SAPO Codebits 2009

Session Title

Crash Course in Brain Surgery

Abstract

Crash Course in Brain Surgery (by "brain" I mean "application",
and by "surgery" I mean "security").

Since Codebits is mainly a coder/developer conference, this presentation will be about developing applications securely, primarly Web applications. As we have seen this year, most "standard" flaws, such as XSS and SQLinjection are still being found and exploited in low and high profile applications (remember the Heartland Payment Systems breach, using SQLinjection, where millions of CC numbers were stolen, or the BarackObama.com website ?), even though these vulnerabilities have been known for almost a decade. My talk focuses on raising awareness on the need for developers to think about security, and integrating security throughout the software development lifecycle, helping developers understand the problems, and how these can be avoided. In the talk I'll try to show different types of flaws (language agnostic), from technical flaws (XSS/CSRF/SQLi/etc), to design flaws, business logic flaws, access control flaws, etc, as well as sharing real world examples and experiences from different applications which have #failed.

Language

Portuguese

Speakers

Bruno Morisson

Bruno Morisson is a Senior Information Security Consultant at Commet, a new IT services company from the Oni Group. He currently leads the IT Security Operations teams at Commet, providing services to customers in the financial, public and energy sectors, to who he also provides consultancy, engineering, and auditing services. For the last 10 years he's been involved in several areas of Information Security, from consulting, architecture, engineering, auditing and penetration testing, as well as integration of opensource security solutions. He was one of the founders of the portuguese chapter of the Honeynet Project, and holds several certifications in Information Security (CISSP, CISA, ISO27001 Lead Auditor). (more)