00:16:22,000
+Absence of multi-factor authentication is a significant risk factor.
+
+169
+00:16:22,000 --> 00:16:29,000
+For example, each time you want to start the session with web application besides logging and passwords
+
+170
+00:16:29,000 --> 00:16:30,000
+provided.
+
+171
+00:16:30,000 --> 00:16:38,000
+User also receives a request to his or her mobile phone, for example, and only after the request is
+
+172
+00:16:38,000 --> 00:16:41,000
+confirmed, sessions start and create.
+
+173
+00:16:42,000 --> 00:16:48,000
+The request can be sent either into the native mobile app or, as this can be called, into Assamese.
+
+174
+00:16:49,000 --> 00:16:53,000
+This can be auto generated tokens at the end before signing in.
+
+175
+00:16:54,000 --> 00:17:00,000
+There are different ways how to implement this, but just remember that multi-factor authentication
+
+176
+00:17:00,000 --> 00:17:05,000
+is very efficient and proven mechanism to confirm the identity of a user.
+
+177
+00:17:06,000 --> 00:17:10,000
+And that's a risk factor is allowing brute force cracking.
+
+178
+00:17:11,000 --> 00:17:17,000
+If you change your credentials to something stronger, those credentials can still be compromised.
+
+179
+00:17:18,000 --> 00:17:23,000
+One way an attacker can gain those credentials is via brute force cracking.
+
+180
+00:17:23,000 --> 00:17:30,000
+And other words, an attacker creates an automated script that uses different combinations of usernames
+
+181
+00:17:30,000 --> 00:17:34,000
+and passwords sequentially until he finds the right combination.
+
+182
+00:17:35,000 --> 00:17:37,000
+This process can be very time consuming.
+
+183
+00:17:38,000 --> 00:17:40,000
+Days, weeks, or even months.
+
+184
+00:17:40,000 --> 00:17:47,000
+But if you don't programmed this kind of attack, it is still doable to prevent this kind of attack.
+
+185
+00:17:47,000 --> 00:17:55,000
+Implementing delays with failed attempts to lock in or block logging attempts completely after you failed
+
+186
+00:17:55,000 --> 00:17:57,000
+to log in at times in a row.
+
+187
+00:17:58,000 --> 00:18:05,000
+Using weak or ineffective credential recovery and forgot password processes such as knowledge based
+
+188
+00:18:05,000 --> 00:18:12,000
+answers which can be made safe will ready discussed in previous classes.
+
+189
+00:18:12,000 --> 00:18:18,000
+That is is not the best practice to rely on the secrets questions while restoring the password.
+
+190
+00:18:19,000 --> 00:18:26,000
+Because in the area of social networks, this relatively easy to steal information builds the user or
+
+191
+00:18:26,000 --> 00:18:30,000
+clarify through the path of the mother's maiden name.
+
+192
+00:18:31,000 --> 00:18:39,000
+So make sure that restoring password flow is also secure and uses other communication channels that
+
+193
+00:18:39,000 --> 00:18:42,000
+only user identity has.
+
+194
+00:18:42,000 --> 00:18:51,000
+For example, make sure you enable some verification of the user use of password restoring sending credentials
+
+195
+00:18:51,000 --> 00:18:53,000
+in an insecure way.
+
+196
+00:18:54,000 --> 00:19:01,000
+Even if you use a strong password and prevent brute force attacks, but send the credentials to the
+
+197
+00:19:01,000 --> 00:19:05,000
+server in plaintext, use an unencrypted connection.
+
+198
+00:19:05,000 --> 00:19:09,000
+For example, you use a CTP but not a protocol.
+
+199
+00:19:10,000 --> 00:19:16,000
+Any other user who is connected to the same network as you can eavesdrop as a traffic.
+
+200
+00:19:17,000 --> 00:19:22,000
+Once attacker has the credentials, he can log in as if he were you.
+
+201
+00:19:23,000 --> 00:19:25,000
+Improper session time.
+
+202
+00:19:26,000 --> 00:19:29,000
+It's important to set a time out for our log in session.
+
+203
+00:19:30,000 --> 00:19:37,000
+This means that after a certain period of inactivity, the user is automatically left out from the system.
+
+204
+00:19:38,000 --> 00:19:41,000
+Failing to do so may result in session hijacking.
+
+205
+00:19:43,000 --> 00:19:45,000
+Expose in session identifiers.
+
+206
+00:19:45,000 --> 00:19:52,000
+Another way in which an attacker can compromise a session is by seeing the session identifier zero.
+
+207
+00:19:53,000 --> 00:19:59,000
+During this process, anyone who has a name can enter the stolen session.
+
+208
+00:20:00,000 --> 00:20:09,000
+Failing to secure API in an API is there is usually a way to define which roles should require and syndication
+
+209
+00:20:09,000 --> 00:20:11,000
+and which should not.
+
+210
+00:20:11,000 --> 00:20:18,000
+If you fail to add an authentication requirement for a role that should contain, the functionality
+
+211
+00:20:18,000 --> 00:20:21,000
+behind this role will be available worldwide.
+
+212
+00:20:22,000 --> 00:20:29,000
+And this is not the you should keep only public resources available, as resources should be protected
+
+213
+00:20:29,000 --> 00:20:31,000
+by authentication.
+
+214
+00:20:32,000 --> 00:20:36,000
+While reviewing the slide, I mentioned multi-factor authentication.
+
+215
+00:20:37,000 --> 00:20:43,000
+The name is MFA taking implementation side of the MFA.
+
+216
+00:20:43,000 --> 00:20:50,000
+I would say that this law is beyond the scope of this lesson, but I believe that we still need to cover
+
+217
+00:20:50,000 --> 00:20:58,000
+some basic radical knowledge about MFA that will serve as a starting point for Eugene's implementation.
+
+218
+00:20:58,000 --> 00:21:01,000
+So let's recap one more time.
+
+219
+00:21:01,000 --> 00:21:03,000
+What is MFA?
+
+220
+00:21:04,000 --> 00:21:11,000
+Multi-factor authentication is an authentication massive, which requires the user to provide two or
+
+221
+00:21:11,000 --> 00:21:20,000
+more verification factors to gain access to a resource such as an application online account or a VPN.
+
+222
+00:21:21,000 --> 00:21:27,000
+MFA is a core component of a strong identity and access management policy.
+
+223
+00:21:28,000 --> 00:21:31,000
+Rather than just asking for a username and password.
+
+224
+00:21:31,000 --> 00:21:39,000
+MFA requires one or more additional verification factors which decreases the likelihood of a successful
+
+225
+00:21:39,000 --> 00:21:40,000
+cyber attack.
+
+226
+00:21:41,000 --> 00:21:49,000
+MFA works by requiring additional verification confirmation factors that usually factor is that they
+
+227
+00:21:49,000 --> 00:22:01,000
+used under the MFA zero time based one time password short message service, electronic email push notifications.
+
+228
+00:22:02,000 --> 00:22:08,000
+One of the most common MFA factors is that user encounter is one time passwords.
+
+229
+00:22:08,000 --> 00:22:10,000
+Is that the U.S. user?
+
+230
+00:22:10,000 --> 00:22:13,000
+We are CMOs or on email.
+
+231
+00:22:14,000 --> 00:22:22,000
+I'm talking about those digit codes that you often receive email esims or some sort of mobile app and
+
+232
+00:22:22,000 --> 00:22:27,000
+you code is generated each time and a syndication request is submitted.
+
+233
+00:22:28,000 --> 00:22:35,000
+The Court is generated based upon the seat value as it is assigned to Z use of one Z first register
+
+234
+00:22:35,000 --> 00:22:41,000
+and some other factor which could simply be account incremented or the time value.
+
+235
+00:22:42,000 --> 00:22:50,000
+Most MFA authentication methodology is based on one of three types of additional information since you
+
+236
+00:22:50,000 --> 00:23:01,000
+no knowledge such as password of being since you have possession such as mage of smartphone, since
+
+237
+00:23:01,000 --> 00:23:07,000
+you are the parents such as biometric like fingerprints or voice and completion.
+
+238
+00:23:09,000 --> 00:23:11,000
+We talked with you about securing the session.
+
+239
+00:23:11,000 --> 00:23:15,000
+And let me elaborate on this a little bit more.
+
+240
+00:23:15,000 --> 00:23:24,000
+The session they need must be unpredictable, random enough to prevent gas attacks where an attacker
+
+241
+00:23:24,000 --> 00:23:31,000
+is able to guess or predict the idea of a valid session through statistical analysis techniques.
+
+242
+00:23:31,000 --> 00:23:39,000
+For this purpose, a good cryptographically secure pseudo random number generator must be used as a
+
+243
+00:23:39,000 --> 00:23:48,000
+set of guidelines created not only for Java's software engineers, but also for other programmers too.
+
+244
+00:23:49,000 --> 00:23:56,000
+I would say in case you create app on Java and you use some kind of web server, for example, you shouldn't
+
+245
+00:23:56,000 --> 00:24:04,000
+be bothered about this too much because required mechanisms are already implemented inside Tomcat.
+
+246
+00:24:05,000 --> 00:24:09,000
+Tomcat generates unique string for the session identifier.
+
+247
+00:24:10,000 --> 00:24:17,000
+If you don't have such feature out of the on your web server, you should use cryptographically secure
+
+248
+00:24:17,000 --> 00:24:19,000
+pseudo random number generator.
+
+249
+00:24:20,000 --> 00:24:27,000
+The main thing is to not use predictable sequences for this session I use the session I value must provide
+
+250
+00:24:27,000 --> 00:24:30,000
+at least 64 bits of entropy.
+
+251
+00:24:31,000 --> 00:24:38,000
+If a good random number generator is used, this value is estimated to be housing length of the session.
+
+252
+00:24:40,000 --> 00:24:42,000
+Additionally, our random session I use nothing else.
+
+253
+00:24:43,000 --> 00:24:47,000
+It must also be somewhat duplicate that I use.
+
+254
+00:24:48,000 --> 00:24:53,000
+A random session must not already exist in the current session i space.
+
+255
+00:24:54,000 --> 00:24:58,000
+Following these rules will help you to secure your S.A.T..
+
+256
+00:24:59,000 --> 00:25:01,000
+Now it is time to review.
+
+257
+00:25:01,000 --> 00:25:09,000
+Examples of attacks of our supposed Lords is a sweet time to attack parties that exploit weak association
+
+258
+00:25:10,000 --> 00:25:19,000
+their credentials, tough and brute force access session hijack lets you use these parties in scope
+
+259
+00:25:19,000 --> 00:25:22,000
+of the particular scenarios one by one.
+
+260
+00:25:23,000 --> 00:25:31,000
+Scenario number one for national stuff, the use of the use of known passwords is a common attack.
+
+261
+00:25:31,000 --> 00:25:37,000
+Suppose an application doesn't implement automated threat or credential stops and protection.
+
+262
+00:25:38,000 --> 00:25:46,000
+In that case, the application can be used as a password oracle to demand user credentials invalid user
+
+263
+00:25:46,000 --> 00:25:47,000
+credentials stuff.
+
+264
+00:25:47,000 --> 00:25:54,000
+An attacker can use automated tools to test a list of rather the usernames and passwords stolen from
+
+265
+00:25:54,000 --> 00:25:58,000
+one company against the website of another company.
+
+266
+00:25:59,000 --> 00:26:06,000
+Since users frequently use the same password on multiple accounts, attackers using this massive have
+
+267
+00:26:06,000 --> 00:26:07,000
+chances to achieve a success.
+
+268
+00:26:08,000 --> 00:26:16,000
+Scenario number two most authentication tech secure due to the continued use of passwords as a sole
+
+269
+00:26:16,000 --> 00:26:17,000
+factor.
+
+270
+00:26:18,000 --> 00:26:24,000
+Once considered best practices, passwords, limitation and complexity requirements encourage users
+
+271
+00:26:24,000 --> 00:26:27,000
+to use and reuse weak passwords.
+
+272
+00:26:28,000 --> 00:26:38,000
+Organisations are recommended to stop these processes per NIST 863 and use multi-factor authentication.
+
+273
+00:26:39,000 --> 00:26:42,000
+Multi-factor authentication should prevent brute force.
+
+274
+00:26:43,000 --> 00:26:49,000
+As we discussed, brute force and passwords is technically the process of trying every different password
+
+275
+00:26:49,000 --> 00:26:51,000
+possible to use.
+
+276
+00:26:51,000 --> 00:26:52,000
+The correct one is found.
+
+277
+00:26:53,000 --> 00:26:56,000
+In practice, this isn't necessary.
+
+278
+00:26:56,000 --> 00:27:03,000
+Attackers will use a list of the most common passwords, such as parcels and one, two, three, four,
+
+279
+00:27:03,000 --> 00:27:05,000
+five, six, seven, eight, nine.
+
+280
+00:27:05,000 --> 00:27:08,000
+And try each one in turn again.
+
+281
+00:27:08,000 --> 00:27:09,000
+Use an automated scripts.
+
+282
+00:27:10,000 --> 00:27:14,000
+Was users now having to manage so many different passwords?
+
+283
+00:27:15,000 --> 00:27:23,000
+The tendency for people to use simple ones and to use the same password across multiple accounts.
+
+284
+00:27:23,000 --> 00:27:28,000
+Brute force is consequently a simple and also effective attack.
+
+285
+00:27:30,000 --> 00:27:35,000
+Scenario number three, application session timeouts are not set correctly.
+
+286
+00:27:36,000 --> 00:27:41,000
+Imagine a case that is a hotel or at the airport.
+
+287
+00:27:41,000 --> 00:27:45,000
+A user uses a public computer to access an application.
+
+288
+00:27:46,000 --> 00:27:54,000
+Instead of selecting a logout, the user simply closes the browser tab and walks away and uses the same
+
+289
+00:27:54,000 --> 00:27:59,000
+browser an hour later, and the user is to authenticate.
+
+290
+00:28:00,000 --> 00:28:06,000
+Session hijacking is the exploitation of a legitimate user's authenticated session.
+
+291
+00:28:07,000 --> 00:28:15,000
+Once login is achieved, the host system will typically assign the session as a user so that it is necessary
+
+292
+00:28:15,000 --> 00:28:17,000
+to log in for each new page.
+
+293
+00:28:17,000 --> 00:28:25,000
+Within this session, there is usually a value as a displaced cookie on the user's computer.
+
+294
+00:28:26,000 --> 00:28:30,000
+In theory, it is removed when the user logs out from the session.
+
+295
+00:28:30,000 --> 00:28:37,000
+If an attacker can, other things, especially in any possible way, is a cross-site scripting.
+
+296
+00:28:37,000 --> 00:28:45,000
+By sniffing traffic while using laptop of the user, he or she is able to hijack a legitimate user's
+
+297
+00:28:45,000 --> 00:28:45,000
+session.
+
+298
+00:28:46,000 --> 00:28:55,000
+Since that user is already authenticated that Tucker is able to perform any action allowed to that user.
+
+299
+00:28:55,000 --> 00:29:02,000
+The most common session hijack attacks, I'm guessing all predicted, is a session talking snake on
+
+300
+00:29:02,000 --> 00:29:11,000
+the talking plan side attacks like peaks, SS malicious JavaScript codes, Trojans, etc..
+
+301
+00:29:12,000 --> 00:29:16,000
+Men's and naval attacks and manuals of browser attacks.
+
+302
+00:29:17,000 --> 00:29:25,000
+We have learned a lot about identification and authentication failures, review of that samples and
+
+303
+00:29:25,000 --> 00:29:31,000
+now we are ready to summarize recommendations and rules to follow to decrease the risk of vulnerabilities
+
+304
+00:29:31,000 --> 00:29:33,000
+from this risk category.
+
+305
+00:29:34,000 --> 00:29:38,000
+Luckily, most of the mitigation techniques are simple and straightforward.
+
+306
+00:29:39,000 --> 00:29:42,000
+If you use these techniques, zero waste decreases.
+
+307
+00:29:43,000 --> 00:29:49,000
+Most of those techniques are framework agnostic and can apply to all frameworks equally.
+
+308
+00:29:50,000 --> 00:29:53,000
+Let's review user recommendations one by one.
+
+309
+00:29:54,000 --> 00:29:58,000
+Implement multi-factor authentication wherever possible.
+
+310
+00:29:58,000 --> 00:30:06,000
+MFA supposed to prevent automated credential stuffing, brute force and stolen credential reuse attacks.
+
+311
+00:30:07,000 --> 00:30:13,000
+They're not sheep or the wall was any different credentials, especially for adding users.
+
+312
+00:30:15,000 --> 00:30:19,000
+Enforce the policy to prevent users from setting the business.
+
+313
+00:30:20,000 --> 00:30:28,000
+Implement password checks such as testing new or changed passwords against the top 10,000 versus password
+
+314
+00:30:28,000 --> 00:30:29,000
+release.
+
+315
+00:30:30,000 --> 00:30:38,000
+This should eliminate cases when users are able to set keyboard sequences as passwords like 30.
+
+316
+00:30:38,000 --> 00:30:40,000
+One, two, three, four, five six.
+
+317
+00:30:41,000 --> 00:30:49,000
+Introduce a password for a patient policy change that passwords and every specific amount of weeks or
+
+318
+00:30:49,000 --> 00:30:50,000
+each three months.
+
+319
+00:30:50,000 --> 00:30:53,000
+For example, you can implement logic.
+
+320
+00:30:53,000 --> 00:31:00,000
+One user receives notification about his password being expired and that he or she needs to change the
+
+321
+00:31:00,000 --> 00:31:04,000
+password in case password is expired.
+
+322
+00:31:04,000 --> 00:31:08,000
+User only can go through a set of password flow.
+
+323
+00:31:09,000 --> 00:31:16,000
+Limit or increase delays between failed attempts, basically zero different ways.
+
+324
+00:31:16,000 --> 00:31:17,000
+How to implement this.
+
+325
+00:31:17,000 --> 00:31:21,000
+I will let you think about the implementation and implement it.
+
+326
+00:31:22,000 --> 00:31:24,000
+This will be one of your whole tasks.
+
+327
+00:31:25,000 --> 00:31:29,000
+I will share the details about the whole tasks as a separate lesson.
+
+328
+00:31:30,000 --> 00:31:34,000
+Implement notifications when attack is detected.
+
+329
+00:31:35,000 --> 00:31:43,000
+Local sailors and alert administrators from Congressional staff and force OSR attacks the Texas.
+
+330
+00:31:44,000 --> 00:31:49,000
+Limit the session duration and invalidate the session after logout.
+
+331
+00:31:50,000 --> 00:31:52,000
+Store session and security.
+
+332
+00:31:53,000 --> 00:31:55,000
+This means a number of things at a time.
+
+333
+00:31:56,000 --> 00:31:59,000
+Namely, the not cost session is the euro.
+
+334
+00:32:00,000 --> 00:32:04,000
+Also, we learned today what is session entropy.
+
+335
+00:32:05,000 --> 00:32:11,000
+So ensure that the entropy source is quite good and also it is important.
+
+336
+00:32:11,000 --> 00:32:14,000
+Course something fun with the session time when a user is logged out.
+
+337
+00:32:15,000 --> 00:32:21,000
+These measures would take you a long way and help avoid such mistakes.
+
+338
+00:32:21,000 --> 00:32:28,000
+Confirmation of the user's identity authentication and session management is critical to protect against
+
+339
+00:32:28,000 --> 00:32:30,000
+syndication related attacks.
+
+340
+00:32:31,000 --> 00:32:32,000
+That's all.
+
+341
+00:32:32,000 --> 00:32:34,000
+What I wanted to share with you today is a lesson.
+
+342
+00:32:35,000 --> 00:32:37,000
+Let's recap what we have.
+
+343
+00:32:38,000 --> 00:32:39,000
+In this lesson.
+
+344
+00:32:39,000 --> 00:32:48,000
+The current identification and authentication failure risk category from a WASP Top ten we learned about
+
+345
+00:32:48,000 --> 00:32:50,000
+common vehicle enumerations.
+
+346
+00:32:50,000 --> 00:32:57,000
+We compared of top ten 2017 versus of up ten 2021.
+
+347
+00:32:57,000 --> 00:33:06,000
+I explained to you how to cross exclude broken authentication when you have such things as session fixation
+
+348
+00:33:06,000 --> 00:33:08,000
+plus size request forgery.
+
+349
+00:33:09,000 --> 00:33:14,000
+We have different factors that can increase probability of attacks.
+
+350
+00:33:15,000 --> 00:33:18,000
+WILLIAMS Multifactor authentication.
+
+351
+00:33:18,000 --> 00:33:25,000
+Also, I explained to you what session I.D. entropy is and how we can secure our session ID.
+
+352
+00:33:25,000 --> 00:33:29,000
+I explained different examples of attacks.
+
+353
+00:33:30,000 --> 00:33:36,000
+Now you know what credentials Statham brute force and session hijacking are.
+
+354
+00:33:36,000 --> 00:33:38,000
+And that's the end of the lesson.
+
+355
+00:33:38,000 --> 00:33:45,000
+We learned how to prevent our abilities associated with ID and authentication failures.
+
+356
+00:33:46,000 --> 00:33:48,000
+Thank you all for your attention.
+
+357
+00:33:48,000 --> 00:33:50,000
+Have a great day and see you.
+
+358
+00:33:50,000 --> 00:33:51,000
+Next lesson.
+

