Why Hunt Bugs? Security and Insecurity Dangerous Assumptions Attack Vectors Lab: Case Study in Failure Safe and Appropriate Bug Hunting/Hacking Working Ethically Respecting Privacy Bug/Defect Notification Bug Bounty Programs

Principles of Information Security Security Is a Lifecycle Issue Minimize Attack Surface Area Layers of Defense: Tenacious D Compartmentalize Consider All Application States Do NOT Trust the Untrusted

Unvalidated Data Buffer Overflows Integer Arithmetic Vulnerabilities Unvalidated Data: Crossing Trust Boundaries Defending Trust Boundaries Whitelisting vs Blacklisting A1: Injection Injection Flaws SQL Injection Attacks Evolve Drill Down on Stored Procedures Other Forms of Injection Minimizing Injection Flaws A2: Broken Authentication Quality and Protection of Authentication Data Handling Passwords on Server Side SessionID Risk Reduction HttpOnly and Security Headers A3: Sensitive Data Exposure Protecting Data Can Mitigate Impact In-Memory Data Handling Secure Pipes Failures in TLS/SSL Framework A4: XML External Entities (XXE) XML Parser Coercion XML Attacks: Structure XML Attacks: Injection Safe XML Processing A5: Broken Access Control Access Control Issues Excessive Privileges Insufficient Flow Control Unprotected URL/Resource Access Examples of Shabby Access Control Sessions and Session Management Lab: Spotlight: Verizon

A6: Security Misconfiguration System Hardening: IA Mitigation Application Whitelisting Least Privileges Anti-Exploitation Secure Baseline A7: Cross Site Scripting (XSS) XSS Patterns Persistent XSS Reflective XSS DOM-Based XSS Best Practices for Untrusted Data A8/9: Deserialization/Vulnerable Components Deserialization Issues Identifying Serialization and Deserializations Vulnerable Components Software Inventory Managing Updates Lab: Spotlight: Equifax A10: Insufficient Logging and Monitoring Fingerprinting a Web Site Error-Handling Issues Logging In Support of Forensics Solving DLP Challenges Spoofing, CSRF, and Redirects Name Resolution Vulnerabilities Fake Certs and Mobile Apps Targeted Spoofing Attacks Cross Site Request Forgeries (CSRF) CSRF Defenses

Applications: What Next? Common Vulnerabilities and Exposures CWE/SANS Top 25 Most Dangerous SW Errors Strength Training: Project Teams/Developers Strength Training: IT Organizations Leveraging Common AppSec Practices and Control Lab: Recent Incidents Lab: Spotlight: Capital One Making Application Security Real Cost of Continually Reinventing Paralysis by Analysis Actional Application Security Additional Tools for the Toolbox

Cryptography Overview Strong Encryption Message Digests Encryption/Decryption Keys and Key Management NIST Recommendations Scanning Applications Overview Scanning Beyond the Applications Fingerprinting Vulnerability Scanning: Hunting for Bugs Reconnaissance Goals Data Collection Techniques Fingerprinting the Environment Enumerating the Web Application