InformationSecurity

KO | EN

gitlite — search

#javascript #react #go #machine-learning #deep-learning #linux #macos #nodejs #cli #awesome-list #pytorch #security #openai #mcp

InformationSecurity

(★ 8)

App security is one of my key aspect of any application. In last few years my focus on security is gone up. Tons of learning and exciting experiments.

InformationSecurity Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

OWASP AppSec Pipeline

Security testing tools
There is eight security tool categories:
source code analyzers,
web application (black-box) scanners,
database scanners,
binary analysis tools,
runtime analysis tools,
configuration management tools,
HTTP proxies,
miscellaneous tools.

http://slideplayer.com/slide/6869389/

https://www.checkmarx.com/wp-content/uploads/2016/02/Requirement.png

https://www.owasp.org/images/5/58/OWASP_ASVS_Version_2.pdf
https://www.checkmarx.com/2016/02/05/5-best-practices-perfect-secure-code-review/
http://slideplayer.com/slide/6869389/
https://www.slideshare.net/ajin25/g4h-webcast-automated

Very good one with action items
https://www.sans.org/reading-room/whitepapers/application/framework-secure-application-design-development-842

# Information Security

Cyber Security vs. Information Security
Cyber security and information security aren’t different at all, but are related to each other in much the same way that the wider field of “science” is related to the practice of chemistry.

Cyber security is a broad practice, demanding mastery of a number of unique skills in computational theory and practice from its most effective practitioners. Ensuring that servers, intranets, and channels built for data transfer remain protected and accessible to only those permitted, for example, falls under the realm of “information security”. While some cyber security professionals may specialize in this area, this is only one of the many dimensions of the field.

Information security can be simply defined as “the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability.” Any point of data storage and transfer is considered to be an “information system”, which means this practice can apply to a wide variety of different environments, including those outside cyberspace.

Network security is another division within cyber security, focusing on data leaving or entering a device through an established network of computers and servers. Experts in network security monitor countless interactions between networked computers and other machines to make sure their connections are protected.

# Information Security
Umbrella covering everything to do with information security. InfoSec specialists cover a wide range of topics and are skilled generalists. In a big company setup, they are your CISOs and managers. In a smaller company, they are your practitioners.

# Application Security
Related more to software design and programming. AppSec specialists are familiar with programming and tend to focus on secure application design.

# Network Security
Firewalls, IDS, VPNs; practitioners understand lots of application-specific protocols. Anything that flows through a router is in their world.

# IT Security
Host-based security, domain controllers / auth servers, mandatory access controls systems. ITSec is focused inside of the system.

# Cyber attacks or Threats:
**Backdoors** – Backdoor is a kind of cyber threat in which the attacker uses a back door to install a keylogging software, thereby allowing an illegal access to your system. This threat can turn out to be possibly severe as it allows for modification of the files, stealing information, installing undesired software or even taking control of the entire computer.

**Spoofing** – Spoofing is another type of cyber attack where an individual or a program represent another by creating fake data to gain illegal access to a system. Such threats are commonly found in emails where the sender’s address is spoofed.

**Bots** – Bots is a type of software application that runs mechanized tasks which are simple and constant in nature. Bots may or may not be malicious, but they are usually found to initiate a DoS attack or a click scam while using the internet.

**Tampering** – Tampering is a web-based attack where certain parameters in the URL are changed without the consumer’s knowledge; and when the customer keys in that URL, it looks and appears the same. Tampering is done by hackers and criminals to steal the identity and obtain illegal access to information.

# Security Organization
* SANS Institute
* OWASP

# Tools
* **Threat Modelling** – MS TMT 2016
* **Static Code Analysis** – PMD, CheckMarx, Coverity, Fortify, Findbugs, Checkstyle
* **Vulnerability Scanner** – Arachni, Nikto, Nessus
* **Packet Sniffing & Replay** – TCPDUMP, Nmap, Tshark, Wireshark
* **Penetration Testing** – Metasploit, OpenVas, ZAP, Kali Linux
* **REST API** – Postman, SOAPUI
* **Web Application Security** – Burpsuite, SQLMap, SQLInjectMe, XSSME, TamperData, commix, Nmap, Zenmap, Hydra, Fiddler, Watobo, SSLScan
* **Encryption & Cipher Test** – GnuGPG, Bitlocker, Openssl, AES Online, md5sum