73 - OWASP Top 10 2021/015 Software & Data Integrity Failures_en.srt

@@ -0,0 +1,740 @@
+1
+00:00:06,000 --> 00:00:06,000
+Hello, you.
+
+2
+00:00:06,000 --> 00:00:12,000
+In this lesson, we're going to talk about software and data integrity failures, risk category from
+
+3
+00:00:12,000 --> 00:00:13,000
+a loss stop.
+
+4
+00:00:13,000 --> 00:00:20,000
+That will start from the general overview of this risk category, I'm going to explain potential impacts
+
+5
+00:00:21,000 --> 00:00:23,000
+that can be caused by vulnerabilities.
+
+6
+00:00:23,000 --> 00:00:29,000
+From this risk category, we'll reviews the most notable common weakness enumerations.
+
+7
+00:00:30,000 --> 00:00:36,000
+As always, we're going to compare of us top ten 2017 versus 2021.
+
+8
+00:00:37,000 --> 00:00:44,000
+After that, we're going to review examples of attacks and as in the of lesson will talk about how to
+
+9
+00:00:44,000 --> 00:00:49,000
+prevent vulnerabilities related to software and data integrity failures.
+
+10
+00:00:50,000 --> 00:00:51,000
+Let's start our lesson.
+
+11
+00:00:52,000 --> 00:00:56,000
+Let's start from a high level overview of this risk category.
+
+12
+00:00:56,000 --> 00:01:04,000
+Nowadays relief in times of agile roles, fast delivery error of startups and technology breakthrough.
+
+13
+00:01:05,000 --> 00:01:13,000
+It is highly competitive market in many teams, and this rash leads sometimes to negative consequences.
+
+14
+00:01:13,000 --> 00:01:15,000
+You're in the software development.
+
+15
+00:01:15,000 --> 00:01:21,000
+Modern software culture encourages rapid loses and short cycles.
+
+16
+00:01:22,000 --> 00:01:31,000
+DevOps teams and security teams have less time to check the quality of you code and identify cryptographic
+
+17
+00:01:31,000 --> 00:01:38,000
+failures, vulnerable and outdated components or identification and syndication failures built into
+
+18
+00:01:38,000 --> 00:01:39,000
+the software.
+
+19
+00:01:39,000 --> 00:01:48,000
+While security professionals always should shift that, it's apparent that there are development teams
+
+20
+00:01:48,000 --> 00:01:55,000
+out there that do not have sufficient integrity verification processes that allows them to analyze,
+
+21
+00:01:55,000 --> 00:02:00,000
+work and protect users against malicious code.
+
+22
+00:02:00,000 --> 00:02:04,000
+All this leads to software and data integrity failures.
+
+23
+00:02:05,000 --> 00:02:06,000
+In few worlds.
+
+24
+00:02:06,000 --> 00:02:16,000
+This category is about the assumptions linked with critical CI pipeline data handling and software integrity
+
+25
+00:02:16,000 --> 00:02:17,000
+failures.
+
+26
+00:02:17,000 --> 00:02:25,000
+Let's now discuss what potential impact can be caused by software and data integrity failures and recap
+
+27
+00:02:25,000 --> 00:02:33,000
+one more time how they may cure the complexity of architectures in more than data release cycles.
+
+28
+00:02:33,000 --> 00:02:41,000
+Often forces developers to use plugins, modules and libraries from public repositories, untrusted
+
+29
+00:02:41,000 --> 00:02:44,000
+sources and content delivery networks.
+
+30
+00:02:45,000 --> 00:02:53,000
+Due to such complexities, software and data integrity failures categorized as design flaws accuracy.
+
+31
+00:02:53,000 --> 00:03:00,000
+When critical data and software updates are added to the delivery pipeline without work finds integrity
+
+32
+00:03:00,000 --> 00:03:08,000
+in the absence of adequate validation, software and data integrity failures make applications susceptible
+
+33
+00:03:08,000 --> 00:03:15,000
+to unauthorized information, disclosure, system, compromise or insertion of malicious code.
+
+34
+00:03:16,000 --> 00:03:24,000
+Modern software delivery pipelines include auto update functionality streamlines the life cycles by
+
+35
+00:03:24,000 --> 00:03:28,000
+downloading updates and applying them without inherent permissions.
+
+36
+00:03:29,000 --> 00:03:36,000
+Threat actors can exploit such functionalities, but performance and imminent attack to inject malicious
+
+37
+00:03:36,000 --> 00:03:39,000
+code into the pipeline to update causes.
+
+38
+00:03:40,000 --> 00:03:47,000
+This results in corrupted payloads being deployed and executed outright on application installations.
+
+39
+00:03:48,000 --> 00:03:52,000
+As always, let's review notable common vehicles enumerations.
+
+40
+00:03:53,000 --> 00:03:55,000
+Let's use them one by one.
+
+41
+00:03:56,000 --> 00:04:05,000
+we4 hundred 94 download of Code Without Integrity Chat and that topic can execute malicious code by
+
+42
+00:04:05,000 --> 00:04:13,000
+compromising the host server, performing DNS spoofing or modifying zip code in transit.
+
+43
+00:04:13,000 --> 00:04:21,000
+Attacks or accidental corruption can introduce invalid files into Conti's repository and verifying file
+
+44
+00:04:21,000 --> 00:04:23,000
+integrity can identify them.
+
+45
+00:04:24,000 --> 00:04:33,000
+In this process, the security teams can pat files digital signature or hashed content with no values.
+
+46
+00:04:33,000 --> 00:04:37,000
+Be sure the files are not altered or corrupted.
+
+47
+00:04:37,000 --> 00:04:46,000
+Some manual processes and automated checks, some validation might not detect changes in a file so corruption
+
+48
+00:04:46,000 --> 00:04:50,000
+can be used as surface content.
+
+49
+00:04:50,000 --> 00:04:57,000
+Security teams can validate a digital signature or use a cryptographic checksum in which they run the
+
+50
+00:04:57,000 --> 00:05:02,000
+hash algorithm against the file to verify file integrity.
+
+51
+00:05:02,000 --> 00:05:11,000
+Validation enables teams to find any changes to the file itself, such as file the nation and its movements
+
+52
+00:05:11,000 --> 00:05:13,000
+or unauthorized access.
+
+53
+00:05:14,000 --> 00:05:22,000
+These changes can reveal a prior intrusion from start to finish or reveal a larger attack that is under
+
+54
+00:05:22,000 --> 00:05:25,000
+way or that the team is investigating.
+
+55
+00:05:26,000 --> 00:05:29,000
+See WP 502.
+
+56
+00:05:29,000 --> 00:05:34,000
+This realisation of untrusted data cause your from zero.
+
+57
+00:05:34,000 --> 00:05:42,000
+The first job in the section about input and output streams will rejoin Watson zation and this civilization
+
+58
+00:05:42,000 --> 00:05:44,000
+is to learn more.
+
+59
+00:05:44,000 --> 00:05:47,000
+Please refer to this section of the course.
+
+60
+00:05:48,000 --> 00:05:56,000
+Ensure in Java, civilization is a process of converting an object into a stream of bytes to store the
+
+61
+00:05:56,000 --> 00:06:01,000
+object or transmit it to memory and database or the file.
+
+62
+00:06:01,000 --> 00:06:04,000
+Disorganization is a reverse process.
+
+63
+00:06:05,000 --> 00:06:10,000
+But centralization is not what can be done only in Java and was three bytes.
+
+64
+00:06:11,000 --> 00:06:13,000
+Serialization accuracy.
+
+65
+00:06:13,000 --> 00:06:21,000
+When an application converts data structures and objects into a different form, such as binary or structured
+
+66
+00:06:21,000 --> 00:06:27,000
+tax, x amount and JSON so that it is suitable for other purposes.
+
+67
+00:06:28,000 --> 00:06:34,000
+Neutralization is when an application reverts as a serialized output into its original form.
+
+68
+00:06:35,000 --> 00:06:42,000
+It is often convenient to serialize objects for communication or to see them for later use.
+
+69
+00:06:42,000 --> 00:06:51,000
+However, these serialized data or code can often be modified without using the provided access of functions
+
+70
+00:06:52,000 --> 00:06:56,000
+if it doesn't use cryptographic to protect itself.
+
+71
+00:06:57,000 --> 00:06:59,000
+CW 849.
+
+72
+00:07:00,000 --> 00:07:08,000
+Inclusion of functionality from untrusted control sphere when including such partisanship analogy such
+
+73
+00:07:08,000 --> 00:07:16,000
+as map, widget, library or a source of functionality, this software must effectively trust that functionality
+
+74
+00:07:17,000 --> 00:07:20,000
+without sufficient protection mechanisms.
+
+75
+00:07:20,000 --> 00:07:27,000
+The functionality could be malicious in nature user by common someone untrusted source being spoofed
+
+76
+00:07:27,000 --> 00:07:31,000
+or being modified in transit from a trusted source.
+
+77
+00:07:31,000 --> 00:07:39,000
+The functionality might also contain its own weakness or grant access to additional functionality and
+
+78
+00:07:39,000 --> 00:07:42,000
+state information that should be kept private.
+
+79
+00:07:42,000 --> 00:07:51,000
+Based system such as system state information, sensitive application data, or the DOM of that application.
+
+80
+00:07:52,000 --> 00:07:59,000
+This might lead to many different consequences dependent on the included functionality, but some examples
+
+81
+00:07:59,000 --> 00:08:07,000
+include injection of malware information exposure by granting excessive privileges or permissions to
+
+82
+00:08:07,000 --> 00:08:11,000
+trust, which are now done based accessible.
+
+83
+00:08:11,000 --> 00:08:16,000
+In our view, it is still users who use or open redirect to malware.
+
+84
+00:08:17,000 --> 00:08:24,000
+Now let's compare Avast Top ten 2017 versus Avast the top ten 2021.
+
+85
+00:08:25,000 --> 00:08:30,000
+This is a new category that was absent in Avast Top ten 2017.
+
+86
+00:08:30,000 --> 00:08:35,000
+This category also includes a category from across the top ten 2017.
+
+87
+00:08:36,000 --> 00:08:38,000
+I'm talking about insecure.
+
+88
+00:08:38,000 --> 00:08:46,000
+Decentralization is a vulnerability here is that a serialized object can be manipulated if malicious
+
+89
+00:08:46,000 --> 00:08:47,000
+code or data was.
+
+90
+00:08:48,000 --> 00:08:50,000
+We use it as a serialized data.
+
+91
+00:08:51,000 --> 00:08:56,000
+It was later executed during the disorganization with the rights of the application.
+
+92
+00:08:56,000 --> 00:09:04,000
+This can happen if the integrity check for this data and objects is not harder against attacks.
+
+93
+00:09:05,000 --> 00:09:13,000
+Software and data integrity failures related to code and infrastructure doesn't protect against integrity
+
+94
+00:09:13,000 --> 00:09:14,000
+violations.
+
+95
+00:09:14,000 --> 00:09:22,000
+An example of this is that an application relies upon plugins, libraries or modules from untrusted
+
+96
+00:09:22,000 --> 00:09:26,000
+sources, repositories and quantum networks.
+
+97
+00:09:26,000 --> 00:09:36,000
+CDs and insecure ICG pipelines can introduce a potential for unauthorized access, malicious code or
+
+98
+00:09:36,000 --> 00:09:38,000
+system compromise.
+
+99
+00:09:39,000 --> 00:09:47,000
+Nowadays, many applications include automatic functionality that updates are downloaded without sufficient
+
+100
+00:09:47,000 --> 00:09:52,000
+integrity, verification and applied across a trusted application.
+
+101
+00:09:52,000 --> 00:09:59,000
+Attackers potentially uploads these to be distributed and run on all installations.
+
+102
+00:10:00,000 --> 00:10:04,000
+Let's review one of the most popular examples from real life.
+
+103
+00:10:05,000 --> 00:10:10,000
+It is always better to use experience of others rather than past.
+
+104
+00:10:10,000 --> 00:10:12,000
+Was a painful experience by yourself.
+
+105
+00:10:13,000 --> 00:10:20,000
+The most famous example of a failure in software and data integrity checks is the SolarWinds Aurion
+
+106
+00:10:20,000 --> 00:10:29,000
+attack, with the now infamous attack centring around compromised update mechanisms after hacking into
+
+107
+00:10:29,000 --> 00:10:35,000
+the SolarWinds backend passwords frame or some other form of brute force attack.
+
+108
+00:10:36,000 --> 00:10:43,000
+The suspected nation state attackers said that the malicious code is the SolarWinds SII pipeline.
+
+109
+00:10:44,000 --> 00:10:51,000
+Some of the components were introduced into the SolarWinds update pipeline and signed off as a service
+
+110
+00:10:51,000 --> 00:10:56,000
+approved software update with legitimate digital signatures.
+
+111
+00:10:56,000 --> 00:11:04,000
+This compromise, the software supply chain, meant that the update was legitimate as far as SolarWinds
+
+112
+00:11:05,000 --> 00:11:07,000
+customers were concerned.
+
+113
+00:11:08,000 --> 00:11:15,000
+Of course, this is only one example of monitoring failures that have left the system compromised and
+
+114
+00:11:15,000 --> 00:11:18,000
+critical data being exposed to it internet.
+
+115
+00:11:18,000 --> 00:11:23,000
+But so we have better processes for monitoring its own updates.
+
+116
+00:11:24,000 --> 00:11:26,000
+This would not have happened.
+
+117
+00:11:27,000 --> 00:11:34,000
+The SolarWinds or an attack in which highly targeted, malicious updates were distributed to more than
+
+118
+00:11:34,000 --> 00:11:40,000
+80,000 organizations is one of the most significant breaches of this nature.
+
+119
+00:11:41,000 --> 00:11:45,000
+Now let's review all the potential attacks and errors.
+
+120
+00:11:46,000 --> 00:11:56,000
+Scenario number one, we'll talk today about potential impact made by all of the adverse highlights
+
+121
+00:11:56,000 --> 00:12:05,000
+potential visited by update without signing many home routers, set top boxes, device firmware and
+
+122
+00:12:05,000 --> 00:12:07,000
+orders do not verify updates.
+
+123
+00:12:07,000 --> 00:12:09,000
+We are signed firmware.
+
+124
+00:12:10,000 --> 00:12:16,000
+Unassigned firmware is a growing target for attackers and is expected to only get worse.
+
+125
+00:12:17,000 --> 00:12:18,000
+This is a major concern.
+
+126
+00:12:18,000 --> 00:12:26,000
+As many times there is no mechanism to remedy other than to fix in the future version and wait for previous
+
+127
+00:12:26,000 --> 00:12:27,000
+versions to age out.
+
+128
+00:12:28,000 --> 00:12:30,000
+Samarra number two.
+
+129
+00:12:31,000 --> 00:12:37,000
+We also talked about insecurity zation one of the reviewed common vehicles enumerations.
+
+130
+00:12:38,000 --> 00:12:43,000
+Let me share with you one more example related to insecure dissociation.
+
+131
+00:12:44,000 --> 00:12:51,000
+Iraq application cause a set of microservices being functional programmers.
+
+132
+00:12:51,000 --> 00:12:55,000
+Developers strive to ensure that their code is immutable.
+
+133
+00:12:56,000 --> 00:13:03,000
+The solution they came up with is to license a user state and the person that back and forth with each
+
+134
+00:13:03,000 --> 00:13:04,000
+request.
+
+135
+00:13:04,000 --> 00:13:07,000
+An attacker notices a Java object signature.
+
+136
+00:13:08,000 --> 00:13:16,000
+They understood that serialization is used and the content used is a jealous zero killer tool to gain
+
+137
+00:13:16,000 --> 00:13:19,000
+remote code execution on the application server.
+
+138
+00:13:20,000 --> 00:13:28,000
+Scenario number three is a full blown Samarra, an attack that exploits an insecure CIC pipeline and
+
+139
+00:13:28,000 --> 00:13:34,000
+installs malicious code to be distributed through the view and deployed process.
+
+140
+00:13:34,000 --> 00:13:42,000
+The attacker identifies an organization's insecure CIC pipeline and installs malicious code that is
+
+141
+00:13:42,000 --> 00:13:44,000
+pushed into production.
+
+142
+00:13:45,000 --> 00:13:51,000
+Customers unknowingly download the malicious quotes from the organization's update servers.
+
+143
+00:13:51,000 --> 00:13:55,000
+The malicious update is installed easy customers environment.
+
+144
+00:13:56,000 --> 00:14:01,000
+The attacker uses the malicious code to gain access to the customer's network.
+
+145
+00:14:02,000 --> 00:14:09,000
+That's now come to conclusion and understand how we can prevent software and data integrity failures.
+
+146
+00:14:09,000 --> 00:14:13,000
+The number of things that we can do to prevent abilities.
+
+147
+00:14:14,000 --> 00:14:22,000
+Use digital signatures or similar mechanisms to verify the software or data is from a suspected source
+
+148
+00:14:22,000 --> 00:14:24,000
+and has not been altered.
+
+149
+00:14:24,000 --> 00:14:27,000
+A digital signature is an electronics.
+
+150
+00:14:28,000 --> 00:14:28,000
+It is.
+
+151
+00:14:28,000 --> 00:14:37,000
+The event defines a region of the digital message or file z signatures from use public key infrastructure
+
+152
+00:14:37,000 --> 00:14:43,000
+partners to ensure data exchanged between parties stays private.
+
+153
+00:14:44,000 --> 00:14:53,000
+All teams should adopt digital signage solutions that automate the code signing encryption and authentication
+
+154
+00:14:53,000 --> 00:14:55,000
+across ICD pipelines.
+
+155
+00:14:56,000 --> 00:15:01,000
+Ensure libraries and dependencies such as NPM or maven.
+
+156
+00:15:01,000 --> 00:15:03,000
+Consume trusted repositories.
+
+157
+00:15:04,000 --> 00:15:09,000
+Verify that components do not contain known vulnerabilities.
+
+158
+00:15:09,000 --> 00:15:15,000
+Use such things as a trusted dependency check like we reviewed in our previous last.
+
+159
+00:15:16,000 --> 00:15:24,000
+Ensure that Zoey's interview crosses protocols and configuration changes to minimize the chance of malicious
+
+160
+00:15:24,000 --> 00:15:29,000
+code or configuration could be introduced into your software pipeline.
+
+161
+00:15:30,000 --> 00:15:33,000
+Ensures its UCI city pipeline.
+
+162
+00:15:33,000 --> 00:15:41,000
+This proper segregation configuration and access control in choosing legacy Xcode loans to build and
+
+163
+00:15:41,000 --> 00:15:42,000
+deploy processes.
+
+164
+00:15:43,000 --> 00:15:52,000
+Ensure that unsigned or unencrypted serialized data is not sent to untrusted clients without some form
+
+165
+00:15:52,000 --> 00:15:53,000
+of integrity.
+
+166
+00:15:53,000 --> 00:15:57,000
+Check for digital signature to detect tampering.
+
+167
+00:15:57,000 --> 00:15:59,000
+Autoplay of the Serialized Data.
+
+168
+00:16:00,000 --> 00:16:08,000
+Even though this ability is capable of causing damage beyond once imagination, measures like continual
+
+169
+00:16:08,000 --> 00:16:15,000
+one time adoption of authentication verification practices can bring great relief.
+
+170
+00:16:16,000 --> 00:16:23,000
+In the event an application server then loads the source code and executes without validating the zip
+
+171
+00:16:23,000 --> 00:16:25,000
+code for its integrity and the region.
+
+172
+00:16:26,000 --> 00:16:32,000
+Caucus can receives the application to download the malicious code from untrusted sites.
+
+173
+00:16:32,000 --> 00:16:40,000
+Such attacks can also the execution of malicious commands, resulting in steal and sensitive information
+
+174
+00:16:41,000 --> 00:16:43,000
+or compromising backend servers.
+
+175
+00:16:44,000 --> 00:16:47,000
+That's all what I wanted to cover with you in this lesson.
+
+176
+00:16:48,000 --> 00:16:51,000
+Let's recap what we learned today.
+
+177
+00:16:51,000 --> 00:16:55,000
+Then we learned what software and integrity failures are.
+
+178
+00:16:56,000 --> 00:17:03,000
+We learned potential impact that may be caused by vulnerabilities associated with this risk category.
+
+179
+00:17:03,000 --> 00:17:06,000
+Also, we have common weakness enumerations.
+
+180
+00:17:07,000 --> 00:17:12,000
+As always, we compared avast the top ten, 2017 and 2021.
+
+181
+00:17:13,000 --> 00:17:18,000
+We discussed different examples of attacks and examples in AC.
+
+182
+00:17:18,000 --> 00:17:23,000
+We talked about how to prevent vulnerabilities from this category.
+
+183
+00:17:24,000 --> 00:17:25,000
+That's it.
+
+184
+00:17:25,000 --> 00:17:27,000
+Thank you for your attention.
+
+185
+00:17:27,000 --> 00:17:30,000
+Have a great day and see in the next lesson.
+

