awesome-appsec

perience is all they're ultimately interested in (at least for the software engineer positions I would be gunning for) but I would suspect some domain knowledge is what they would prefer in addition to that. So far, I've just been exploring this domain via involvement with open-source projects within this space. 2) Cybersecurity: I'm not sure if this qualifies as a secondary domain since it's still very "computer sciencey" and is quite broad in and of itself but I suspect that it's a much wider space than civic tech which is why I find myself torn between which one is worthy of further exploration. Within this space, I would probably be either be interested in application security positions (https://www.facebook.com/careers/jobs/123558231663498/ as an example) or "secure software development" positions which I understand are positions that involve building software that operates in the context of improving the security posture of a company (ex. software that conducts static analysis of source code to find potential vulnerabilities). To determine whether I am interested in this domain, I've just been going through application security resources (currently, the Crypto 1 course from Stanford but I'll be following that up with other resources from https://github.com/paragonie/awesome-appsec). With regard to next steps after that, I've been thinking of https://www.edx.org/masters/online-master-science-cybersecur... but I'm a bit conflicted given that I've received conflicting opinions on the usefulness of a masters within the field of cybersecurity. TL;DR: "Civic tech" and cybersecurity are the 2 I'm considering. I'm unsure which domain is worthy of my entire attention but I've been immersing myself in each to a varying degree via related activities.

1823. Apache can't save you from Shellshock. Cryptography failures are their own category, where the phrase "padding oracle" is routinely uttered with a straight face, a single mistake can cripple your application, and comparing strings the normal way programmers compare strings is considered dangerous. The solution here for people who aren't interested in becoming an expert is to hire one. Or a team of them. These descriptions are an attempt to address the fundamental problems with how insecure code is written, rather than to arm the reader with a checklist of specific instances of vulnerabilities they can check off. I generally dislike checklists (OWASP 10, SANS 25). How many people are well-armed against SQL Injection, but pass user data to PHP's unserialize() function with reckless abandon? This is a data-as-code issue. How many people use str_shuffle() for password reset token generation? This is a cryptographic failure. I wrote about this at length here: https://paragonie.com/blog/2015/08/gentle-introduction-appli... If anyone's interested, I also curate this reading list on Github: https://github.com/paragonie/awesome-appsec

: Don't write your applications in a dumb way that makes these vulnerabilities possible. But if you must, use something like realpath() with a sanity check based on the expected parent directory (in PHP). XML External Entities: Make sure you disable the entity loader: libxml_disable_entity_loader(true); PHP Object Injection in PHP 5: don't ever pass user input to unserialize(); use json_decode() instead. PHP Object Injection in PHP 7: either disable object loading or whitelist the allowed types; i.e. unserialize($var, false); or unserialize($var, ['DateTime']); These are just some of the common problems I frequently find, of course. There are more basic ways to mess up an application ("not even checking that you're authenticated" being at the top of that list). https://paragonie.com/blog/2015/08/gentle-introduction-appli... Further reading and resources: * https://securityheaders.io * https://github.com/paragonie/awesome-appsec And if anyone wants their code reviewed: https://paragonie.com/services