Lesson 13: Security¶

Warning

This lesson is under construction. Learn from it at your own risk. If you have any feedback, please fill out our General Feedback Survey.

Security¶

se·cu·ri·ty ( siˈkyo͝oritē/ ) [ noun ]

The state of being free from danger or threat.

The safety of a state or organization against criminal activity such as terrorism, theft, or espionage.

Types of Security¶

There are three main types of security in computing:

Threat Models¶

Threat models allow you to focus and limit your security resources on what is necessary instead of what is possible.

Authentication, Authorization, Identity¶

Passwords / Passphrases¶

Problems with Passwords¶

People repeat passwords.
Many passwords are easy to guess.
Passwords are hard to remember.

Solutions for Passwords¶

Choosing Pass-phrases¶

Relevant funny bash.org post

Certificates and HTTPS¶

Types of Attacks¶

Frequency of online attacks (37% Cross Site Scripting, 16% SQL Injection, etc)

Code Injection¶

Code Injection Attacks¶

<img src="http://example.com/?action="Delete All Accounts"

Code Injection Defenses¶

Web Server Attacks¶

Discovering Vulnerabilites¶

Test and document the bug to verify it exists.

If you think you encountered a bug, make sure you can replicate it. If you can’t how can you expect the developers to recreate it?
Disclose it privately to those responsible for fixing it.

Provide examples – it’s basically a bug report, but through private channels (not public tracker yet!)
Give them time to release a patch before announcing it.

Google waits 90 days to announce a bug after informing the developers.

Lesson 13: Security¶

Security¶

Types of Security¶

Threat Models¶

Authentication, Authorization, Identity¶