73 - OWASP Top 10 2021/016 Computer-Security-Incident-Handling-Guide.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf

73 - OWASP Top 10 2021/016 Security Logging & Monitoring Failures_en.srt

@@ -0,0 +1,1016 @@
+1
+00:00:06,000 --> 00:00:06,000
+Hello, tim.
+
+2
+00:00:06,000 --> 00:00:13,000
+In this video we're going to run security volume and monitoring failures from avast that we're going
+
+3
+00:00:13,000 --> 00:00:17,000
+to study nicely from understanding what logging and logs are.
+
+4
+00:00:18,000 --> 00:00:24,000
+After that, I'm going to explain what security, logging and monitoring failures risk category is about.
+
+5
+00:00:25,000 --> 00:00:31,000
+Will understand the potential impacts that can be caused by vulnerabilities that are associated with
+
+6
+00:00:31,000 --> 00:00:33,000
+this risk category.
+
+7
+00:00:33,000 --> 00:00:40,000
+I will review with the risk factors that should be eliminated, and we'll review the key challenges
+
+8
+00:00:40,000 --> 00:00:42,000
+that you can face with on practice.
+
+9
+00:00:43,000 --> 00:00:49,000
+Also in this lesson, I'm going to hold an overview of wealth management tools and libraries for logging
+
+10
+00:00:49,000 --> 00:00:50,000
+in Java.
+
+11
+00:00:50,000 --> 00:00:57,000
+As always, we'll talk about the most notable common weakness and limitations from this risk category
+
+12
+00:00:57,000 --> 00:01:03,000
+will compare of up top ten 2017 versus last time.
+
+13
+00:01:03,000 --> 00:01:09,000
+2021 also will review attack examples and designs of the last.
+
+14
+00:01:09,000 --> 00:01:16,000
+And we're going to know how to prevent negative consequences that may be caused by security, logging
+
+15
+00:01:16,000 --> 00:01:17,000
+and monitoring failures.
+
+16
+00:01:18,000 --> 00:01:20,000
+Let's start our lesson.
+
+17
+00:01:21,000 --> 00:01:26,000
+The first questions that we have to address is the definition of log in and logs.
+
+18
+00:01:27,000 --> 00:01:27,000
+In computing.
+
+19
+00:01:27,000 --> 00:01:35,000
+A log file is a file that records user events to any operating system or application.
+
+20
+00:01:36,000 --> 00:01:40,000
+Log in is an act of keeping the law in the simplest case.
+
+21
+00:01:41,000 --> 00:01:50,000
+Messages Reason for a single file a log in the computing context is it automatically produced and timestamp
+
+22
+00:01:50,000 --> 00:01:56,000
+documentation of events relevant to a particular system or application.
+
+23
+00:01:57,000 --> 00:02:01,000
+Most of software applications and systems produce log files.
+
+24
+00:02:02,000 --> 00:02:10,000
+These are also separate libraries for logging and applications that helps to gather, analyze and navigate
+
+25
+00:02:10,000 --> 00:02:10,000
+the logs.
+
+26
+00:02:11,000 --> 00:02:15,000
+They're called log management applications.
+
+27
+00:02:15,000 --> 00:02:18,000
+There are really a lot of them for different languages.
+
+28
+00:02:19,000 --> 00:02:25,000
+In this lesson we're going to review library some tools that are most popular while working with Java
+
+29
+00:02:25,000 --> 00:02:26,000
+applications.
+
+30
+00:02:27,000 --> 00:02:34,000
+Now when we have learned what logs are, let's proceed with a high level overview of this risk category.
+
+31
+00:02:35,000 --> 00:02:39,000
+To help you understand what this category is about, let me ask you a question.
+
+32
+00:02:40,000 --> 00:02:47,000
+Have you ever had a case when your app was not as expected or you have to investigate some incidents
+
+33
+00:02:47,000 --> 00:02:56,000
+that happened and you can track since because of missing logs, logging and monitoring go hand in hand.
+
+34
+00:02:57,000 --> 00:03:03,000
+There is little point in having adequate logs, is there not adequate monitoring?
+
+35
+00:03:03,000 --> 00:03:12,000
+It is a problem of insufficient logging and monitoring covers type of structure and not just anything
+
+36
+00:03:12,000 --> 00:03:14,000
+that's facing that application.
+
+37
+00:03:15,000 --> 00:03:23,000
+Failure to sufficiently a law monitor or report security events such as logging items makes suspicious
+
+38
+00:03:23,000 --> 00:03:30,000
+behavior difficult to detect and significantly raises the likelihood that an attacker can successfully
+
+39
+00:03:30,000 --> 00:03:32,000
+exploit your application.
+
+40
+00:03:33,000 --> 00:03:40,000
+For example, an attacker may probe your application or software components following the abilities
+
+41
+00:03:40,000 --> 00:03:44,000
+of a permit, allowing such probes to continue.
+
+42
+00:03:44,000 --> 00:03:51,000
+And the tactic increases the likelihood that that target ultimately finds it will be with you and successfully
+
+43
+00:03:51,000 --> 00:03:59,000
+exploits a flaw in sufficient logging, monitoring or reporting makes your application susceptible to
+
+44
+00:03:59,000 --> 00:04:04,000
+attacks that target any part of the application stack.
+
+45
+00:04:04,000 --> 00:04:10,000
+Probably you can be wondering what impact can be caused by absent logging.
+
+46
+00:04:11,000 --> 00:04:18,000
+And this is a great question because it is hard to understand how absence of logging may impact security
+
+47
+00:04:18,000 --> 00:04:26,000
+of our application, while insufficient logging and monitoring is to observe to be a direct attack vector,
+
+48
+00:04:26,000 --> 00:04:31,000
+it affects the detection and response to every single breach.
+
+49
+00:04:32,000 --> 00:04:40,000
+If web application and server incidents are improperly monitored, suspicious activity can easily be
+
+50
+00:04:40,000 --> 00:04:40,000
+missed.
+
+51
+00:04:41,000 --> 00:04:49,000
+If security risks are not correct, the law or the logs are badly stored or hard to access, then these
+
+52
+00:04:49,000 --> 00:04:57,000
+flaws will go unaddressed as a result of direct vulnerabilities that can arise due to these issues.
+
+53
+00:04:57,000 --> 00:05:05,000
+But in general, logging and monitoring are quite critical and the absence of failures in directly impact
+
+54
+00:05:05,000 --> 00:05:09,000
+the visibility, incident, technology and forensics.
+
+55
+00:05:10,000 --> 00:05:17,000
+Thus, it's quite important to have a functioning logging and monitoring system to collect logs and
+
+56
+00:05:17,000 --> 00:05:21,000
+also give alerts if any malfunctions or errors happen.
+
+57
+00:05:22,000 --> 00:05:28,000
+Else use can go unnoticed for a long time and cause a lot more damage.
+
+58
+00:05:29,000 --> 00:05:33,000
+Let's review some risk factors that can lead us to negative consequences.
+
+59
+00:05:34,000 --> 00:05:40,000
+The elimination of this risk factors is it that listed on the slide will help us to decrease risks of
+
+60
+00:05:40,000 --> 00:05:49,000
+vulnerability to significantly log in and failed attempts not being locked locks on this cert locally
+
+61
+00:05:49,000 --> 00:05:50,000
+and not back.
+
+62
+00:05:50,000 --> 00:05:57,000
+Top warnings and errors are generated with an adequate or unpeel log messages.
+
+63
+00:05:58,000 --> 00:06:00,000
+It is not enough just to log an event.
+
+64
+00:06:00,000 --> 00:06:05,000
+It is also important to be able to understand it later.
+
+65
+00:06:06,000 --> 00:06:12,000
+Logs of applications and apps are not monitored for suspicious activity.
+
+66
+00:06:12,000 --> 00:06:21,000
+Penetration testing and scans by dynamic application security testing tools such as the do not trigger
+
+67
+00:06:21,000 --> 00:06:30,000
+alerts monitoring systems not able to detect suspicious activity or not able to raise alerts in real
+
+68
+00:06:30,000 --> 00:06:31,000
+time.
+
+69
+00:06:32,000 --> 00:06:38,000
+Missing monitoring and alert systems locks not protected for integrity.
+
+70
+00:06:39,000 --> 00:06:41,000
+This will allow log forgery.
+
+71
+00:06:42,000 --> 00:06:49,000
+Let's understand now the challenges that you may face weeks after implementing logging and eliminating
+
+72
+00:06:49,000 --> 00:06:51,000
+all the risk factors.
+
+73
+00:06:52,000 --> 00:06:56,000
+Very often there is a challenge that there are really a lot of loss.
+
+74
+00:06:57,000 --> 00:07:00,000
+You have multiple services then distributed.
+
+75
+00:07:00,000 --> 00:07:03,000
+Each service logs its own messages.
+
+76
+00:07:04,000 --> 00:07:06,000
+Log management can become a problem.
+
+77
+00:07:07,000 --> 00:07:13,000
+Moreover, if you are talking about monitoring, it is close to impossible to monitor such amount of
+
+78
+00:07:13,000 --> 00:07:14,000
+logs manually.
+
+79
+00:07:15,000 --> 00:07:17,000
+What would be a solution to this challenge?
+
+80
+00:07:18,000 --> 00:07:20,000
+There are some points to consider.
+
+81
+00:07:21,000 --> 00:07:25,000
+Never forget to set the proper log level for each log message.
+
+82
+00:07:25,000 --> 00:07:31,000
+We're going to have a separate lesson about logging in Java, but in case you are already familiar with
+
+83
+00:07:31,000 --> 00:07:39,000
+some logging in the programming languages, you'll know that each log message is logged on different
+
+84
+00:07:39,000 --> 00:07:47,000
+levels and it is important to agree on the criteria of each log level and set proper level to each log
+
+85
+00:07:47,000 --> 00:07:48,000
+message.
+
+86
+00:07:48,000 --> 00:07:49,000
+Why?
+
+87
+00:07:49,000 --> 00:07:51,000
+Because it is a future one.
+
+88
+00:07:51,000 --> 00:07:53,000
+We are glad to work with these logs.
+
+89
+00:07:53,000 --> 00:07:57,000
+We can apply the rules for different log levels.
+
+90
+00:07:57,000 --> 00:08:03,000
+We can filter logs on different levels and the work was logs in a more efficient way.
+
+91
+00:08:04,000 --> 00:08:11,000
+Introduce Automation, NZ lock management process, implement monitoring roles across the system.
+
+92
+00:08:11,000 --> 00:08:14,000
+For example, limit the number of sales.
+
+93
+00:08:14,000 --> 00:08:16,000
+Log in items.
+
+94
+00:08:16,000 --> 00:08:19,000
+Increase delay between failed walk ins.
+
+95
+00:08:20,000 --> 00:08:27,000
+Create IP Blacklist block IP addresses that sense suspiciously huge amounts of requests.
+
+96
+00:08:28,000 --> 00:08:31,000
+Automate alerting on some critical events.
+
+97
+00:08:31,000 --> 00:08:32,000
+Let's see.
+
+98
+00:08:32,000 --> 00:08:39,000
+In this case, security team used to monitor alarms manually and having all necessary logs.
+
+99
+00:08:39,000 --> 00:08:42,000
+Security can track down what actually happened.
+
+100
+00:08:43,000 --> 00:08:45,000
+React and allow alerts.
+
+101
+00:08:45,000 --> 00:08:52,000
+Already makes life easier rather than monitoring all possible logs in the system manually.
+
+102
+00:08:53,000 --> 00:08:54,000
+Introduce logging tools.
+
+103
+00:08:55,000 --> 00:08:57,000
+We're going to use some of them in a few seconds.
+
+104
+00:08:58,000 --> 00:09:06,000
+Let's review log management applications, the most popular ones that can help to make your life easier.
+
+105
+00:09:07,000 --> 00:09:13,000
+I want to highlight significantly more tools that I will give you on this slide.
+
+106
+00:09:13,000 --> 00:09:20,000
+So in case you are looking for something really specific, give it a try to review all of the solutions.
+
+107
+00:09:21,000 --> 00:09:24,000
+There are six those I'd like to discuss.
+
+108
+00:09:25,000 --> 00:09:27,000
+Zia Splunk.
+
+109
+00:09:27,000 --> 00:09:31,000
+Splunk is the biggest tool in the log management space.
+
+110
+00:09:31,000 --> 00:09:36,000
+It's well-established, full featured and enterprise class.
+
+111
+00:09:37,000 --> 00:09:41,000
+It's unique in this space as an on premises tool.
+
+112
+00:09:41,000 --> 00:09:45,000
+Also, they have come out with a cloud version as well.
+
+113
+00:09:45,000 --> 00:09:56,000
+And lastly, formerly known as our OC Elasticsearch Slash Kanban, it is an open source project made
+
+114
+00:09:56,000 --> 00:09:59,000
+up of many different tools for application.
+
+115
+00:09:59,000 --> 00:10:07,000
+Data analysis and visualization looks specifically was made for the collection and management of log
+
+116
+00:10:07,000 --> 00:10:10,000
+files beyond the Law congregation.
+
+117
+00:10:10,000 --> 00:10:18,000
+It includes Elasticsearch for indexing and searches for data and Cabana for charting and visualizing
+
+118
+00:10:18,000 --> 00:10:20,000
+data to gather.
+
+119
+00:10:20,000 --> 00:10:23,000
+They form a powerful log management solution.
+
+120
+00:10:23,000 --> 00:10:25,000
+Similar logic.
+
+121
+00:10:25,000 --> 00:10:33,000
+Similar logic was founded as a software, as a service version of Splunk, going so far as to imitate
+
+122
+00:10:33,000 --> 00:10:36,000
+some logs, features and visual story.
+
+123
+00:10:36,000 --> 00:10:45,000
+All since then, some logic has developed into full fledged enterprise class management solution in
+
+124
+00:10:45,000 --> 00:10:46,000
+its own right.
+
+125
+00:10:47,000 --> 00:10:52,000
+Some of the logic is a lost enterprise focus of the cloud native analyzers.
+
+126
+00:10:54,000 --> 00:10:54,000
+Love.
+
+127
+00:10:54,000 --> 00:10:55,000
+We love.
+
+128
+00:10:55,000 --> 00:11:04,000
+We used a robust analyzer focusing on simplicity and ease of use is targeted for developers and DevOps,
+
+129
+00:11:05,000 --> 00:11:07,000
+making it less enterprise focused.
+
+130
+00:11:08,000 --> 00:11:09,000
+Paper Trail.
+
+131
+00:11:10,000 --> 00:11:18,000
+Paper trail is a simple way to loop and search through logs from multiple machines in one consolidated
+
+132
+00:11:18,000 --> 00:11:19,000
+easy to use interface.
+
+133
+00:11:20,000 --> 00:11:27,000
+It is software as a service too designed to enhance the logs you already collect or generate.
+
+134
+00:11:28,000 --> 00:11:28,000
+Gridlock.
+
+135
+00:11:29,000 --> 00:11:37,000
+Gridlock is an open source look and noise are backed by MongoDB as well as Elasticsearch, similar to
+
+136
+00:11:37,000 --> 00:11:41,000
+Lock Stash for storing and searching for errors.
+
+137
+00:11:42,000 --> 00:11:50,000
+It's mainly focused on helping developers detect and fix errors in their apps, but they have also released
+
+138
+00:11:50,000 --> 00:11:53,000
+an official enterprise ready platform.
+
+139
+00:11:54,000 --> 00:11:56,000
+Let's sum it up and make conclusions.
+
+140
+00:11:57,000 --> 00:12:04,000
+Splunk is the best out of the box tool for enterprise companies, where money is less of a concern.
+
+141
+00:12:05,000 --> 00:12:12,000
+Elastic is a strongest open source project with complex set top and maintenance vs downside.
+
+142
+00:12:13,000 --> 00:12:21,000
+Similar logic is basically the software as a service version of Splunk, but is less expensive and has
+
+143
+00:12:21,000 --> 00:12:23,000
+less extensive features at least.
+
+144
+00:12:24,000 --> 00:12:32,000
+Locally is a solid solution for smaller that and above Steve's focusing on monitoring and troubleshooting.
+
+145
+00:12:33,000 --> 00:12:39,000
+Paper Trail is a simple and affordable tool for viewing log files from multiple machines.
+
+146
+00:12:39,000 --> 00:12:41,000
+In a single view is a cloud.
+
+147
+00:12:42,000 --> 00:12:48,000
+Grain law is a solid alternative to logs stash within the elastic stack framework.
+
+148
+00:12:48,000 --> 00:12:51,000
+Let's continue as a set.
+
+149
+00:12:51,000 --> 00:12:54,000
+We're going to have a separate lesson about log in.
+
+150
+00:12:54,000 --> 00:13:02,000
+In Java, we're going to have this class in scope of my course Java from zero to first job and details
+
+151
+00:13:02,000 --> 00:13:06,000
+of using log libraries also lies beyond this class.
+
+152
+00:13:07,000 --> 00:13:15,000
+But still, just for your awareness, I'd like to list here log in libraries you can use while working
+
+153
+00:13:15,000 --> 00:13:19,000
+this Java applications general log in framework.
+
+154
+00:13:19,000 --> 00:13:27,000
+Java has its own log in framework that is built in and does adjudicate honestly the Java Logan framework
+
+155
+00:13:27,000 --> 00:13:29,000
+not very popular nowadays.
+
+156
+00:13:30,000 --> 00:13:35,000
+Unfortunately, that didn't include logging in its original release.
+
+157
+00:13:36,000 --> 00:13:44,000
+So by the time the Java logging API was added, several other Logan's frameworks had become widely used.
+
+158
+00:13:45,000 --> 00:13:54,000
+Look, 4G VoLTE 4G is a general organ framework that supports the log in to files, output streams and
+
+159
+00:13:54,000 --> 00:13:58,000
+other targets and allows the configuration via config files.
+
+160
+00:13:59,000 --> 00:14:00,000
+Log back.
+
+161
+00:14:00,000 --> 00:14:05,000
+Log back is intended to be the successor of Log for G.
+
+162
+00:14:05,000 --> 00:14:11,000
+It was developed with the original log for G developer and features a lightweight architecture.
+
+163
+00:14:13,000 --> 00:14:21,000
+So for G itself, four G is a framework that acts as a simple interface for various other logging libraries,
+
+164
+00:14:21,000 --> 00:14:27,000
+allowing developers to log in the desired implementation and deployment time.
+
+165
+00:14:28,000 --> 00:14:37,000
+So basically rides it could rely on the interface provided by so for G and then decide which log you
+
+166
+00:14:37,000 --> 00:14:45,000
+want to use because A so for G supports really a lot of different factors, including connectors for
+
+167
+00:14:45,000 --> 00:14:46,000
+4G.
+
+168
+00:14:46,000 --> 00:14:54,000
+And log back, let's review multiple common considerations that are associated with this risk category.
+
+169
+00:14:55,000 --> 00:15:02,000
+There isn't much common vulnerability on the exposures data for this category, but the tactic in responding
+
+170
+00:15:02,000 --> 00:15:04,000
+to breaches is critical.
+
+171
+00:15:04,000 --> 00:15:13,000
+Still, it can be very impactful for comfortability, visibility, incident, alerting and forensics.
+
+172
+00:15:13,000 --> 00:15:24,000
+Among the most notable common victims memory that is worth the mention of the fallen S.W.A.T. 778 insufficient
+
+173
+00:15:24,000 --> 00:15:31,000
+log in when security critical events are not logged properly, such as failed log in item.
+
+174
+00:15:31,000 --> 00:15:39,000
+This can make malicious behavior more difficult to detect and may complicate analysis after an attack
+
+175
+00:15:39,000 --> 00:15:40,000
+succeeds.
+
+176
+00:15:40,000 --> 00:15:47,000
+CW E 117 Improper output neutralization for locks.
+
+177
+00:15:47,000 --> 00:15:54,000
+This can allow an attacker to forge entries or inject malicious calls into the logs.
+
+178
+00:15:54,000 --> 00:15:56,000
+Lock Forging Vulnerabilities.
+
+179
+00:15:56,000 --> 00:16:05,000
+Akua When data enters an application from an and trusted source, the data is written to an application
+
+180
+00:16:05,000 --> 00:16:06,000
+or system log file.
+
+181
+00:16:07,000 --> 00:16:13,000
+CW 223 Completion of security relevant information.
+
+182
+00:16:14,000 --> 00:16:21,000
+In this case, the application doesn't record or display information that would be important for identifying
+
+183
+00:16:21,000 --> 00:16:27,000
+the source or nature of an attack for determining if an action is safe.
+
+184
+00:16:28,000 --> 00:16:34,000
+cwe5 hundred 32 insertion of sensitive information in the log file.
+
+185
+00:16:36,000 --> 00:16:36,000
+While log in.
+
+186
+00:16:36,000 --> 00:16:39,000
+All information may be helpful.
+
+187
+00:16:39,000 --> 00:16:46,000
+Under development stages, it is important that Logan levels be set appropriately before a product ships
+
+188
+00:16:46,000 --> 00:16:54,000
+so that sensitive user data and system information are not accidentally exposed to potential attackers.
+
+189
+00:16:55,000 --> 00:17:00,000
+Let's compare WASP Top ten 2017 versus US Top ten 2021.
+
+190
+00:17:01,000 --> 00:17:03,000
+Previously we had categories.
+
+191
+00:17:03,000 --> 00:17:11,000
+It was called patient log and monitoring, and the WASP space is a 2021.
+
+192
+00:17:11,000 --> 00:17:14,000
+It was promoted to the position number nine.
+
+193
+00:17:14,000 --> 00:17:18,000
+The scope of this category has been revised.
+
+194
+00:17:18,000 --> 00:17:24,000
+TSA's name also was changed to security of volume and monitoring failures.
+
+195
+00:17:25,000 --> 00:17:29,000
+And now it is time to review examples of attacks.
+
+196
+00:17:30,000 --> 00:17:32,000
+Let's review two scenarios.
+
+197
+00:17:32,000 --> 00:17:41,000
+Scenario number one A Children's Health Plan Providers website operator who then detected breach due
+
+198
+00:17:41,000 --> 00:17:43,000
+to a lack of monitoring and log?
+
+199
+00:17:44,000 --> 00:17:54,000
+An external party informed is a health plan provider that had access and modified thousands of sensitive
+
+200
+00:17:54,000 --> 00:18:00,000
+health records of more than 3.5 million children at cost incidents.
+
+201
+00:18:00,000 --> 00:18:08,000
+Review found that the website developers had not addressed significant vulnerabilities as there was
+
+202
+00:18:08,000 --> 00:18:10,000
+no log or monitoring system.
+
+203
+00:18:11,000 --> 00:18:18,000
+The data breach could have been in progress since 2017 at periods of more than seven years.
+
+204
+00:18:19,000 --> 00:18:24,000
+An attacker gained access to an organisation's internal network.
+
+205
+00:18:25,000 --> 00:18:32,000
+The attack in Iran is coming to locate internal systems with no vulnerabilities and obtains sensitive
+
+206
+00:18:32,000 --> 00:18:39,000
+data since the organization doesn't follow adequate log and monitoring practices.
+
+207
+00:18:39,000 --> 00:18:47,000
+They are unable to attack active attacks as a data breach continuous undetected for a long period of
+
+208
+00:18:47,000 --> 00:18:48,000
+time.
+
+209
+00:18:50,000 --> 00:18:57,000
+A major Indian airline had a data breach involving more than ten years worth of personal data of millions
+
+210
+00:18:57,000 --> 00:19:02,000
+of passengers, including passport and credit card data.
+
+211
+00:19:03,000 --> 00:19:11,000
+The data breach accuracy at a search party cloud hosting provider who notified the airline of the breach
+
+212
+00:19:11,000 --> 00:19:12,000
+after some time.
+
+213
+00:19:13,000 --> 00:19:18,000
+Because of insufficient logging, not on time monitoring and alerting.
+
+214
+00:19:18,000 --> 00:19:24,000
+It was almost impossible to prevent data breaches simply once it was discovered.
+
+215
+00:19:24,000 --> 00:19:26,000
+And analyses that use that.
+
+216
+00:19:28,000 --> 00:19:33,000
+And major European airlines suffered reportable breach.
+
+217
+00:19:33,000 --> 00:19:42,000
+The breach was reportedly caused by a payment application security vulnerabilities exploited by attackers
+
+218
+00:19:42,000 --> 00:19:47,000
+who gather with more than 400,000 customer payments records.
+
+219
+00:19:48,000 --> 00:19:54,000
+The airline was fined £20 million as a result by the privacy regulator.
+
+220
+00:19:55,000 --> 00:20:01,000
+And finally, let's talk about how to prevent vulnerabilities related to security.
+
+221
+00:20:01,000 --> 00:20:03,000
+Log in and monitoring servers.
+
+222
+00:20:03,000 --> 00:20:10,000
+It is recommended that developers implement some or all of the following controls, depending on the
+
+223
+00:20:10,000 --> 00:20:12,000
+risk of the application.
+
+224
+00:20:13,000 --> 00:20:20,000
+Ensure all login access control and server side input validation failures can do logged with sufficient
+
+225
+00:20:20,000 --> 00:20:30,000
+user context to identify suspicious or malicious accounts and have enough time to allow delayed forensic
+
+226
+00:20:30,000 --> 00:20:30,000
+analysis.
+
+227
+00:20:31,000 --> 00:20:39,000
+Ensure log data is encoded correctly to prevent injections or attacks on the logging or monitoring systems.
+
+228
+00:20:40,000 --> 00:20:43,000
+This should help avoid forgery.
+
+229
+00:20:44,000 --> 00:20:51,000
+Devsecops teams should establish effective monitoring and alerting, such as a suspicious activities
+
+230
+00:20:51,000 --> 00:20:54,000
+are detected and responded to quickly.
+
+231
+00:20:55,000 --> 00:21:02,000
+Establish or adopt an incident response and recovery plan, such as National Institute of Standards
+
+232
+00:21:02,000 --> 00:21:12,000
+and Technology 861 revision to oh eight that I'm going to leave a reference to this document attachments
+
+233
+00:21:12,000 --> 00:21:12,000
+to the last.
+
+234
+00:21:14,000 --> 00:21:22,000
+Ensure that logs contain all the relevant data and are well formatted to be consumed by other tools.
+
+235
+00:21:22,000 --> 00:21:24,000
+Lock Management Solutions.
+
+236
+00:21:25,000 --> 00:21:33,000
+Test If your monitoring systems can identify suspicious activity and ensure that dirty is done in near
+
+237
+00:21:34,000 --> 00:21:34,000
+real time.
+
+238
+00:21:35,000 --> 00:21:43,000
+Introduce some log management to at least one of those that we have discussed in this lesson or similar
+
+239
+00:21:43,000 --> 00:21:43,000
+one.
+
+240
+00:21:44,000 --> 00:21:47,000
+That's all what I wanted to discuss with you today.
+
+241
+00:21:48,000 --> 00:21:51,000
+Let's recap what we have learned in this lesson.
+
+242
+00:21:52,000 --> 00:21:58,000
+We learned what logging and logs are well on security, logging and monitoring.
+
+243
+00:21:58,000 --> 00:21:59,000
+Taylor Swift Category.
+
+244
+00:22:00,000 --> 00:22:07,000
+I explains potential impact, which may be caused by vulnerabilities associated with this risk category.
+
+245
+00:22:08,000 --> 00:22:12,000
+What discussed risk factors that should be eliminated?
+
+246
+00:22:13,000 --> 00:22:18,000
+I hold an overview of management tools and libraries for logging in Java.
+
+247
+00:22:19,000 --> 00:22:22,000
+We reviewed multiple common weaknesses enumerations.
+
+248
+00:22:23,000 --> 00:22:30,000
+Also, we did a comparison of of us top ten 2017 versus avast top ten 2021.
+
+249
+00:22:31,000 --> 00:22:39,000
+We reviewed different examples of attacks and examples of the lessons we learned how to prevent negative
+
+250
+00:22:39,000 --> 00:22:43,000
+consequences caused by security, volume and monitoring failures.
+
+251
+00:22:44,000 --> 00:22:46,000
+That's it for this lesson.
+
+252
+00:22:46,000 --> 00:22:48,000
+Thank you all for your attention.
+
+253
+00:22:48,000 --> 00:22:50,000
+Have a great day and see you.
+
+254
+00:22:50,000 --> 00:22:51,000
+Next lesson.
+