# Software security testing cover the following areas
* Penetration testing
* Network and port scanning
* Authentication and authorization exploits
* Cross-site scripting exploits
* Session hijacking
* DNS poisoning

# Key Terms
* Threats
* [Attacks](https://www.owasp.org/index.php/Category:Attack)
* [Vulnerabilities](https://www.owasp.org/index.php/Category:Vulnerability)
* Countermeasures

# [STRIDE Explained](http://shapingsoftware.com/2008/03/30/stride-explained/)
Spoofing user identity.
Tampering with data.
Repudiation.
Information disclosure.
Denial of service.
Elevation of privilege.

# Security testing
* Dynamic testing of web applications against major types of attacks: XSS, SQL Injection, buffer overflows, manipulations of the address bar and source code revealing
* Intrusion (penetration) tests (access control, authentication, input validation, cryptography reliability, error handling)
* Testing of payment mechanisms in different web systems
* Vulnerability testing of system's third-party components
* Security code audit (use of static code analysis tools, manual review of major components of the system, recommendations on improvements, patches, security alerts)
* Server configuration testing (search for errors in multithreaded environments that allow data to be shared or corrupted)

10 Steps To Kickstart Your Web Application Security Career 
https://dzone.com/articles/10-steps-to-kickstart-your-web-application-securit

Detect & fix security vulnerabilities, problematic open source licenses.
https://marketplace.visualstudio.com/items?itemName=whitesource.ws-bolt

What Is Server-Side Request Forgery (SSRF)?
https://dzone.com/articles/what-is-server-side-request-forgery-ssrf?

http://shapingsoftware.com/2009/03/09/security-hot-spots/

http://testingrants.blogspot.in/2017/03/some-security-podcasts-i-like.html

OWASP
https://drive.google.com/file/d/0BxOPagp1jPHWYmg3Y3BfLVhMcmc/view
![1](https://www.owasp.org/index.php/OWASP_Mobile_Security_Project

https://f5.com/about-us/blog/articles/web-fraud-solutions-for-the-ever-growing-malware-threat-19857

# Practice InfoSec Skills
https://www.checkmarx.com/2015/04/16/15-vulnerable-sites-to-legally-practice-your-hacking-skills/
https://www.checkmarx.com/2015/11/06/13-more-hacking-sites-to-legally-practice-your-infosec-skills/

# Follow Leader
https://www.checkmarx.com/2015/08/28/15-devops-and-security-experts-you-should-be-following-on-twitter/
https://www.checkmarx.com/2015/05/21/2015052129-cyber-security-blogs-you-should-be-reading/

# Seucity & DevOps
https://www.checkmarx.com/2015/06/22/21-awesome-talks-and-resources-on-security-and-devops/

http://www.veracode.com/sites/default/files/Resources/Whitepapers/ultimate-guide-to-getting-started-with-appsec-veracode.pdf
# 
* [Web Application Security Testing Resources](https://danielmiessler.com/projects/webappsec_testing_resources/#wahhcl)

