WebFund 2014W Lecture 15: Difference between revisions
| Line 18: | Line 18: | ||
==Attacker Goals== | ==Attacker Goals== | ||
* steal private information (e.g., financial) | |||
* reduce availability | |||
** impact reputation | |||
* perform malicious operations (using existing functionality) | |||
** steal money | |||
** blow up a reactor | |||
** use application to achieve attacker's goals | |||
* monitor usage (spying) | |||
* data tampering | |||
==Points of Vulnerability== | ==Points of Vulnerability== | ||
Revision as of 18:32, 7 March 2014
Web Security
Security is (roughly):
- confidentiality
- integrity
- availability
Cryptography (SSL, secure hashes) are tools for achieving security. But they are not the only ones.
Security really matters for web applications because, by design, most are accessible by anyone in the world.
Threat Models
- what are the attacker goals?
- how may they achieve them?
- in other words, how are you in danger? What are the risks?
There are always attacks outside of your threat model.
Attacker Goals
- steal private information (e.g., financial)
- reduce availability
- impact reputation
- perform malicious operations (using existing functionality)
- steal money
- blow up a reactor
- use application to achieve attacker's goals
- monitor usage (spying)
- data tampering