73 - OWASP Top 10 2021/017 Server-Side Request Forgery (SSRF)_en.srt

@@ -0,0 +1,1036 @@
+1
+00:00:06,000 --> 00:00:06,000
+Hello Tim.
+
+2
+00:00:06,000 --> 00:00:12,000
+Today we are going to learn server side request forgery risk category from Avast Top ten.
+
+3
+00:00:12,000 --> 00:00:17,000
+We are going to start the lesson from the general overview of the risk category.
+
+4
+00:00:17,000 --> 00:00:22,000
+I will tell you what is called trust relationships in the web applications.
+
+5
+00:00:22,000 --> 00:00:25,000
+We are going to review different risk factors.
+
+6
+00:00:25,000 --> 00:00:28,000
+This is recommended to eliminate.
+
+7
+00:00:28,000 --> 00:00:35,000
+I will explain why server side regrets forgery is dangerous and what potential impacts are.
+
+8
+00:00:35,000 --> 00:00:40,000
+We are going to review different types of server side request forgery.
+
+9
+00:00:41,000 --> 00:00:49,000
+As always, we are going to compare Avast Top ten 2017 versus Avast Top ten 2021.
+
+10
+00:00:49,000 --> 00:00:56,000
+During the lesson we are going to review different attack examples, including Capital One incident,
+
+11
+00:00:56,000 --> 00:01:01,000
+some basic Java example and other examples of attacks.
+
+12
+00:01:01,000 --> 00:01:07,000
+And at the end of the lesson, we are going to make a summary of what we have to do in order to prevent
+
+13
+00:01:07,000 --> 00:01:10,000
+server side request forgery.
+
+14
+00:01:10,000 --> 00:01:12,000
+Let's start our lesson.
+
+15
+00:01:12,000 --> 00:01:16,000
+Let's start from the high level overview of this risk category.
+
+16
+00:01:16,000 --> 00:01:19,000
+Let's understand what it is.
+
+17
+00:01:19,000 --> 00:01:28,000
+If an attacker can make this server sends a request, usually we mean HTTP requests on its behalf.
+
+18
+00:01:28,000 --> 00:01:31,000
+Then that is server side request forgery.
+
+19
+00:01:32,000 --> 00:01:40,000
+That means that attacker get access to the internal services located on the server and can send data
+
+20
+00:01:40,000 --> 00:01:42,000
+from that server.
+
+21
+00:01:42,000 --> 00:01:47,000
+It is dangerous because in case requests are sent from the server.
+
+22
+00:01:47,000 --> 00:01:55,000
+Attackers can get access to the information on the server that is secure to be accessed outside of the
+
+23
+00:01:55,000 --> 00:01:56,000
+server.
+
+24
+00:01:56,000 --> 00:02:04,000
+For example, attackers can send information about internal resources, perform port scanning on the
+
+25
+00:02:04,000 --> 00:02:10,000
+internal network, send confidential information like credentials, etc..
+
+26
+00:02:10,000 --> 00:02:18,000
+Server side request forgery allows an attacker to force the server side application into making arbitrary
+
+27
+00:02:18,000 --> 00:02:22,000
+web requests to an unintended domain.
+
+28
+00:02:23,000 --> 00:02:31,000
+This can result in the server making connections to internal only services or arbitrary external systems.
+
+29
+00:02:32,000 --> 00:02:40,000
+A successful server side request forgery attack can result in unauthorized actions or access to data
+
+30
+00:02:40,000 --> 00:02:48,000
+within the organization, either in the vulnerable application itself or on other backend systems that
+
+31
+00:02:48,000 --> 00:02:51,000
+the application can communicate with.
+
+32
+00:02:51,000 --> 00:02:59,000
+This vulnerability usually occurs in applications that take your rails from the user and then make a
+
+33
+00:02:59,000 --> 00:03:09,000
+HTTP request to the supplied URL without proper euro validation, excluding internal IPS, for instance.
+
+34
+00:03:09,000 --> 00:03:17,000
+As modern web applications provide end users with convenient features, fetching a URL becomes a common
+
+35
+00:03:17,000 --> 00:03:18,000
+scenario.
+
+36
+00:03:19,000 --> 00:03:25,000
+As a result, the incidence of server side request forgery is increasing.
+
+37
+00:03:25,000 --> 00:03:32,000
+Also, the severity of server side request forgery is becoming high due to the cloud services and the
+
+38
+00:03:32,000 --> 00:03:35,000
+complexity of architectures.
+
+39
+00:03:36,000 --> 00:03:45,000
+Why service such request forgery is also dangerous is because trust relationships of the application
+
+40
+00:03:45,000 --> 00:03:46,000
+is under attack.
+
+41
+00:03:46,000 --> 00:03:48,000
+Now what are trust?
+
+42
+00:03:48,000 --> 00:03:57,000
+Relationships of application is the trust relationship occurs when an application server interacts with
+
+43
+00:03:57,000 --> 00:04:02,000
+private banking systems not intended for access by users.
+
+44
+00:04:03,000 --> 00:04:12,000
+Is accessible systems most likely use non-removable private IP addresses or are restricted to specific
+
+45
+00:04:12,000 --> 00:04:18,000
+costs, which assumes that the network topology protects them.
+
+46
+00:04:18,000 --> 00:04:25,000
+Lack of internal security controls opens the application to in server sites.
+
+47
+00:04:25,000 --> 00:04:26,000
+Request forgery.
+
+48
+00:04:26,000 --> 00:04:31,000
+Vulnerability is the main things that we all have to remember.
+
+49
+00:04:31,000 --> 00:04:34,000
+Never assume anything when it comes to code.
+
+50
+00:04:34,000 --> 00:04:44,000
+Security trust relationships exist because an engineer doesn't implement proper security controls because
+
+51
+00:04:44,000 --> 00:04:50,000
+they incorrectly assume attackers can attack from an already trusted location.
+
+52
+00:04:51,000 --> 00:04:56,000
+Let's review environment that can increase the risk of service sites.
+
+53
+00:04:56,000 --> 00:04:58,000
+Request Forgery Attack.
+
+54
+00:04:58,000 --> 00:05:01,000
+Let's talk about risk factors now.
+
+55
+00:05:01,000 --> 00:05:09,000
+The vulnerable application will often have functionality for publishing, reading or in-person data
+
+56
+00:05:09,000 --> 00:05:12,000
+using a URL that a user can modify.
+
+57
+00:05:13,000 --> 00:05:21,000
+The attacker takes advantage of this functionality by manipulating the euro or providing an entirely
+
+58
+00:05:21,000 --> 00:05:22,000
+new euro.
+
+59
+00:05:23,000 --> 00:05:30,000
+The court on the server will then read or submit the euro, allowing the attacker to read server data,
+
+60
+00:05:30,000 --> 00:05:37,000
+connect in internal services, or send post requests to private internal services.
+
+61
+00:05:37,000 --> 00:05:39,000
+In general server side requests.
+
+62
+00:05:39,000 --> 00:05:46,000
+Forgery attacks are made possible by a lack of user input validation in the web application.
+
+63
+00:05:47,000 --> 00:05:54,000
+Without strict validation, the attacker can alter parameters that control what gets executed.
+
+64
+00:05:54,000 --> 00:06:02,000
+Server side for example, potentially malicious commands or establish an HTTP connections to arbitrary
+
+65
+00:06:02,000 --> 00:06:03,000
+systems.
+
+66
+00:06:04,000 --> 00:06:11,000
+Vulnerabilities will arise when the web application is unable to identify and validate requests from
+
+67
+00:06:11,000 --> 00:06:21,000
+trusted applications, or when the web application can send requests to any external IP address or domain.
+
+68
+00:06:21,000 --> 00:06:29,000
+Let's review now potential impact that may be caused by server sites, request forgery and believes
+
+69
+00:06:29,000 --> 00:06:36,000
+that you ready made gas potential impact that may be caused by this vulnerability but lets some attack
+
+70
+00:06:37,000 --> 00:06:45,000
+server sites request forgery attacks present a range of risks from potentially stealing sensitive information
+
+71
+00:06:45,000 --> 00:06:50,000
+from the application to bring an entire web application down.
+
+72
+00:06:51,000 --> 00:06:59,000
+These attacks target systems that are located behind firewalls and restrict access from non trusted
+
+73
+00:06:59,000 --> 00:07:00,000
+networks.
+
+74
+00:07:01,000 --> 00:07:06,000
+Protecting your application from such attacks is vitally important.
+
+75
+00:07:07,000 --> 00:07:15,000
+The damage extent is hard to predict as outcomes depend on the system configuration, API security practices
+
+76
+00:07:15,000 --> 00:07:19,000
+adopted and the severity of the attack.
+
+77
+00:07:19,000 --> 00:07:27,000
+In some situations, the server side requests for vulnerability may even allow an attacker to perform
+
+78
+00:07:27,000 --> 00:07:29,000
+arbitrary command execution.
+
+79
+00:07:30,000 --> 00:07:39,000
+This can result in exposure and theft of data that may include sensitive, personal or corporate information.
+
+80
+00:07:39,000 --> 00:07:47,000
+If successful server side requests, forgery, vulnerability grants, hackers admin access to the data
+
+81
+00:07:47,000 --> 00:07:50,000
+stored on the server and its backend system.
+
+82
+00:07:51,000 --> 00:08:00,000
+That negative consequences can be one of the following denial of service attack, remote code execution,
+
+83
+00:08:01,000 --> 00:08:09,000
+hijack of a vulnerable system to use its trust relationship with other systems to launch further attacks
+
+84
+00:08:10,000 --> 00:08:13,000
+or cause or cross-site port attack.
+
+85
+00:08:14,000 --> 00:08:23,000
+It is not necessary that any service request for a related attack will have to bring the response data
+
+86
+00:08:23,000 --> 00:08:27,000
+to the heart to avoid missing any response.
+
+87
+00:08:27,000 --> 00:08:33,000
+An attack that can take the help of an open port using an open port.
+
+88
+00:08:33,000 --> 00:08:39,000
+It is easy to carry out a quick network scan of the application server.
+
+89
+00:08:39,000 --> 00:08:43,000
+This is known as cross-site port attack.
+
+90
+00:08:43,000 --> 00:08:50,000
+There are different types of service sites request forgery and to prevent them, we need to know these
+
+91
+00:08:50,000 --> 00:08:51,000
+types.
+
+92
+00:08:51,000 --> 00:08:56,000
+Let's learn them for any service site ecosystem.
+
+93
+00:08:56,000 --> 00:09:06,000
+There are two sites the server and its internal components, and this server was a backend system based
+
+94
+00:09:06,000 --> 00:09:09,000
+on the site impacted by this vulnerability.
+
+95
+00:09:09,000 --> 00:09:12,000
+It has two classifications.
+
+96
+00:09:12,000 --> 00:09:15,000
+Attacks against the server.
+
+97
+00:09:15,000 --> 00:09:24,000
+This is also known as basic server side request forgery and refers to the direct display of the outcome
+
+98
+00:09:24,000 --> 00:09:28,000
+of the attack to the hacker to make this happen.
+
+99
+00:09:28,000 --> 00:09:37,000
+The server accesses the attacker, fetched URL, gathers the information data response and shares it
+
+100
+00:09:37,000 --> 00:09:38,000
+with the hacker.
+
+101
+00:09:39,000 --> 00:09:49,000
+This tab describes a case when data from the malicious forced backhand request is reflected in the application
+
+102
+00:09:49,000 --> 00:09:49,000
+frontend.
+
+103
+00:09:50,000 --> 00:10:00,000
+Mostly the hacker swaps the actual URL with localhost or IP 120 7001.
+
+104
+00:10:01,000 --> 00:10:08,000
+Doing so will help the hardware to find out the path that will directly lead to crucial data.
+
+105
+00:10:09,000 --> 00:10:16,000
+This type of server side request forgery attack is common and can lead to heart.
+
+106
+00:10:16,000 --> 00:10:21,000
+Identification is the right kind of investigation is carried out.
+
+107
+00:10:21,000 --> 00:10:26,000
+And the second type attacks against banking systems.
+
+108
+00:10:27,000 --> 00:10:33,000
+Here, the threat actor doesn't directly reach the server or communicate with it.
+
+109
+00:10:33,000 --> 00:10:41,000
+It involves taking any server backend system under control and using it to access severe responses or
+
+110
+00:10:41,000 --> 00:10:42,000
+information.
+
+111
+00:10:43,000 --> 00:10:48,000
+So it is known as blind service site request forgery.
+
+112
+00:10:49,000 --> 00:10:57,000
+As the name describes with this type of server site request forgery attack, the application is forced
+
+113
+00:10:57,000 --> 00:11:02,000
+to make a back end HTTP request to a malicious domain.
+
+114
+00:11:03,000 --> 00:11:06,000
+In this type of server side request forgery.
+
+115
+00:11:06,000 --> 00:11:10,000
+The attacker doesn't get data back from the server directly.
+
+116
+00:11:11,000 --> 00:11:18,000
+The response from the backend request triggers an action on the target without getting reflected in
+
+117
+00:11:18,000 --> 00:11:19,000
+the application frontend.
+
+118
+00:11:20,000 --> 00:11:27,000
+Hacker sees this type of server side request forgery when they want to make some changes using the victim's
+
+119
+00:11:27,000 --> 00:11:28,000
+server.
+
+120
+00:11:29,000 --> 00:11:36,000
+Let's compare a WASP Top ten, 2017 versus a WASP Top ten 2021.
+
+121
+00:11:37,000 --> 00:11:39,000
+This is a new category.
+
+122
+00:11:39,000 --> 00:11:42,000
+It is added from the top ten community survey.
+
+123
+00:11:43,000 --> 00:11:51,000
+The data shows a relatively low incidence rate with above average testing coverage and above average
+
+124
+00:11:51,000 --> 00:11:54,000
+exploit and impact potential ratings.
+
+125
+00:11:55,000 --> 00:12:02,000
+From the very first list released to the newest one, service site request forgery has always been defined
+
+126
+00:12:02,000 --> 00:12:05,000
+as a potential security threat.
+
+127
+00:12:05,000 --> 00:12:10,000
+However, it got its separate category this time only.
+
+128
+00:12:11,000 --> 00:12:19,000
+Dependent upon the total common vulnerabilities and exposures reported server size request forgery secured
+
+129