http://www.hongkiat.com/blog/google-play-gooligan-malware/
http://www.cyberdatainc.com/cyber-security
http://shapingsoftware.com/2008/03/30/stride-explained/
http://shapingsoftware.com/2008/04/13/secure-your-network-host-and-application/
http://shapingsoftware.com/2008/04/07/security-principles/
http://www.precisetestingsolution.com/wp-content/uploads/Precise-Testing-Solution-Security-Testing-Checklist.pdf
http://shapingsoftware.com/2008/04/07/security-frame/
http://tuppad.com/blog/wp-content/uploads/2012/03/WebApp_Sec_Testing_Checklist.pdf
https://www.sans.org/reading-room/whitepapers/securecode/security-checklist-web-application-design-1389
https://code.google.com/archive/p/owasp-testing-checklist/
https://code.google.com/archive/p/owasp-testing-checklist/downloads
https://web.byu.edu/wiki/web-application-security-checklist
http://www.guru99.com/complete-web-application-testing-checklist.html
https://www.cybrary.it/0p3n/penetration-testing-checklist/
http://apps.testinsane.com/mindmaps/Uploads/Web%20Security%20Testing%20Part%20I.png
https://www.owasp.org/index.php/OWASP_Testing_Project
http://securitywing.com/63-web-application-security-checklist-auditors-developers/
Getting Started with Security Testing
https://www.soapui.org/security-testing/getting-started.html
http://www.securityinnovationeurope.com/blog/what-is-application-threat-modeling
https://www.sans.org/reading-room/whitepapers/hsoffice/designing-implementing-effective-information-security-program-protecting-data-assets-of-1398
https://www.tutorialspoint.com/security_testing
* [OWASPv4_Checklist.xlsx](https://github.com/tanprathan/OWASP-Testing-Checklist)
* [OWASPTestingChecklist_v_1.0.xls](https://github.com/rajivvishwa/owasp-testing-checklist/blob/master/OWASPTestingChecklist_v_1.0.xls)
* [OWASP Mantra](https://www.youtube.com/user/Getmantra/videos)
* [OWASP Project](https://www.owasp.org/index.php/Category:OWASP_Project)
* [IOS Application Security Testing Cheat Sheet](https://www.owasp.org/index.php/IOS_Application_Security_Testing_Cheat_Sheet)
* [Software Security Testing](http://www.slideshare.net/srivinayak/software-security-testing-18056466)

http://shapingsoftware.com/2008/03/30/threats-attacks-vulnerabilities-and-countermeasures/
# Test Web Practice
* [OWASP Mutillidae II](Web Pen-Test Practice Application)
* [Read about OWASP Mutillidae II Web Pen-Test Training Environment](https://www.sans.org/reading-room/whitepapers/testing/introduction-owasp-mutillidae-ii-web-pen-test-training-environment-34380)

# Image speak louder than words
http://image.slidesharecdn.com/rss2010-s14-ucedavelezapplication-threat-modeling-101024185548-phpapp01/95/application-threat-modeling-38-638.jpg
https://media.licdn.com/mpr/mpr/p/5/005/051/39d/319d58e.jpg
http://2we26u4fam7n16rz3a44uhbe1bq2.wpengine.netdna-cdn.com/wp-content/uploads/2-9.png
https://media.licdn.com/mpr/mpr/p/5/005/051/39e/1cfaaa9.jpg
https://media.licdn.com/mpr/mpr/p/5/005/051/39e/3747637.jpg
http://www.taosecurity.com/images/vulnerability-threat_pairs.png
http://player.slideplayer.com/22/6405319/data/images/img16.png
http://image.slidesharecdn.com/owaspocsept17presentationvs10reduced-091030221445-phpapp01/95/security-compliance-web-application-risk-management-34-728.jpg?cb=1258273619
http://2.bp.blogspot.com/-ZbvSKb6_n00/Upmte-znE9I/AAAAAAAAABc/kiZnBw4Oizw/s400/security.png

http://www.guidanceshare.com/images/7/7e/DatabaseServerThreatsAndVulnerabilities.gif
### Threats / Attacks
http://www.guidanceshare.com/images/d/d4/InternetWebtoDatabaseThreats.gif

### Vulnerabilities
http://www.guidanceshare.com/images/b/bd/InternetWebToDatabaseVulnerabilities.gif

### Database Server Threats/Attacks and Vulnerabilities
http://www.guidanceshare.com/images/7/7e/DatabaseServerThreatsAndVulnerabilities.gif

### Library Threats/Attacks and Vulnerabilities
http://www.guidanceshare.com/images/f/fe/LibraryThreatsAndVulnerabilities.gif

### Web Application Threats/Attacks and Vulnerabilities
http://www.guidanceshare.com/images/7/75/WebAppThreatsAndVulnerabilities.gif

### Web Server Threats/Attacks and Vulnerabilities
http://www.guidanceshare.com/images/2/28/WebServerThreatsAndVulnerabilities.gif

