Security - Gavin Johnson-Lynn

Z-DaRT (Zero Data and Resource Trust)

TL;DR: "An application should assume zero trust in ALL data and resources that it consumes, no matter who created them, including internal staff" Software, in particular web-based applications suffer from a problem with trusting data and resources. Trusting Data Data coming

Compiling the LaZagne.exe from Source

Problems creating the LaZagne exe file? Use this guide to help you!

CVSS for Dev Teams

Penetrations test results (hopefully) contain CVSS scores. Here are some thoughts on how a dev team should look at them.

OWASP API Top 10: Broken Object Level Authorisation

Understand how broken object level authorisation attacks work against an API, why they work and what the potential impact is..

Defending from Forced Browsing…good reasons not to just hide restricted content

Secure coding to protect against forced browsing. Strong defences from forced browsing require controls such as Role Based Access. Here we explain how to mount a good defence!

Hooking a Browser with the Browser Exploitation Framework (BeEF)

A quick guide to starting BeEF and running commands against a hooked browser

Proxmark 3, Cloning a Mifare Classic 1K

Cloning a Mifare Classic 1k card using the Proxmark 3

Why do we Perform Secure Code Reviews

Why do we use secure code reviews, instead of just a generic code review?

When Should we Perform a Secure Code Review?

Working in an agile environment we need to consider what we do and how important it is that we do it. We want efficiency, but not at the expense of quality. So when we think about secure code reviews we shouldn't assume

Who can Perform a Secure Code Review?

You need to pick the right person for a job. Here's how to find the right person for a secure code review.

Agile Secure Code Review

Performing secure code reviews in an agile environment.

Agile Secure Code Review - References

A list of references that have been useful when writing about Secure Code Reviews. I haven't found much yet! * FxCop [https://en.wikipedia.org/wiki/FxCop] * OWASP Code Review Guide [https://www.owasp.org/index.php/OWASP_Code_Review_Guide_Table_of_

API Throttling

API request throttling limits the number of requests that can use your API. “Madness” you say, “intentionally stop requests from reaching my API?”

Defence Against SQL Injection

How do you defend against SQL Injection? Have you only got one or two defences in place? Cover yourself from multiple angles and perhaps help your overall security stance too!

Adding Depth to Security with Input Validation

Input validation is a simple yet powerful part of defence in depth. Discover how it helps improve the security of any service.

Defence in Depth Meets the Software Development Life-cycle

Security in software development can get time consuming. Thinking about it in an Agile way can save time and may even be better...

Authentication vs Authorisation, know the difference

Authentication vs Authorisation is one of the real basics of security, we've all got to start somewhere!

The Intricacies of IP Whitelisting

What is an IP Whitelist? An IP whitelist restricts incoming traffic so that it may only arrive from an IP address or list of IP addresses. Traffic from any other address is ignored before any further processing. This is useful because you can immediately

The Security of Champions

This is the third blog (first one here [https://gavinjl.ghost.io/is-your-business-unwilling-to-add-security-features-to-software/] , second one here [https://gavinjl.ghost.io/application-security-design-it-in-or-wedge-it-in-at-the-end/], third on here [https://gavinjl.ghost.io/security-degrades-over-time/]) from a meeting of the North-East England chapter of (ISC)2 [https://www.isc2.org/

Security degrades over time

This is the third blog (first one here [https://gavinjl.ghost.io/is-your-business-unwilling-to-add-security-features-to-software/] , second one here [https://gavinjl.ghost.io/application-security-design-it-in-or-wedge-it-in-at-the-end/]) from a meeting of the North-East England chapter of (ISC)2 [https://www.isc2.org/], where security experts from the region used the

Application security, design it in, or wedge it in at the end??

...security is rarely considered part of a minimum viable product.

Is your business unwilling to add security features to software?

I recently took part in a meeting of the North-East England chapter of (ISC)2 [https://www.isc2.org/], where security experts from the region used the world café conversational format to discuss a number of topics. I lead a table discussing secure software

My Path to CSSLP

A guide to how I got the CSSLP Certification, containing resources I used and what I experienced along the way.