+00:12:19,000 --> 00:12:22,000
+10th place in the avast least.
+
+130
+00:12:23,000 --> 00:12:25,000
+Let's start with giving examples.
+
+131
+00:12:26,000 --> 00:12:28,000
+Talking about server side requests forgery.
+
+132
+00:12:29,000 --> 00:12:33,000
+It is not possible to ignore a case that happened with Capital One.
+
+133
+00:12:34,000 --> 00:12:35,000
+What is it?
+
+134
+00:12:35,000 --> 00:12:43,000
+Capital One financial corporation is an American bank holding company specializing in credit cards,
+
+135
+00:12:43,000 --> 00:12:47,000
+auto loans, banking and savings accounts.
+
+136
+00:12:48,000 --> 00:12:58,000
+The most famous service request forgery attack happened in July of 2019 against Capital One server site
+
+137
+00:12:58,000 --> 00:13:01,000
+request forgery was used to retrieve a W.
+
+138
+00:13:01,000 --> 00:13:10,000
+S credentials that attackers used to steal over 100 million Capital One customer's personal information
+
+139
+00:13:11,000 --> 00:13:15,000
+hiding behind the VPN and Tor browser.
+
+140
+00:13:15,000 --> 00:13:23,000
+The attacker executed and server side request forgery query that the server relayed to the bank and
+
+141
+00:13:23,000 --> 00:13:28,000
+a w s server because of misconfigured web application firewall.
+
+142
+00:13:29,000 --> 00:13:38,000
+The attackers then retrieved a temporary credential from the ec2 metadata service and run the LRS Terminal
+
+143
+00:13:38,000 --> 00:13:42,000
+Command to retrieve the list of 8ws.
+
+144
+00:13:42,000 --> 00:13:46,000
+S three buckets of compromised Capital one accounts.
+
+145
+00:13:47,000 --> 00:13:48,000
+What was the result?
+
+146
+00:13:49,000 --> 00:13:57,000
+The malicious actors copied nearly 30 gigabytes of Capital One credit application data.
+
+147
+00:13:58,000 --> 00:14:01,000
+To help you understand this risk category better.
+
+148
+00:14:02,000 --> 00:14:05,000
+Let me show you one example with Java source code.
+
+149
+00:14:06,000 --> 00:14:11,000
+It is relatively simple, but it will help you to understand the challenge.
+
+150
+00:14:12,000 --> 00:14:19,000
+The code on this slide represents one of the possible masses to fetch remote resources from a Java web
+
+151
+00:14:19,000 --> 00:14:20,000
+application.
+
+152
+00:14:21,000 --> 00:14:22,000
+Zahra.
+
+153
+00:14:22,000 --> 00:14:24,000
+At least two issues with this code.
+
+154
+00:14:25,000 --> 00:14:34,000
+The first one, a java dot net euro object can represent many more schemes that just HTP.
+
+155
+00:14:34,000 --> 00:14:41,000
+For example, it can be used to fetch the local file by employing the file protocol.
+
+156
+00:14:42,000 --> 00:14:50,000
+And the second issue, no restriction whatsoever is enforced to include or exclude the means.
+
+157
+00:14:50,000 --> 00:14:59,000
+This could be exploited to fetch in general resources, for example, those that reside in local force
+
+158
+00:14:59,000 --> 00:15:01,000
+or in the internal network.
+
+159
+00:15:02,000 --> 00:15:07,000
+And we can see that there is no invalidation of location, massive parameter.
+
+160
+00:15:07,000 --> 00:15:17,000
+So technically speaking, any string can be passed to our message and resource will be read and returned
+
+161
+00:15:17,000 --> 00:15:19,000
+from the method as a string.
+
+162
+00:15:19,000 --> 00:15:22,000
+How to avoid potential liability.
+
+163
+00:15:22,000 --> 00:15:25,000
+Let me show it to you on another slide.
+
+164
+00:15:26,000 --> 00:15:31,000
+On this slide, we are going to release a solution to the challenge shown on the previous slide.
+
+165
+00:15:32,000 --> 00:15:40,000
+Fetching a user provided euro is quite a sensitive operation, especially if a user will be able to
+
+166
+00:15:40,000 --> 00:15:42,000
+read the response.
+
+167
+00:15:42,000 --> 00:15:47,000
+In such cases and allow least approach is advisable.
+
+168
+00:15:47,000 --> 00:15:55,000
+For example, on the certain protocols, the means, POS, etc. are allowed to be requested.
+
+169
+00:15:56,000 --> 00:15:59,000
+All other cases are to be rejected.
+
+170
+00:15:59,000 --> 00:16:08,000
+The court from the previous slide can be hardened by only allowing HTTP or https with sources coming
+
+171
+00:16:08,000 --> 00:16:10,000
+from specific subdomains.
+
+172
+00:16:11,000 --> 00:16:12,000
+Just look at this example.
+
+173
+00:16:13,000 --> 00:16:19,000
+You can see that they added if statement to verify location, massive parameter.
+
+174
+00:16:20,000 --> 00:16:24,000
+And as I already said, this is just an example.
+
+175
+00:16:24,000 --> 00:16:31,000
+In real life, you can come up with your own security requirements and create your custom condition
+
+176
+00:16:31,000 --> 00:16:36,000
+to validate the URL before sending request from the application.
+
+177
+00:16:36,000 --> 00:16:44,000
+I hope that with this example it is clear how server side request forgery can impact your application.
+
+178
+00:16:44,000 --> 00:16:51,000
+And we also reviewed one of the simplest workarounds how to avoid server side request forgery.
+
+179
+00:16:52,000 --> 00:16:55,000
+Let's review other examples of attack.
+
+180
+00:16:55,000 --> 00:16:59,000
+Scenario number one, ports come in channel service.
+
+181
+00:17:00,000 --> 00:17:08,000
+If the network architecture is segmented, attackers can map out internal networks and determine if
+
+182
+00:17:08,000 --> 00:17:14,000
+ports are open or closed on a channel service from connection results.
+
+183
+00:17:14,000 --> 00:17:19,000
+The defined ports can be used for further attacks.
+
+184
+00:17:20,000 --> 00:17:28,000
+Segment of network architecture is an opportunity for attackers as they can use them to figure out whether
+
+185
+00:17:28,000 --> 00:17:31,000
+or not the internal server ports are open.
+
+186
+00:17:31,000 --> 00:17:37,000
+If ports are open, they can easily carry and service sites request for connection.
+
+187
+00:17:38,000 --> 00:17:43,000
+Understand what a segmented network architecture is.
+
+188
+00:17:43,000 --> 00:17:46,000
+Let me explain what network segmentation is.
+
+189
+00:17:47,000 --> 00:17:56,000
+Network segmentation is an architectural approach that divides a network into multiple segments of subnets,
+
+190
+00:17:56,000 --> 00:17:59,000
+each acting as its own small network.
+
+191
+00:18:00,000 --> 00:18:08,000
+This allows network administrators to control the flow of traffic between subnets based on granular
+
+192
+00:18:08,000 --> 00:18:09,000
+policies.
+
+193
+00:18:09,000 --> 00:18:17,000
+Organizations use segmentation to improve monitoring, boost performance, localized technical issues,
+
+194
+00:18:17,000 --> 00:18:21,000
+and, most importantly, enhanced security.
+
+195
+00:18:22,000 --> 00:18:27,000
+Scenario number two, attacks against the local host.
+
+196
+00:18:28,000 --> 00:18:36,000
+If the local machine doesn't validate requests from the local host or execute them with elevated privilege,
+
+197
+00:18:36,000 --> 00:18:39,000
+the server becomes an attack target.
+
+198
+00:18:40,000 --> 00:18:49,000
+The TOCA convinces the application to make an HDP request back to the hosting server via its loopback
+
+199
+00:18:49,000 --> 00:18:50,000
+network interface.
+
+200
+00:18:51,000 --> 00:19:02,000
+Frequently, this involves the attacker supplying a euro with the host name like 120 7001 or just localhost.
+
+201
+00:19:03,000 --> 00:19:11,000
+And just like that, that takes advantage of the trust relationship the system has with its internal
+
+202
+00:19:11,000 --> 00:19:11,000
+requests.
+
+203
+00:19:12,000 --> 00:19:20,000
+Scenario number three, attacks against other banking systems similar to the attack against the server
+
+204
+00:19:20,000 --> 00:19:21,000
+itself.
+
+205
+00:19:21,000 --> 00:19:29,000
+When developers assume that network topologies protect an internal systems, we often see weak server
+
+206
+00:19:29,000 --> 00:19:34,000
+security controls configurations for interactions on the local network.
+
+207
+00:19:35,000 --> 00:19:43,000
+Attackers take advantage of backend systems that contain sensitive functionality and lock authentication
+
+208
+00:19:43,000 --> 00:19:48,000
+mechanisms for anyone accessing ZAP from the local network.
+
+209
+00:19:49,000 --> 00:19:56,000
+We already discussed today trustful relationships between BEC and service of the application itself.
+
+210
+00:19:56,000 --> 00:20:00,000
+It can be a risk factor for such kind of vulnerability.
+
+211
+00:20:01,000 --> 00:20:02,000
+Samarra.
+
+212
+00:20:02,000 --> 00:20:06,000
+Number four, attacks against third party systems.
+
+213
+00:20:07,000 --> 00:20:15,000
+When a company doesn't adequately protect its systems, an attacker can hijack them to launch attacks
+
+214
+00:20:15,000 --> 00:20:17,000
+against the third party.
+
+215
+00:20:17,000 --> 00:20:26,000
+This attack uses a trust relationship between the vulnerable company and the customer or vendor to access
+
+216
+00:20:26,000 --> 00:20:34,000
+private resources, and that can also launch attacks using the vulnerable server as a pivot point,
+
+217
+00:20:34,000 --> 00:20:39,000
+making the victim company appear to be the source of the attack.
+
+218
+00:20:39,000 --> 00:20:47,000
+Now I suggest to summarize all what we have learned and gather rules and guidelines to follow in order
+
+219
+00:20:47,000 --> 00:20:49,000
+to avoid server side requests.
+
+220
+00:20:49,000 --> 00:20:50,000
+Forgery.
+
+221
+00:20:50,000 --> 00:20:58,000
+It is recommended to implement security controls on different levels, namely on the network layer and
+
+222
+00:20:58,000 --> 00:21:00,000
+on the application layer.
+
+223
+00:21:01,000 --> 00:21:09,000
+On the network layer segment remote resource access functionality in separate networks to reduce the
+
+224
+00:21:09,000 --> 00:21:12,000
+impact of the server side request forgery.
+
+225
+00:21:13,000 --> 00:21:19,000
+We already talked today about network segmentation, so I will not stop on this.
+
+226
+00:21:20,000 --> 00:21:29,000
+Enforce denied by default firewall policies or network access control rules to block all but essential
+
+227
+00:21:29,000 --> 00:21:30,000
+internet traffic.
+
+228
+00:21:31,000 --> 00:21:38,000
+On the application layer, sanitise and validate all client supplied input data.
+
+229
+00:21:38,000 --> 00:21:46,000
+In some previous lessons, we already discussed correctness of using block list and allow list, maintain
+
+230
+00:21:46,000 --> 00:21:54,000
+and allow list or deny list of both of your rails that you would make or denies a request to respectively
+
+231
+00:21:55,000 --> 00:22:02,000
+develop a safe list of the allowed, the means, resources and protocols for fetching resources and
+
+232
+00:22:02,000 --> 00:22:04,000
+enforce its use.
+
+233
+00:22:04,000 --> 00:22:11,000
+Next perform safe list input validation on all inputs whenever possible.
+
+234
+00:22:11,000 --> 00:22:19,000
+Do not accept user input in functions that control where the web server can fetch resources if your
+
+235
+00:22:19,000 --> 00:22:24,000
+application must accept such user inputs validate.
+
+236
+00:22:25,000 --> 00:22:28,000
+Do not send raw responses to clients.
+
+237
+00:22:29,000 --> 00:22:36,000
+Removing trust relationships will reduce your potential server site request forgery attack surface use
+
+238
+00:22:36,000 --> 00:22:43,000
+parameterization properly and implement a zero trust architecture which requires the various parts of
+
+239
+00:22:43,000 --> 00:22:51,000
+the application environment to always revalidate one another in the previous lessons, namely when we
+
+240
+00:22:51,000 --> 00:22:57,000
+learn security misconfiguration we already talked about zero trust security model.
+
+241
+00:22:58,000 --> 00:23:02,000
+Please refer to the lesson if you want to refresh your knowledge.
+
+242
+00:23:03,000 --> 00:23:12,000
+20/21 is a service site request for its first year on the WASP lease, and security professionals should
+
+243
+00:23:12,000 --> 00:23:17,000
+expect to encounter this read more and more in the coming years.
+
+244
+00:23:17,000 --> 00:23:24,000
+But if you are effectively testing your applications and remediating issues quickly and correctly,
+
+245
+00:23:24,000 --> 00:23:32,000
+you'll be prepared to support and resolve server side requests, forgery vulnerabilities before an attacker
+
+246
+00:23:32,000 --> 00:23:33,000
+exploits them.
+
+247
+00:23:34,000 --> 00:23:37,000
+That's all what I wanted to share with you today.
+
+248
+00:23:37,000 --> 00:23:40,000
+Let's recap what we have learned.
+
+249
+00:23:40,000 --> 00:23:44,000
+We learned today what seven sites request forgery is.
+
+250
+00:23:45,000 --> 00:23:47,000
+We learned risk factors.
+
+251
+00:23:47,000 --> 00:23:50,000
+I explained potential impacts.
+
+252
+00:23:50,000 --> 00:23:55,000
+We discussed different types of server side request forgery.
+
+253
+00:23:55,000 --> 00:24:04,000
+As usual, we compared Avast Top ten 2017 versus Avast Top ten 2021.
+
+254
+00:24:04,000 --> 00:24:13,000
+And we reviewed a lot of different examples of attacks, including Capital One incident, Java example
+
+255
+00:24:13,000 --> 00:24:15,000
+and other attack examples.
+
+256
+00:24:16,000 --> 00:24:21,000
+And at the end of the lesson, we discussed how to prevent server side request forgery.
+
+257
+00:24:22,000 --> 00:24:24,000
+That's all for today.
+
+258
+00:24:24,000 --> 00:24:26,000
+Thank you for your attention.
+
+259
+00:24:26,000 --> 00:24:29,000
+Have a great day and see you in the next lesson.
+

