How an Attacker "Audits" Your Software Applications

Software runs today’s business; however, security implications are often misunderstood, creating significant organizational risk. Poorly configured servers, 3rd-party software, and continuous release cycles put additional pressure on already stressed teams. Hackers no longer just exploit vulnerabilities in code -- faulty cloud deployments, weak database structures, and business logic problems are also easy targets for attackers. To reduce risk, you’ve got to audit your system in the same way an attacker would. This presentation demonstrates how attackers compromise the modern enterprise. For each attack demonstrated, mitigation practices will be discussed. WARNING: software will be harmed during this presentation. Viewer discretion advised. Topics include: - The modern technology stack - Easy pickings – hacking demonstrations!! - Auditing software-based systems: o Standards and policies o System updates and patching o Data leakage/exfiltration o Identity & access management o System logs and tracking o Tamper protections and detection o Authentication and access controls