Defence In Depth: What We Practice

We practice what we preach. Zero Trust is part of a complete defence in depth strategy.

Overview

Defence In Depth. The principle is simple. Assume each layer of your security will be breached. Think about how to delay the attacker, how to increase their costs.

The more you can delay the attacker, the more you have a chance of observing and reacting before its too late.

The more you can shift cost from you (the defender) to the attacker, the more likely it is they will go elsewhere.

Defense in depth means defending at each stage of a pipeline. From SAST through simple orthogonal security techniques like fail to ban to zero-trust techniques like splitting identity from authorisation.

Don’t let the browser pass you by: keep your server up to date

Browsers update faster than servers, being consumer technology. TLS 1.0 and 1.1 are dead, update your servers.
Zero Trust: Connecting The Digitally Disconnected

Digitally Disconnected. The 2nd class citizens of the 21st Century. Unable to access data due to identity or VPN. NO MORE! Zero Trust.
Email Strict Transport Security: Our First Report

Email Strict-Transport-Security. Complex to setup, but provides encryption on the transportation of your email like HTTP Strict Transport.
Zero Trust Architecture: Published by NIST

Zero-Trust. Make your team more efficient, increase your security, reduce your cost? What’s not to love. The line for the bandwagon starts over there.
Cross-Origin-Request-Sharing and You

CORS. The method by which we secure web applications that are de-monolithed to directly use API’s
CORS’ing the complexity: idempotent and caching meets Vary: Origin for CORS

Cross-Origin-Request-Sharing (CORS) is challenging to implement. Learn how to make it work with multiple applications in the same browser.
Secure the Cookie!

The humble cookie. So controversial. So complex to secure. If your web app must have them, you must secure them.
The browser was the accomplice

You and your browser run inside a nice safe firewall. A firewall which doesn’t do what you think. Explore how the browser is the accomplice to the crime.
Zero Trust and the NTT Hack

NTT Comm discloses a breach. Firewalls lead to false assurances, allowing wide open internal access.
Fixing the case of the Implicit Flow modification

Meet Hank. Hank is a web application with a dark secret. It trusts you the user to not change things in the browser. Bad Hank. Learn how to fix it!
Why should I use Content-Security-Policy?

The Content-Security-Policy headers exists to protect the users of your web site from the content they themselves might create.
The Web Application Firewall and You: Who Should Use, and When.

Should I use a Web Application Firewall? What is it ? What benefit will it give me? When would I use it? Read on to learn!
DEFENSE IN DEPTH: CLOUD NATIVE DAY 2019 TALK

We often think in Boolean terms: Outside Bad, Inside Good Instead, assume each layer will be breached
How phishing negates your firewall

Your corporate firewall. That invulnerable bastion that lets you fearlessly run less-than-secure internal tools like a CRM, a Finance portal. But, is it really invulnerable? Or is it a paper wall at best? We look at how Cross-Site-Scripting vulnerabilities, known session ID cookies or access tokens can allow content from the world to pierce it as if it were not there. We do this using the weakest link: you.
Logging real remote address with Nginx and Lua

For audit, security, tracing, we want the origin IP logged. Load-balancers can mask this. Learn how to log the true client IP from nginx with lua, when that nginx is behind a load-balancer (reverse proxy)
Using Istio & OpenID Connect / OAUTH2 To Authorise

Make it simple and safe to be secure for your developers. Allow any internal devops site to have single-sign-on and authorisation.
The desktop crypto curveball: test your encryption

Encryption. Its good, if its working,. You should test your encryption, on the desktop, on the server, once in a while. Curveball recently came out, test it!.
Don’t trust the firewall: why defence in depth is important

A firewall is not an absolute defense. Weak things inside it can be attacked through JavaScript or other vectors. Defense in Depth is important.
Mutual Identity: Phone Scams And Workload Security

Establishing mutual identity trust is complex. I must know who you are, you must know who I am. People fall for phone scams with caller ID. Let’s fix for online.
Assess Web Security Simply. You. Yes You.

Asssessing web security, The basics are faster and easier than you think. A few simple free tools, a minute or so of our time. Let’s try some sites now.
Remove information exposure: nginx banner

Information exposure. Many servers send a helpful banner out with the specific name and version of the software. This can in turn attract low-level attacks that use tools like Shodan.io to find vulnerable hosts. CWE-200 suggests we need to remove the information exposure. Let’s discuss. Some hold that hiding these banners increases security. For example, CWE-200 has this position. Others (myself included) are of the opinion that security through obscurity gives a false sense. Regardless of your opinion, you will…
Email Strict Transport Security with MTA-STS

Email security. A complex patchwork. Enable MTA-STS to get strict transport security on your STARTTLS.
Defense in Depth: Securing your new Kubernetes cluster from the challenges that lurk within

Cloud Native Day Presentation. The dangers that lurk inside your Kubernetes Cluster, what to watch out for.
We are all-in on the TLS: the HSTS preload

TLS, HTTPS. These are an important step in defence in depth. Get your entire domain on the https-only list at hstspreload.org, thank me later.
Git ransomware: beware the misdirection

Github ransomware. It might be a misdirection to hide more surreptitious changes to the codebase for you to import into your cloud.
Covert Exfiltration, Cloud Native

Your virtual-private-cloud private IP setup still has access to key API’s such as storage and messaging. Have you considered exfiltration through these?
Moving into a new (cloud) neighbourhood? Check its reputation!

Your shiny new cloud instances might be tarnished by the reputation of the last tenant. Use Shodan to check, and Greynoise to see if its above the norm. And above all, don’t panic!
Docker Hub Hack: Secure Your Supply Chain

Docker hub loses account info, deploy tokens for github + bitbucket. Supply chain security chaos should ensue. Or are we now too blase? Its not me, right?
Static Application Security for Nodejs (with Gitlab CI)

Static application security for nodejs and Gitlab CI without changing your containers. SAST the easy way using docker FROM.
The supply chain security risk in action: ESLint

Software is eating the world. The software supply chain is very complex to understand and manage. One slip up upstream, and that code is in your image very rapidly. Continuous!