73 - OWASP Top 10 2021/external-links.txt

@@ -0,0 +1,42 @@
+
+001 Common-Weakness-Enumeration-CWE-official-website
+https://cwe.mitre.org/index.html
+
+002 Source-code-examples-from-the-lesson
+https://github.com/AndriiPiatakha/java-learnit-web-online-store/tree/master/online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/bac
+
+004 Source-code-examples-from-the-lesson
+https://github.com/AndriiPiatakha/java-learnit-web-online-store/tree/master/online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/cf
+
+005 Source-code-examples-from-the-lesson
+https://github.com/AndriiPiatakha/java-learnit-web-online-store/tree/master/online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/cf
+
+006 Source-code-examples-from-the-lesson
+https://github.com/AndriiPiatakha/java-learnit-web-online-store/tree/master/online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/i/problem
+
+007 Source-code-examples-from-the-lesson
+https://github.com/AndriiPiatakha/java-learnit-web-online-store/tree/master/online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/i/problem
+
+008 Source-code-examples-from-the-lesson
+https://github.com/AndriiPiatakha/java-learnit-web-online-store/tree/master/online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/i/problem
+
+011 NIST-800-123-Guide-to-General-Server-Security
+https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-123.pdf
+
+011 NIST-800-207-Zero-Trust-Architecture
+https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
+
+012 NIST-800-123-Guide-to-General-Server-Security
+https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-123.pdf
+
+012 NIST-800-207-Zero-Trust-Architecture
+https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
+
+013 pom.xml-from-the-lesson-with-OWASP-plugin
+https://github.com/AndriiPiatakha/java-learnit-web-online-store/blob/master/pom.xml
+
+013 Dependency-check-plugin
+https://mvnrepository.com/artifact/org.owasp/dependency-check-maven/7.1.0
+
+016 Computer-Security-Incident-Handling-Guide
+https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf

74 - OWASP API Security Top 10 2023/001 OWASP API Security Project & OWASP API Security Top 10 2023.html

@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>OWASP API Security Project & OWASP API Security Top 10 2023</title>
+
+        <style>
+            * {
+                box-sizing: border-box;
+                margin: 0;
+                padding: 0;
+            }
+            body {
+                font-family: var(--font-stack-text);
+                font-weight: 400;
+                line-height: 1.4;
+                font-size: 1.6rem;
+                color: #2d2f31;
+            }
+            .container {
+                position: relative;
+                height: 100%;
+                overflow-y: auto;
+            }
+            .content {
+                padding: 3.2rem 4.8rem;
+                word-break: break-word;
+                max-width: 69.6rem;
+                margin: 0 auto;
+            }
+            .heading {
+                margin-bottom: 24px;
+                font-family: -apple-system, BlinkMacSystemFont, Roboto, "Segoe UI", Helvetica, Arial, sans-serif,
+                    "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";
+                font-weight: 700;
+                line-height: 1.2;
+                letter-spacing: 0;
+                font-size: 32px;
+                max-width: 36em;
+            }
+            .article-asset-container {
+                padding: 2.4rem;
+            }
+            .article-asset-container p {
+                font-size: 19px;
+            }
+            code {
+                background-color: #fff;
+                border: 1px solid #d1d7dc;
+                color: #b4690e;
+                font-size: 80%;
+                padding: 0.2rem 0.4rem;
+                font-family: sfmono-regular, Consolas, liberation mono, Menlo, Courier, monospace;
+            }
+            p {
+                font-weight: 400;
+            }
+        </style>
+    </head>
+    <body>
+        <div class="container">
+            <div class="content">
+                <div class="heading">OWASP API Security Project & OWASP API Security Top 10 2023</div>
+                <div class="article-asset-container"><h4>Introduction to OWASP API Security Top 10 2023</h4><p><br></p><h4>Why Learn the OWASP API Security Top 10 2023?</h4><p>In today's digital landscape, APIs (Application Programming Interfaces) are integral to the functionality and interconnectivity of web applications, mobile applications, and IoT devices. They allow different systems to communicate and share data seamlessly. However, with this increased reliance on APIs comes an elevated risk of security vulnerabilities. Learning the OWASP API Security Top 10 2023 is crucial because:</p><ol><li><p><strong>API Proliferation</strong>: APIs are becoming more prevalent, making them attractive targets for attackers.</p></li><li><p><strong>Unique Vulnerabilities</strong>: APIs have unique security challenges that differ from traditional web applications, requiring specialized knowledge to mitigate.</p></li><li><p><strong>Data Sensitivity</strong>: APIs often handle sensitive data, and breaches can lead to severe data leaks and privacy violations.</p></li><li><p><strong>Business Impact</strong>: Security flaws in APIs can lead to significant business disruptions, financial loss, and damage to reputation.</p></li></ol><p><br></p><p><br></p><h4>Introduction to API Security - Importance of API Security in Today's Digital Landscape</h4><p>APIs (Application Programming Interfaces) have become integral to modern software applications, facilitating seamless communication and interaction between different systems and services. However, the increased reliance on APIs also exposes organizations to new security risks. Ensuring API security is crucial because:</p><ul><li><p><strong>Data Exposure:</strong> APIs often handle sensitive data such as user information, financial records, and business transactions. Insecure APIs can lead to data breaches, compromising confidentiality and privacy.</p></li><li><p><strong>Business Continuity:</strong> API disruptions or compromises can disrupt operations, leading to financial losses and reputational damage.</p></li><li><p><strong>Regulatory Compliance:</strong> Many industries are subject to strict regulations (e.g., GDPR, HIPAA) that mandate the protection of user data. Non-compliance can result in significant penalties.</p></li></ul><p><br></p><p><br></p><h4>Key Differences Between OWASP&nbsp;Top 10 2021 and OWASP&nbsp;API&nbsp;Security Top 10 2023</h4><p>OWASP API Security Project: focuses on strategies and solutions to understand and mitigate the unique vulnerabilities and security risks of Application Programming Interfaces (APIs). Includes the most recent list API Security Top 10 2023.</p><p>The OWASP API Security Top 10 focuses specifically on the unique vulnerabilities and security risks associated with Application Programming Interfaces (APIs), whereas the OWASP Top 10 2021 addresses the most critical web application security risks in general.</p><h4>Key Differences</h4><ol><li><p><strong>Scope</strong>:</p><ul><li><p><strong>OWASP API Security Top 10</strong>: Focuses solely on API-specific security risks.</p></li><li><p><strong>OWASP Top 10</strong>: Covers a broader range of web application security risks.</p></li></ul></li><li><p><strong>Focus on Implementation Details</strong>:</p><ul><li><p>The API Security list often dives deeper into issues that are particularly relevant to the nature of API implementations, such as asset management, rate limiting, and object/function level authorization.</p></li></ul></li><li><p><strong>New Additions in General List</strong>:</p><ul><li><p>The general list introduces newer categories like SSRF, insecure design, and software/data integrity failures, which are not specifically addressed in the API list.</p></li></ul></li></ol><p><br></p><p><br></p><p><br></p><h4>What is in Common between OWASP&nbsp;API&nbsp;Security Top 10 2023 and the OWASP Top 10 2021?</h4><p><br></p><figure><img src="https://img-c.udemycdn.com/redactor/raw/article_lecture/2024-07-10_21-44-56-ebbd8c2cb5bccb3dbf58786847a233e4.jpg"></figure><p>The OWASP API Security Top 10 2023 shares several commonalities with the OWASP Top 10 2021, reflecting enduring security challenges that affect both APIs and web applications. Here's a closer look at the similarities:</p><ol><li><p><strong>Security Misconfiguration</strong>: This risk remains a critical concern in both lists. Security misconfigurations occur when security settings are not defined, implemented, or maintained correctly, leading to vulnerabilities. Both APIs and web applications suffer from this issue due to complex configurations and the potential for human error.</p></li><li><p><strong>Server-Side Request Forgery (SSRF)</strong>: This risk appears in both lists, highlighting the importance of protecting servers from unauthorized internal requests that can lead to data leaks or manipulation.</p><p><br></p></li></ol><h4>Renamed and Reframed Categories</h4><p>Some risks have been renamed or reframed in the API Security list to better reflect their specific context within APIs:</p><ul><li><p><strong>Broken Access Control</strong> in the 2021 list is now split into <strong>Broken Object Level Authorization</strong> and <strong>Broken Function Level Authorization</strong> in the API list, emphasizing different aspects of access control failures. Both lists address issues related to access control. In the API Security list, this is split into Broken Object Level Authorization and Broken Function Level Authorization, focusing on the granularity of access controls at the object and function levels, respectively. In the OWASP Top 10 2021, Broken Access Control covers a broader range of access control failures.</p></li><li><p><strong>Identification and Authentication Failures</strong> from the 2021 list is now <strong>Broken Authentication</strong> in the API list, focusing on the critical aspects of user authentication.</p></li><li><p><strong>Vulnerable and Outdated Components</strong> has been reframed as <strong>Improper Inventory Management</strong> in the API list, reflecting the importance of managing API components and dependencies properly.</p></li></ul><h4>Removed and New Additions</h4><p>The OWASP Top 10 2021 includes categories that are not explicitly listed in the API Security Top 10 2023, such as:</p><ul><li><p><strong>Cryptographic Failures</strong></p></li><li><p><strong>Injection</strong></p></li><li><p><strong>Insecure Design</strong></p></li><li><p><strong>Software and Data Integrity Failures</strong></p></li><li><p><strong>Security Logging and Monitoring Failures</strong></p></li></ul><p>Conversely, the API Security Top 10 introduces categories specifically relevant to APIs, such as:</p><ul><li><p><strong>Broken Object Property Level Authorization</strong></p></li><li><p><strong>Unrestricted Resource Consumption</strong></p></li><li><p><strong>Broken Function Level Authorization</strong></p></li><li><p><strong>Unrestricted Access to Sensitive Business Flows</strong></p></li><li><p><strong>Unsage Consumption of APIs</strong></p></li></ul><p>And we are going to learn all the details in the course.</p><p><br></p><p><br></p><p><br></p><h4>Do We Need to Learn the OWASP Top 10 2021 First?</h4><p>Understanding the OWASP Top 10 2021 provides a solid foundation for web application security. This knowledge is beneficial when transitioning to the more specialized OWASP API Security Top 10 2023. The commonalities and renamed categories underscore the evolving nature of security threats while maintaining a focus on core security principles. By mastering both lists, you can better protect both general web applications and the APIs that power modern digital ecosystems.</p><p>While it's not strictly necessary to learn the OWASP Top 10 2021 before delving into the OWASP API Security Top 10 2023, it is highly beneficial. Understanding the broader context of web application security will provide a strong foundation and enhance your comprehension of API-specific vulnerabilities. The OWASP Top 10 2021 covers fundamental security concepts that are also relevant to APIs, such as access control, injection flaws, and security misconfigurations.</p><p><br></p><p><br></p><h4>Additional Information</h4><ul><li><p><strong>Evolving Threat Landscape</strong>: As the threat landscape evolves, staying updated with the latest security practices and vulnerabilities is essential. The OWASP API Security Top 10 2023 reflects the latest insights and research in API security.</p></li><li><p><strong>Complementary Knowledge</strong>: Combining knowledge from both the OWASP Top 10 2021 and the OWASP API Security Top 10 2023 ensures a comprehensive understanding of web security, allowing you to safeguard both web applications and APIs effectively.</p></li><li><p><strong>Practical Applications</strong>: Learning these security principles is not just theoretical but highly practical. Implementing these best practices can prevent many common and potentially devastating security breaches.</p></li></ul><p>By understanding and applying the principles from both OWASP Top 10 lists, you can build more secure applications and contribute to a safer digital ecosystem.</p></div>
+            </div>
+        </div>
+    </body>
+</html>

74 - OWASP API Security Top 10 2023/002 API12023 Broken Object Level Authorization - Part 1_en.srt

