Practical Security for Web Applications (extended session) - Chris Holland - TriNet - OS101

Chris Holland, Director of Engineering at TriNet, delivered the extended (90 minutes) talk "Practical Security for Web Applications" at Open Source 101 on Tuesday, March 30, 2021.

Abstract:
Explore effective methods to identify & avoid the most common and devastating security pitfalls in Web Applications.

When it comes to an enterprise’s exposure to security vulnerabilities, one could easily argue that its web presence is by far its greatest threat. There are many ways to build vulnerable applications and a few effective ways to “build them right”. We’ll instrument you to stay on the right side of this equation.

Basic Resources and Tooling
—————————–
We’ll look at the OWASP Top 10
Open-Source Code Analysis for your CI/CD
Open-Source Security Scanning
Low-level Threat Avoidance
—————————-
Avoiding SQL Injections
Dangers of not properly using an ORM
NoSQL injections
Avoiding CSRF
Avoiding XSS
Data Scrubbing
Data Rendering
Application Threat Avoidance
—————————–
User Authentication / Password Hashing
OAuth Security
Resource Access
Multi-Tenancy: Users & Companies

Chris on the internets: