Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl-Sensitive Sunglasses
 
PerlMonks  

Re: Stay aware of security

by rpc (Monk)
on Mar 15, 2001 at 22:37 UTC ( #64744=note: print w/ replies, xml ) Need Help??


in reply to Stay aware of security

I fully agree; system and network security are of utmost importance, especially in a threat model which includes large loss of revenue.

However, most people think that security is reading about the latest exploits and techniques. This is not enough.

Security must be pro-active. Most public exploits have been known to the blackhat community for a very long time. Devise an overall security architecture that matches your threat model.

Also, I can't tell you how many times during a security audit I've compromised machines through finding holes in home grown code. Yes, worry about patching and maintaining your daemons, but damnit have someone security audit your source!

On the Perl front, CGI scripts tend to be the worst in security, and best in accesibility. This is due to the overwhelming amount of novice Perl coders who have web whacking jobs.

In particular, please, please, please: if you load a template or any dynamic content via a CGI script don't get the template or content filename from the client if you can help it. I have (legally) compromised dozens of websites using insecure template loading alone.

In short, audit your code!


Comment on Re: Stay aware of security

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://64744]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others avoiding work at the Monastery: (7)
As of 2014-11-27 12:19 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    My preferred Perl binaries come from:














    Results (184 votes), past polls