@@ -0,0 +1,720 @@
+1
+00:00:05,000 --> 00:00:06,000
+Hello, Tim.
+
+2
+00:00:06,000 --> 00:00:13,000
+Today we start review of the first vulnerability from the OWASp API Security Top ten 2023 list.
+
+3
+00:00:13,000 --> 00:00:17,000
+In this lesson, we are going to learn broken object level authorization.
+
+4
+00:00:18,000 --> 00:00:20,000
+So here's what we'll be covering today.
+
+5
+00:00:20,000 --> 00:00:26,000
+First I will define object level authorization and explain its importance in modern applications.
+
+6
+00:00:27,000 --> 00:00:32,000
+Following that we'll delve into broken object level authorization vulnerabilities, discussing their
+
+7
+00:00:32,000 --> 00:00:40,000
+prevalence in APIs and how they relate to the OWASp top ten list, specifically under Broken Access
+
+8
+00:00:40,000 --> 00:00:41,000
+Control.
+
+9
+00:00:41,000 --> 00:00:48,000
+Next, we'll examine some real world examples of data breaches caused by broken object level authorization
+
+10
+00:00:48,000 --> 00:00:56,000
+and discuss the severe consequences these breaches have for both organisations, and users will then
+
+11
+00:00:56,000 --> 00:01:02,000
+explore insecure coding practices that lead to broken object level authorization vulnerabilities.
+
+12
+00:01:03,000 --> 00:01:08,000
+To make it practical, I will demonstrate with the code example from an online shop highlighting the
+
+13
+00:01:08,000 --> 00:01:11,000
+problem and providing a solution.
+
+14
+00:01:11,000 --> 00:01:18,000
+After this, we'll look into how to enforce robust authorization mechanisms and the importance of continuous
+
+15
+00:01:18,000 --> 00:01:21,000
+testing and validation of authorization logic.
+
+16
+00:01:21,000 --> 00:01:28,000
+We'll also cover the use of random, universally unique identifiers, discussing implementation considerations
+
+17
+00:01:28,000 --> 00:01:32,000
+when integrating Uuids into API ecosystems.
+
+18
+00:01:32,000 --> 00:01:38,000
+Additionally, we'll discuss securing the business logic layer to ensure comprehensive protection.
+
+19
+00:01:38,000 --> 00:01:44,000
+Finally, we'll explore the zero trust security model and how its principles can effectively mitigate
+
+20
+00:01:44,000 --> 00:01:47,000
+broken object level authorization vulnerabilities.
+
+21
+00:01:48,000 --> 00:01:50,000
+So let's start our lesson.
+
+22
+00:01:51,000 --> 00:01:53,000
+Let's start from understanding the general concept.
+
+23
+00:01:54,000 --> 00:01:59,000
+Let's define object level authorization and answer the question why it is important.
+
+24
+00:02:00,000 --> 00:02:05,000
+Object level authorization refers to the practice of controlling access to individual data.
+
+25
+00:02:05,000 --> 00:02:09,000
+objects based on the permissions granted to users or roles.
+
+26
+00:02:09,000 --> 00:02:18,000
+It ensures that users can only perform actions, for example, view, edit, delete on data objects
+
+27
+00:02:18,000 --> 00:02:20,000
+they are authorized to access.
+
+28
+00:02:20,000 --> 00:02:23,000
+The importance of object level authorization includes.
+
+29
+00:02:23,000 --> 00:02:31,000
+Granular control allows organizations to enforce fine grained access controls, limiting exposure and
+
+30
+00:02:31,000 --> 00:02:33,000
+reducing the impact of potential breaches.
+
+31
+00:02:34,000 --> 00:02:42,000
+Compliance helps organizations meet regulatory requirements by ensuring data access is restricted to
+
+32
+00:02:42,000 --> 00:02:43,000
+authorized personnel only.
+
+33
+00:02:44,000 --> 00:02:51,000
+Broken object level authorization vulnerabilities specifically relates to weaknesses in how APIs enforce
+
+34
+00:02:51,000 --> 00:02:55,000
+access controls at the level of individual data objects.
+
+35
+00:02:55,000 --> 00:02:59,000
+For example, records, files, resources.
+
+36
+00:02:59,000 --> 00:03:07,000
+These vulnerabilities arise when APIs fail to adequately verify whether a user has the necessary permissions
+
+37
+00:03:07,000 --> 00:03:10,000
+to access or manipulate specific data objects.
+
+38
+00:03:11,000 --> 00:03:17,000
+APIs may grant broader access rights than necessary, allowing users to perform actions they shouldn't
+
+39
+00:03:17,000 --> 00:03:18,000
+be authorized to do.
+
+40
+00:03:19,000 --> 00:03:27,000
+Broken object level authorization vulnerabilities occur due to flaws in how APIs implement object level
+
+41
+00:03:27,000 --> 00:03:28,000
+authorization.
+
+42
+00:03:28,000 --> 00:03:30,000
+Common scenarios include.
+
+43
+00:03:31,000 --> 00:03:33,000
+Direct object references.
+
+44
+00:03:33,000 --> 00:03:40,000
+APIs expose internal object references, for example, database IDs without proper validation, allowing
+
+45
+00:03:40,000 --> 00:03:44,000
+attackers to manipulate these references to access unauthorized data.
+
+46
+00:03:45,000 --> 00:03:53,000
+Predictable Object Identifiers APIs use predictable patterns or sequential identifiers for objects,
+
+47
+00:03:53,000 --> 00:04:00,000
+making it easier for attackers to guess or iterate through IDs to access unauthorized resources.
+
+48
+00:04:01,000 --> 00:04:08,000
+Inadequate scope validation APIs may lack checks to ensure that users are restricted to accessing only
+
+49
+00:04:08,000 --> 00:04:13,000
+their own data or data they are explicitly authorized to access.
+
+50
+00:04:14,000 --> 00:04:20,000
+Broken object level authorization vulnerabilities are prevalent in APIs across various industries and
+
+51
+00:04:20,000 --> 00:04:23,000
+have been exploited in high profile data breaches.
+
+52
+00:04:24,000 --> 00:04:30,000
+Understanding these vulnerabilities is crucial for implementing effective security measures and protecting
+
+53
+00:04:30,000 --> 00:04:33,000
+sensitive data within API ecosystems.
+
+54
+00:04:34,000 --> 00:04:40,000
+If you are a student of my OWASp top ten course, I believe you remember that I had a lesson with you
+
+55
+00:04:40,000 --> 00:04:43,000
+about such categories as broken Access Control.
+
+56
+00:04:43,000 --> 00:04:48,000
+By the way, I recommend to make sure you watch that lesson before you continue with this one.
+
+57
+00:04:49,000 --> 00:04:55,000
+Let's understand how broken access control is connected with broken object level authorization.
+
+58
+00:04:56,000 --> 00:05:04,000
+The OWASp top ten is a widely recognized list of the top ten most critical security risks to web applications.
+
+59
+00:05:05,000 --> 00:05:12,000
+Broken Access Control ranks prominently on this list due to its significant impact on data confidentiality,
+
+60
+00:05:12,000 --> 00:05:14,000
+integrity, and availability.
+
+61
+00:05:14,000 --> 00:05:20,000
+Key points from the OWASp top ten 2021 regarding Broken Access Control include.
+
+62
+00:05:21,000 --> 00:05:28,000
+Broken access control refers to vulnerabilities that occur when restrictions on what authenticated users
+
+63
+00:05:28,000 --> 00:05:31,000
+are allowed to do are not properly enforced.
+
+64
+00:05:32,000 --> 00:05:37,000
+This includes both vertical and horizontal access control issues.
+
+65
+00:05:38,000 --> 00:05:45,000
+Exploitation of broken access control can lead to unauthorized data access, modification or deletion,
+
+66
+00:05:45,000 --> 00:05:52,000
+allowing attackers to bypass authorization mechanisms and perform actions outside their intended scope.
+
+67
+00:05:53,000 --> 00:05:59,000
+Issues typically arise due to improper configuration, insufficient validation of user permissions,
+
+68
+00:05:59,000 --> 00:06:03,000
+or weaknesses in how access control rules are implemented and enforced.
+
+69
+00:06:04,000 --> 00:06:11,000
+Broken object level authorization is closely related to broken access control, and can be seen as a
+
+70
+00:06:11,000 --> 00:06:16,000
+specific instance or subset of this broader vulnerability category.
+
+71
+00:06:16,000 --> 00:06:24,000
+Here's how broken object level authorization relates to and overlaps with broken access control.
+
+72
+00:06:25,000 --> 00:06:32,000
+Broken access control includes a wide range of access control issues, including both overarching authorization
+
+73
+00:06:32,000 --> 00:06:36,000
+floors and more granular object level authorization.
+
+74
+00:06:36,000 --> 00:06:36,000
+Weaknesses.
+
+75
+00:06:37,000 --> 00:06:44,000
+Broken object level authorization specifically focuses on vulnerabilities where APIs fail to enforce
+
+76
+00:06:44,000 --> 00:06:50,000
+proper access controls at the level of individual data objects, for example records files.
+
+77
+00:06:50,000 --> 00:06:51,000
+Resource.
+
+78
+00:06:52,000 --> 00:06:58,000
+This often involves scenarios where direct object references or predictable identifiers are exposed
+
+79
+00:06:58,000 --> 00:07:02,000
+without adequate validation or authorization checks.
+
+80
+00:07:02,000 --> 00:07:10,000
+While broken access control addresses systemic access control failures across an application, broken
+
+81
+00:07:10,000 --> 00:07:17,000
+object level authorization vulnerabilities typically manifest in specific instances where object level
+
+82
+00:07:17,000 --> 00:07:19,000
+permissions are not correctly implemented.
+
+83
+00:07:20,000 --> 00:07:27,000
+These vulnerabilities can lead to unauthorized access to sensitive data objects, which is a critical
+
+84
+00:07:27,000 --> 00:07:29,000
+subset of the broader access control issues.
+
+85
+00:07:30,000 --> 00:07:38,000
+Broken access control and broken object level authorization both address critical aspects of application
+
+86
+00:07:38,000 --> 00:07:44,000
+security, but focus on different scopes and vulnerabilities within the application stack.
+
+87
+00:07:45,000 --> 00:07:51,000
+While broken access control tackles broader access control issues across various application interfaces,
+
+88
+00:07:52,000 --> 00:07:59,000
+broken object level authorization hones in on specific vulnerabilities within API endpoints where object
+
+89
+00:07:59,000 --> 00:08:04,000
+level permissions are manipulated or inadequately enforced.
+
+90
+00:08:04,000 --> 00:08:11,000
+Organizations must implement tailored security measures to mitigate both types of vulnerabilities effectively
+
+91
+00:08:11,000 --> 00:08:16,000
+and safeguard the applications against unauthorized access and data breaches.
+
+92
+00:08:17,000 --> 00:08:24,000
+Let's review some real world examples of data breaches due to broken object level authorization.
+
+93
+00:08:24,000 --> 00:08:29,000
+I believe these examples will motivate you to learn this lesson more thoroughly.
+
+94
+00:08:30,000 --> 00:08:31,000
+Broken object level.
+
+95
+00:08:31,000 --> 00:08:38,000
+authorization vulnerabilities have been implicated in several high profile data breaches, underscoring
+
+96
+00:08:38,000 --> 00:08:41,000
+their significance in compromising data security.
+
+97
+00:08:41,000 --> 00:08:43,000
+Here are some real world examples.
+
+98
+00:08:44,000 --> 00:08:46,000
+USPS data breach.
+
+99
+00:08:46,000 --> 00:08:53,000
+In 2014, the United States Postal Service suffered a significant data breach attributed to broken object
+
+100
+00:08:53,000 --> 00:08:56,000
+level authorization vulnerabilities.
+
+101
+00:08:56,000 --> 00:09:05,000
+Attackers exploited weaknesses in Usps's API endpoints, allowing them to manipulate object IDs to access
+
+102
+00:09:05,000 --> 00:09:08,000
+sensitive information belonging to millions of users.
+
+103
+00:09:09,000 --> 00:09:15,000
+The breach exposed personal data, including addresses, tracking information, and other confidential
+
+104
+00:09:15,000 --> 00:09:19,000
+details affecting a vast number of USPS customers.
+
+105
+00:09:20,000 --> 00:09:22,000
+Facebook data breach.
+
+106
+00:09:23,000 --> 00:09:29,000
+Facebook experienced a broken object level authorization related data breach in 2018.
+
+107
+00:09:29,000 --> 00:09:36,000
+Attackers exploited a flaw in Facebook's API that allowed them to access users private photos without
+
+108
+00:09:36,000 --> 00:09:38,000
+proper authorization.
+
+109
+00:09:39,000 --> 00:09:45,000
+Millions of users private photos were exposed, leading to privacy concerns and reputational damage
+
+110
+00:09:45,000 --> 00:09:46,000
+for Facebook.
+
+111
+00:09:47,000 --> 00:09:49,000
+Equifax data breach.
+
+112
+00:09:50,000 --> 00:09:57,000
+In 2017, Equifax, one of the largest credit reporting agencies in the US, suffered a massive data
+
+113
+00:09:57,000 --> 00:09:58,000
+breach.
+
+114
+00:09:58,000 --> 00:10:05,000
+The breach was due to a combination of factors, including broken object level authorization, vulnerabilities
+
+115
+00:10:05,000 --> 00:10:14,000
+in their web application, Personal and financial information of approximately 147 million consumers
+
+116
+00:10:14,000 --> 00:10:19,000
+was compromised, leading to widespread identity theft and financial fraud.
+
+117
+00:10:20,000 --> 00:10:26,000
+As you may already understand, violation of security rules and not following best practices that will
+
+118
+00:10:26,000 --> 00:10:32,000
+help to prevent broken object level authorization may cause different negative consequences.
+
+119
+00:10:33,000 --> 00:10:35,000
+Let's review some of them.
+
+120
+00:10:35,000 --> 00:10:37,000
+Financial losses.
+
+121
+00:10:37,000 --> 00:10:44,000
+Data breaches resulting from broken object level authorization vulnerabilities can lead to significant
+
+122
+00:10:44,000 --> 00:10:47,000
+financial consequences for organizations.
+
+123
+00:10:48,000 --> 00:10:56,000
+This includes costs associated with incident response, regulatory fines, for example, GDPR, CcpA,
+
+124
+00:10:56,000 --> 00:11:00,000
+and legal fees stemming from lawsuits filed by affected users.
+
+125
+00:11:01,000 --> 00:11:03,000
+Reputational damage.
+
+126
+00:11:03,000 --> 00:11:08,000
+Organizations may suffer long term damage to their reputation and trustworthiness.
+
+127
+00:11:09,000 --> 00:11:15,000
+Customers may lose confidence in the organization's ability to protect their data, leading to churn
+
+128
+00:11:15,000 --> 00:11:18,000
+and difficulty acquiring new customers.
+
+129
+00:11:19,000 --> 00:11:21,000
+Legal and regulatory consequences.
+
+130
+00:11:22,000 --> 00:11:28,000
+Organizations found negligent in protecting user data can face severe penalties under data protection
+
+131
+00:11:28,000 --> 00:11:29,000
+laws.
+
+132
+00:11:30,000 --> 00:11:36,000
+Compliance failures can result in fines, sanctions, and mandated corrective actions.
+
+133
+00:11:37,000 --> 00:11:39,000
+Impact on users.
+
+134
+00:11:39,000 --> 00:11:43,000
+For individuals, the consequences of data breaches can be profound.
+
+135
+00:11:44,000 --> 00:11:50,000
+They may experience identity theft, financial fraud, or personal embarrassment if sensitive information
+
+136
+00:11:50,000 --> 00:11:51,000
+is exposed.
+
+137
+00:11:52,000 --> 00:11:58,000
+Restoring one's identity and financial security can be a lengthy and stressful process.
+
+138
+00:11:59,000 --> 00:12:06,000
+Operational disruption remediation efforts following a data breach can disrupt normal business operations.
+
+139
+00:12:06,000 --> 00:12:13,000
+This includes dedicating resources to investigate the breach, implement security fixes, and communicate
+
+140
+00:12:13,000 --> 00:12:14,000
+with affected users.
+
+141
+00:12:15,000 --> 00:12:21,000
+Let's now review the most common insecure coding practices that leads to broken object level authorization.
+
+142
+00:12:21,000 --> 00:12:24,000
+You need to know them in order to avoid them.
+
+143
+00:12:25,000 --> 00:12:27,000
+Insufficient input validation.
+
+144
+00:12:27,000 --> 00:12:35,000
+Failure to properly validate and sanitize input parameters such as object IDs or parameters in API requests.
+
+145
+00:12:36,000 --> 00:12:42,000
+Attackers can manipulate these inputs to access unauthorized data objects or perform actions beyond
+
+146
+00:12:42,000 --> 00:12:44,000
+the authorized scope.
+
+147
+00:12:45,000 --> 00:12:47,000
+Predictable object identifiers.
+
+148
+00:12:47,000 --> 00:12:51,000
+Using predictable or sequential identifiers, for example.
+
+149
+00:12:51,000 --> 00:12:54,000
+Incremental IDs for data objects.
+
+150
+00:12:55,000 --> 00:13:02,000
+Attackers can guess or enumerate object IDs to access sensitive data or resources that should be restricted.
+
+151
+00:13:03,000 --> 00:13:05,000
+Lack of proper access controls.
+
+152
+00:13:06,000 --> 00:13:10,000
+Failure to implement and enforce adequate access controls at the object level.
+
+153
+00:13:11,000 --> 00:13:17,000
+Users may be able to perform operations on data objects they should not have access to, leading to
+
+154
+00:13:17,000 --> 00:13:20,000
+data breaches or unauthorized modifications.
+
+155
+00:13:21,000 --> 00:13:23,000
+Improper use of permissions and roles.
+
+156
+00:13:24,000 --> 00:13:29,000
+Incorrectly assigning or checking permissions and roles for accessing data objects.
+
+157
+00:13:29,000 --> 00:13:36,000
+Users may exploit these misconfigurations to escalate privileges or access data they are not authorised
+
+158
+00:13:36,000 --> 00:13:37,000
+to see or modify.
+
+159
+00:13:39,000 --> 00:13:45,000
+Let's also review common flaws in authorization controls that are often root causes of broken object
+
+160
+00:13:45,000 --> 00:13:47,000
+level authorization vulnerabilities.
+
+161
+00:13:48,000 --> 00:13:55,000
+Overly permissive access policies defining access policies that are too broad or permissive, granting
+
+162
+00:13:55,000 --> 00:14:03,000
+users more access than necessary increases the risk of unauthorized access and potential data breaches.
+
+163
+00:14:03,000 --> 00:14:07,000
+As users can perform actions they should not be able to.
+
+164
+00:14:08,000 --> 00:14:11,000
+Failure to enforce principle of least privilege.
+
+165
+00:14:12,000 --> 00:14:18,000
+Allowing users or processes to access resources with more privileges than needed to perform their tasks,
+
+166
+00:14:19,000 --> 00:14:27,000
+increases the attack surface and potential impact of security incidents, as attackers can exploit these
+
+167
+00:14:27,000 --> 00:14:28,000
+elevated privileges.
+
+168
+00:14:29,000 --> 00:14:32,000
+Inadequate validation of user sessions and tokens.
+
+169
+00:14:33,000 --> 00:14:36,000
+Failing to validate user sessions or tokens properly.
+
+170
+00:14:36,000 --> 00:14:41,000
+Allowing attackers to forge or manipulate tokens to gain unauthorized access.
+
+171
+00:14:42,000 --> 00:14:49,000
+Users may access data or perform actions they are not authorized for compromising data integrity and
+
+172
+00:14:49,000 --> 00:14:50,000
+confidentiality.
+
+173
+00:14:51,000 --> 00:14:55,000
+Weak authentication and authorization mechanisms.
+
+174
+00:14:56,000 --> 00:15:03,000
+Using weak or outdated authentication and authorization methods that are susceptible to exploitation,
+
+175
+00:15:03,000 --> 00:15:11,000
+allows attackers to bypass security measures and gain unauthorized access to sensitive data or resources.
+
+176
+00:15:12,000 --> 00:15:18,000
+Addressing the root causes of broken object level authorization vulnerabilities requires implementing
+
+177
+00:15:18,000 --> 00:15:24,000
+robust coding practices through input validation and stringent access control mechanisms.
+
+178
+00:15:24,000 --> 00:15:30,000
+By adopting secure coding principles and continuously auditing and updating authorization controls,
+
+179
+00:15:30,000 --> 00:15:37,000
+organizations can significantly reduce the risk of broken object level authorization vulnerabilities
+
+180
+00:15:37,000 --> 00:15:43,000
+and enhance the overall security posture of their applications and APIs.
+

