WebFund 2014W Lecture 15 - Revision history

Soma at 00:44, 10 March 2014

2014-03-10T00:44:04Z

← Older revision		Revision as of 00:44, 10 March 2014
Line 1:		Line 1:
			The video from the lecture given on March 7, 2014 is available:

			* [http://www.screencast.com/t/IPsw3EmQ1 Small from screencast.com]
			* [http://www.screencast.com/t/vJp1VpQumCI Large from screencast.com]
			* [http://dl.cuol.ca/capture/Anil.Somayaji/COMP_2406_2014W_Lecture_15_-_20140307_142925_27.mp4 Original from CUOL]


	==Web Security==		==Web Security==
	Security is (roughly):		Security is (roughly):

Soma: /* Input validation */

2014-03-07T19:21:46Z

Input validation

← Older revision		Revision as of 19:21, 7 March 2014
Line 47:		Line 47:
	** input becomes output semi-directly		** input becomes output semi-directly
	** (incorporated into web pages)		** (incorporated into web pages)
			* one JavaScript context per web page
			* DOM is accessible in it => all of the web page is accessible
			* easy to trust client, easy to forget "redundant" checks

Soma: /* Input validation */

2014-03-07T18:48:03Z

Input validation

← Older revision		Revision as of 18:48, 7 March 2014
Line 42:		Line 42:

	==Input validation==		==Input validation==

			* hard because application interface/front end is under attacker control
			* hardest use case: user-generated input
			** input becomes output semi-directly
			** (incorporated into web pages)

Soma at 18:42, 7 March 2014

2014-03-07T18:42:26Z

← Older revision		Revision as of 18:42, 7 March 2014
Line 40:		Line 40:

	Last is most significant for web security		Last is most significant for web security

			==Input validation==

Soma: /* Points of Vulnerability */

2014-03-07T18:41:20Z

Points of Vulnerability

← Older revision		Revision as of 18:41, 7 March 2014
Line 30:		Line 30:

	==Points of Vulnerability==		==Points of Vulnerability==

			What access does the attacker have?
			# hardware (chips)?
			# physical/virtual access to machine?
			#* burglary
			#* "insider attacks": sysadmins, cloud providers
			#* Digital Rights Management (DRM)
			# malicious input

			Last is most significant for web security

Soma: /* Attacker Goals */

2014-03-07T18:32:29Z

Attacker Goals

← Older revision		Revision as of 18:32, 7 March 2014
Line 18:		Line 18:

	==Attacker Goals==		==Attacker Goals==

			* steal private information (e.g., financial)
			* reduce availability
			** impact reputation
			* perform malicious operations (using existing functionality)
			** steal money
			** blow up a reactor
			** use application to achieve attacker's goals
			* monitor usage (spying)
			* data tampering

	==Points of Vulnerability==		==Points of Vulnerability==

Soma: /* Threat Models */

2014-03-07T18:25:59Z

Threat Models

← Older revision		Revision as of 18:25, 7 March 2014
Line 14:		Line 14:
	* how may they achieve them?		* how may they achieve them?
	* in other words, how are you in danger? What are the risks?		* in other words, how are you in danger? What are the risks?

			There are always attacks outside of your threat model.

	==Attacker Goals==		==Attacker Goals==

	==Points of Vulnerability==		==Points of Vulnerability==

Soma: /* Threat Models */

2014-03-07T18:24:28Z

Threat Models

← Older revision		Revision as of 18:24, 7 March 2014
Line 11:		Line 11:
	==Threat Models==		==Threat Models==

			* what are the attacker goals?
			* how may they achieve them?
			* in other words, how are you in danger? What are the risks?

	==Attacker Goals==		==Attacker Goals==

	==Points of Vulnerability==		==Points of Vulnerability==

Soma: Created page with "==Web Security== Security is (roughly): * confidentiality * integrity * availability Cryptography (SSL, secure hashes) are tools for achieving security. But they are not the..."

2014-03-07T17:50:30Z

Created page with "==Web Security== Security is (roughly): * confidentiality * integrity * availability Cryptography (SSL, secure hashes) are tools for achieving security. But they are not the..."

New page

==Web Security==
Security is (roughly):
* confidentiality
* integrity
* availability

Cryptography (SSL, secure hashes) are tools for achieving security. But they are not the only ones.

Security really matters for web applications because, by design, most are accessible by anyone in the world.

==Threat Models==

==Attacker Goals==

==Points of Vulnerability==