Thanks to J.D. Meier-He is Awesome

# Tools
http://sectools.org/

http://www.praxiom.com/iso-27001-sample.pdf
https://github.com/OWASP-Foundation/Project-Handbook
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/image_data/file/35290/common_cyber_attacks.png
![1](http://qamentor.com/wp-content/uploads/2014/05/security-testing-methodolgy-1_big.jpg)
![1](http://qamentor.com/wp-content/uploads/2014/05/security-testing-methodolgy-2_big.jpg)
![1](http://qamentor.com/wp-content/uploads/2014/05/security-testing-methodolgy-3_big.jpg)
![1](http://image.slidesharecdn.com/softwaresecuritytesting-130402094400-phpapp01/95/software-security-testing-4-638.jpg)
![1](http://image.slidesharecdn.com/softwaresecuritytesting-130402094400-phpapp01/95/software-security-testing-6-638.jpg)
![1](https://s-media-cache-ak0.pinimg.com/originals/df/03/39/df03397afae18eaa51bc188a362b57b0.jpg)
![1](https://s-media-cache-ak0.pinimg.com/564x/27/41/7c/27417c15236d5b9aa63bbd09ad28d123.jpg)
![1](http://www.rfwireless-world.com/images/security-testing-types.jpg)
![1](http://synerzip.com/wp-content/uploads/2013/04/Security-testing-offerings-624x419.jpg)
![1](http://www.evers.com.vn/images/security_testing.jpg)
![1](https://orafw.com/wp-content/uploads/2016/04/article-1341142-0C926C10000005DC-822_634x286.jpg)
![1](http://www.industrial-ip.org/~/media/Images/Padilla%20Images/Security%20article%201.ashx)
![1](http://www.industrial-ip.org/~/media/Images/Padilla%20Images/Security%20article%202.ashx)
![1](https://www.mastercard.us/content/dam/mccom/en-us/icons/infographic-pci-compliance.png)

http://image.slidesharecdn.com/owaspocsept17presentationvs10reduced-091030221445-phpapp01/95/security-compliance-web-application-risk-management-34-728.jpg?cb=1258273619

![1](https://www.cigital.com/wp-content/uploads/2015/09/Cigitals-Software-Security-Touchpoints.png)
![1](http://image.slidesharecdn.com/softwaresecuritytesting-130402094400-phpapp01/95/software-security-testing-4-638.jpg)
![1](http://image.slidesharecdn.com/softwaresecuritytesting-130402094400-phpapp01/95/software-security-testing-6-638.jpg)
![1](https://s-media-cache-ak0.pinimg.com/originals/df/03/39/df03397afae18eaa51bc188a362b57b0.jpg)
![1](https://s-media-cache-ak0.pinimg.com/564x/27/41/7c/27417c15236d5b9aa63bbd09ad28d123.jpg)
![1](http://www.rfwireless-world.com/images/security-testing-types.jpg)
![1](http://synerzip.com/wp-content/uploads/2013/04/Security-testing-offerings-624x419.jpg)
![1](http://www.evers.com.vn/images/security_testing.jpg)
![1](https://orafw.com/wp-content/uploads/2016/04/article-1341142-0C926C10000005DC-822_634x286.jpg)
![1](http://www.industrial-ip.org/~/media/Images/Padilla%20Images/Security%20article%201.ashx)
![1](http://www.industrial-ip.org/~/media/Images/Padilla%20Images/Security%20article%202.ashx)
![1](https://www.mastercard.us/content/dam/mccom/en-us/icons/infographic-pci-compliance.png)

![1](https://s-media-cache-ak0.pinimg.com/736x/06/13/f1/0613f1a0e1af6b5c4fe0ba1df097a5f3.jpg)
![1](https://www.owasp.org/images/thumb/5/55/AppSec-Pipeline-Example.png/800px-AppSec-Pipeline-Example.png)
![1](https://www.ibm.com/devops/method/images/experiences/development-pipeline-breakdown-diagram.png)
![1](https://www.ibm.com/developerworks/community/blogs/invisiblethread/resource/BLOGS_UPLOADED_IMAGES/523blog.jpg)
![1](https://www.qa.com/-/media/qa/blogs/devops-pipeline.png?la=en)
![1](https://www.owasp.org/images/thumb/9/9a/AppSec_Pipeline_Rugged_DevOps.png/800px-AppSec_Pipeline_Rugged_DevOps.png)

InformationSecurity

InformationSecurity Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

InformationSecurity

InformationSecurity Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README