74 - OWASP API Security Top 10 2023/003 API12023 Broken Object Level Authorization - Part 2 (Practice)_en.srt

@@ -0,0 +1,652 @@
+1
+00:00:02,000 --> 00:00:08,000
+Specially for this lesson, I prepared a demo of broken object level authorization vulnerability.
+
+2
+00:00:09,000 --> 00:00:11,000
+Together we will learn how we can fix it.
+
+3
+00:00:12,000 --> 00:00:17,000
+So let me start screen sharing all source code examples that you will see in the lesson.
+
+4
+00:00:17,000 --> 00:00:20,000
+You can find in attachments to the video.
+
+5
+00:00:20,000 --> 00:00:26,000
+And just a reminder in case you will have any questions related to the lesson, don't wait.
+
+6
+00:00:26,000 --> 00:00:30,000
+Post your questions below the video and I will be happy to answer.
+
+7
+00:00:31,000 --> 00:00:34,000
+So we are going to review the problem statement.
+
+8
+00:00:34,000 --> 00:00:40,000
+First I will show you vulnerable example first and then we will review solution and you will learn how
+
+9
+00:00:40,000 --> 00:00:43,000
+to avoid broken object level authorization vulnerability.
+
+10
+00:00:44,000 --> 00:00:49,000
+If you are a student of my course Java from zero to first job, then you are already aware that during
+
+11
+00:00:49,000 --> 00:00:51,000
+the course we develop online.
+
+12
+00:00:51,000 --> 00:00:53,000
+Shop from scratch.
+
+13
+00:00:53,000 --> 00:00:57,000
+But don't worry, I will give you a context before this example.
+
+14
+00:00:57,000 --> 00:01:04,000
+So imagine that you develop e-commerce application online shop and you are in progress of implementation
+
+15
+00:01:04,000 --> 00:01:06,000
+of API for your product entity.
+
+16
+00:01:07,000 --> 00:01:14,000
+For example, you need to introduce this API for another service or another app to manage your products
+
+17
+00:01:14,000 --> 00:01:15,000
+via API.
+
+18
+00:01:16,000 --> 00:01:19,000
+Let's review example of the servlet line by line.
+
+19
+00:01:19,000 --> 00:01:26,000
+The annotation at the top of the servlet class designates it as a servlet, and maps it to a specific
+
+20
+00:01:26,000 --> 00:01:27,000
+URL pattern.
+
+21
+00:01:28,000 --> 00:01:34,000
+This means that any request to this URL pattern will be handled by the servlet class.
+
+22
+00:01:35,000 --> 00:01:42,000
+The class itself extends HTTP servlet, which is a base class for handling HTTP requests in Java.
+
+23
+00:01:43,000 --> 00:01:48,000
+By extending this class, it can override methods like Doget to handle get requests.
+
+24
+00:01:49,000 --> 00:01:55,000
+Inside the class, there is an instance variable of type product facade which is used to interact with
+
+25
+00:01:55,000 --> 00:01:56,000
+the product data.
+
+26
+00:01:57,000 --> 00:02:01,000
+You can check details of product facade later and ask me if you have any questions.
+
+27
+00:02:01,000 --> 00:02:08,000
+But in general, this is just an implementation of facade pattern that simplify our interaction with
+
+28
+00:02:08,000 --> 00:02:09,000
+product entity.
+
+29
+00:02:10,000 --> 00:02:17,000
+This variable is initialized to an instance of default product facade through a method that implements
+
+30
+00:02:17,000 --> 00:02:19,000
+the singleton pattern.
+
+31
+00:02:19,000 --> 00:02:26,000
+We don't have any inversion of control container in this example, so I implemented singleton pattern
+
+32
+00:02:26,000 --> 00:02:27,000
+for some entities.
+
+33
+00:02:27,000 --> 00:02:32,000
+The Doget method is overridden to handle http get requests.
+
+34
+00:02:32,000 --> 00:02:38,000
+It takes two parameters, one representing the request and one representing the response.
+
+35
+00:02:39,000 --> 00:02:46,000
+Inside this method, the product ID is extracted from the request parameters and converted from a string
+
+36
+00:02:46,000 --> 00:02:47,000
+to an integer.
+
+37
+00:02:48,000 --> 00:02:53,000
+The product facade is then used to fetch a product based on the product id.
+
+38
+00:02:54,000 --> 00:02:58,000
+Here is the first alarm I extract product by ID.
+
+39
+00:02:58,000 --> 00:03:01,000
+This is not string, this is integer id.
+
+40
+00:03:02,000 --> 00:03:06,000
+Most likely all IDs goes in the sequential order one after another.
+
+41
+00:03:07,000 --> 00:03:12,000
+That is the first thing that hackers think when they see this API interface.
+
+42
+00:03:13,000 --> 00:03:19,000
+If you are a student of Udemy platform and if you will be very attentive, even Udemy used sequential
+
+43
+00:03:19,000 --> 00:03:21,000
+IDs for different resources.
+
+44
+00:03:21,000 --> 00:03:26,000
+I hope that by moment when you watch this video, they will fix this.
+
+45
+00:03:26,000 --> 00:03:30,000
+But still, it is a potential security vulnerability.
+
+46
+00:03:30,000 --> 00:03:37,000
+Just a reminder that all attempts of hacking are illegal, so please don't even try to do some attempts.
+
+47
+00:03:38,000 --> 00:03:43,000
+We are learning all this information just to learn by example how to avoid potential vulnerabilities.
+
+48
+00:03:44,000 --> 00:03:49,000
+And now you learned that having sequential IDs for resources is not the best practice.
+
+49
+00:03:50,000 --> 00:03:52,000
+So what do we have next?
+
+50
+00:03:52,000 --> 00:03:57,000
+If a product is found, it writes the product's information to the response.
+
+51
+00:03:58,000 --> 00:04:06,000
+If no product is found, it sends a 404 error response indicating that the product was not found.
+
+52
+00:04:06,000 --> 00:04:08,000
+Seems like okay for you?
+
+53
+00:04:08,000 --> 00:04:09,000
+Not at all.
+
+54
+00:04:10,000 --> 00:04:15,000
+What if during a malicious attack, somebody would read all product details, including products that
+
+55
+00:04:15,000 --> 00:04:17,000
+are not published?
+
+56
+00:04:17,000 --> 00:04:21,000
+Or even worse, what if this wouldn't be just read operation?
+
+57
+00:04:22,000 --> 00:04:28,000
+What if this would be delete operation and hacker can get opportunity to delete all products in your
+
+58
+00:04:28,000 --> 00:04:31,000
+shop simply by sending multiple requests.
+
+59
+00:04:31,000 --> 00:04:32,000
+Just change an ID.
+
+60
+00:04:33,000 --> 00:04:38,000
+Let me show you in the browser how easily you can get access to product resource.
+
+61
+00:04:39,000 --> 00:04:42,000
+So this application is deployed on my localhost.
+
+62
+00:04:43,000 --> 00:04:45,000
+Imagine I found out the resource name.
+
+63
+00:04:45,000 --> 00:04:52,000
+It can be relatively simple either by using the web resource and just by being attentive, navigating
+
+64
+00:04:52,000 --> 00:04:59,000
+between pages, or exploring network tab in Google Chrome DevTools details to learn which requests are
+
+65
+00:04:59,000 --> 00:05:01,000
+sent and different other methods.
+
+66
+00:05:02,000 --> 00:05:09,000
+This is more related to API testing, and I had a separate section about API testing in my course Java
+
+67
+00:05:09,000 --> 00:05:10,000
+from zero to first job.
+
+68
+00:05:10,000 --> 00:05:14,000
+Let's stick to agenda of the lesson and continue.
+
+69
+00:05:14,000 --> 00:05:20,000
+So I just sent a request to a resource with request parameter product ID equal to one.
+
+70
+00:05:21,000 --> 00:05:23,000
+And here is product information.
+
+71
+00:05:24,000 --> 00:05:29,000
+What if I would change a year just to the next ID that pops up in my mind?
+
+72
+00:05:29,000 --> 00:05:32,000
+Let me change ID to two.
+
+73
+00:05:33,000 --> 00:05:36,000
+What if I would send requests to resource with product ID three?
+
+74
+00:05:37,000 --> 00:05:39,000
+That is jackpot.
+
+75
+00:05:39,000 --> 00:05:46,000
+The only thing that is left for me in such case is to create a program that will send requests for all
+
+76
+00:05:46,000 --> 00:05:47,000
+integers.
+
+77
+00:05:47,000 --> 00:05:49,000
+Parse response.
+
+78
+00:05:49,000 --> 00:05:50,000
+And that's it.
+
+79
+00:05:50,000 --> 00:05:52,000
+Information is stolen.
+
+80
+00:05:53,000 --> 00:05:59,000
+Another problem with this code that during the access to resource, we don't check user's authorization
+
+81
+00:05:59,000 --> 00:06:01,000
+to access this resource.
+
+82
+00:06:01,000 --> 00:06:04,000
+In Java, this can be done very simply.
+
+83
+00:06:04,000 --> 00:06:11,000
+There is a robust and efficient spring security framework that can allow you to configure authorization
+
+84
+00:06:11,000 --> 00:06:13,000
+rules for different resources.
+
+85
+00:06:13,000 --> 00:06:19,000
+In this case, you can see that in code no authorization checks present.
+
+86
+00:06:19,000 --> 00:06:25,000
+Let me now open another file and I will show you how you can avoid broken object level authorization
+
+87
+00:06:25,000 --> 00:06:26,000
+vulnerabilities.
+
+88
+00:06:27,000 --> 00:06:29,000
+The file is called secure product servlet.
+
+89
+00:06:30,000 --> 00:06:31,000
+It is also servlet.
+
+90
+00:06:31,000 --> 00:06:34,000
+We are going to use product facade in this example too.
+
+91
+00:06:34,000 --> 00:06:37,000
+So we need to initialize it here too.
+
+92
+00:06:38,000 --> 00:06:41,000
+But do get method is written in a little bit different way.
+
+93
+00:06:42,000 --> 00:06:45,000
+First of all I changed request parameter name.
+
+94
+00:06:45,000 --> 00:06:51,000
+This time it will not be product ID it will be product global unique identifier.
+
+95
+00:06:51,000 --> 00:06:55,000
+Another difference I want to extract logged in user from the session.
+
+96
+00:06:56,000 --> 00:07:02,000
+Basically, when the user will log in into our application, I will put user object into the session.
+
+97
+00:07:02,000 --> 00:07:06,000
+There are different authentication and authorization mechanisms.
+
+98
+00:07:07,000 --> 00:07:12,000
+This is just one of the possible ways to implement this in the simplified and transparent manner.
+
+99
+00:07:12,000 --> 00:07:15,000
+That is the best for online lesson.
+
+100
+00:07:16,000 --> 00:07:22,000
+Of course, there are dozens of more complicated ways to implement authorization and authentication.
+
+101
+00:07:22,000 --> 00:07:28,000
+So if you know other way or you use different programming language or other frameworks, feel free to
+
+102
+00:07:28,000 --> 00:07:29,000
+proceed with those.
+
+103
+00:07:29,000 --> 00:07:31,000
+That is totally fine.
+
+104
+00:07:31,000 --> 00:07:33,000
+So I extracted logged in user.
+
+105
+00:07:33,000 --> 00:07:35,000
+We will use it later.
+
+106
+00:07:35,000 --> 00:07:37,000
+Let's see what is going next.
+
+107
+00:07:38,000 --> 00:07:48,000
+I extract product using not ID but global unique identifier that is long string value 32 character hexadecimal
+
+108
+00:07:48,000 --> 00:07:48,000
+string.
+
+109
+00:07:49,000 --> 00:07:55,000
+So it will take some time of hacker to guess it and it will not be super fun.
+
+110
+00:07:55,000 --> 00:08:02,000
+Hacker would require super computer to hack all the database of products you will see soon how it looks
+
+111
+00:08:02,000 --> 00:08:02,000
+like.
+
+112
+00:08:03,000 --> 00:08:09,000
+Then I check that product is not null and that product name is not null.
+
+113
+00:08:09,000 --> 00:08:16,000
+That is related with the specifics of implementation, because I try to avoid returned null values to
+
+114
+00:08:16,000 --> 00:08:18,000
+avoid null pointer exception.
+
+115
+00:08:19,000 --> 00:08:25,000
+I also try to avoid of using optional API in Java because it has its own drawbacks.
+
+116
+00:08:25,000 --> 00:08:28,000
+But anyway, this is a topic for a separate lesson.
+
+117
+00:08:29,000 --> 00:08:33,000
+What I prefer to do time to time is to return empty objects.
+
+118
+00:08:34,000 --> 00:08:38,000
+That's why I need these checks to check if object is empty or not.
+
+119
+00:08:39,000 --> 00:08:43,000
+So if there is no object, we just send error.
+
+120
+00:08:43,000 --> 00:08:45,000
+That product is not found.
+
+121
+00:08:46,000 --> 00:08:50,000
+If we found this product then I check which row has logged in.
+
+122
+00:08:50,000 --> 00:08:51,000
+User.
+
+123
+00:08:51,000 --> 00:08:58,000
+In this particular example, I allow only to users with admin role to get access to product details
+
+124
+00:08:58,000 --> 00:08:59,000
+via API.
+
+125
+00:09:00,000 --> 00:09:07,000
+And in case logged in user has admin role only, in this case it can see the product details.
+
+126
+00:09:07,000 --> 00:09:09,000
+Otherwise I return 403.
+
+127
+00:09:09,000 --> 00:09:11,000
+Error code access is forbidden.
+
+128
+00:09:11,000 --> 00:09:15,000
+The client is not permitted access to the resource and that's it.
+
+129
+00:09:16,000 --> 00:09:22,000
+So in this particular case, I used just few techniques to avoid broken object level authorization.
+
+130
+00:09:22,000 --> 00:09:30,000
+I used non predictable unique identifiers and I added zero authorization check before granting access
+
+131
+00:09:30,000 --> 00:09:31,000
+to a resource.
+
+132
+00:09:32,000 --> 00:09:37,000
+In this lesson, we'll learn even more ways how to avoid broken object level authorization.
+
+133
+00:09:37,000 --> 00:09:41,000
+But in this particular example, I applied this tool.
+
+134
+00:09:41,000 --> 00:09:44,000
+It is time to demo you how it works.
+
+135
+00:09:44,000 --> 00:09:46,000
+Let me open browser now.
+
+136
+00:09:47,000 --> 00:09:49,000
+So let's start from easy case.
+
+137
+00:09:49,000 --> 00:09:52,000
+Let's imagine I learned resource URL.
+
+138
+00:09:52,000 --> 00:09:58,000
+I try to send request with the value of product Guid request parameter equal to one.
+
+139
+00:09:59,000 --> 00:10:02,000
+So I receive 404 error code.
+
+140
+00:10:02,000 --> 00:10:04,000
+Resource is not found.
+
+141
+00:10:05,000 --> 00:10:06,000
+Cool.
+
+142
+00:10:06,000 --> 00:10:09,000
+It is already less predictable than in previous case.
+
+143
+00:10:09,000 --> 00:10:10,000
+Don't you think so?
+
+144
+00:10:10,000 --> 00:10:13,000
+Let's imagine that I managed to hack all products.
+
+145
+00:10:13,000 --> 00:10:15,000
+Unique identifiers.
+
+146
+00:10:15,000 --> 00:10:17,000
+Okay, good for me.
+
+147
+00:10:17,000 --> 00:10:21,000
+Let's try to send requests using different request parameter value.
+
+148
+00:10:21,000 --> 00:10:23,000
+Can you see this value?
+
+149
+00:10:24,000 --> 00:10:30,000
+This is 32 character hexadecimal strings that I generate for each product during its creation.
+
+150
+00:10:30,000 --> 00:10:35,000
+What I will receive now of course access is forbidden status code.
+
+151
+00:10:36,000 --> 00:10:41,000
+Product is found, but I can't access it because I don't have enough authorization rights.
+
+152
+00:10:42,000 --> 00:10:49,000
+So what I need to do to be able to read this product, I need login with admin user credentials because
+
+153
+00:10:49,000 --> 00:10:55,000
+as you remember, according to our logic, only users with admin role can get access to this resource.
+
+154
+00:10:56,000 --> 00:11:00,000
+So let me navigate to the login page of my application.
+
+155
+00:11:00,000 --> 00:11:04,000
+Here I need to enter credentials of admin user.
+
+156
+00:11:04,000 --> 00:11:06,000
+It will take few seconds.
+
+157
+00:11:07,000 --> 00:11:10,000
+Admin at Test.com and password.
+
+158
+00:11:11,000 --> 00:11:14,000
+Okay, now I'm logged in as an admin user.
+
+159
+00:11:15,000 --> 00:11:15,000
+Cool.
+
+160
+00:11:16,000 --> 00:11:19,000
+Let's check access to the same resource one more time.
+
+161
+00:11:20,000 --> 00:11:21,000
+And here we go.
+
+162
+00:11:21,000 --> 00:11:24,000
+Now we finally can access it.
+
+163
+00:11:24,000 --> 00:11:30,000
+So that's how you can avoid broken object level authorization vulnerabilities in your code.
+