The Tangled Web

Security in the World of Web Applications
1. History of the Web
  1. GML
    1. IBM's Generalized Markup Language
      1. "this is a header", "this is a list"
    2. SGML
      1. Standard Generalized Markup Language
      2. HTML
        Focused on simplicity
        Tim Berners-Lee and Dan Connolly
        HyperText Markup Language
        HTTP
        HyperText Transfer Protocol
        Dedicated scheme for accessing HTML resources using TCP/IP, DNS and file pathes concepts
        Tim's WWW Project
        Nota:
        World Wide Web
        1991-1993
        A browser that parsed HTML and allowed navigation from one page to another
        Tim Berners-Lee
        Mosaic Web Browser
        Netscape Navigator
        Spyglass Mosaic
        Microsoft Internet Explorer
    3. 1960's
  2. Microsoft XMLHttpRequest
    1. Web 2.0
  3. W3C - WWW Consortium
2. Risk Management
  1. CWE
    1. Homeland Security
    2. Common Weakness Enumeration
    3. "Provide a common language"
  2. CVSS
    1. Common Vulnerability Scoring System
      1. method to quantify and score a vulnerability based on risk
  3. probability * maximum loss = risk
Anatomy of the Web
1. URLs
2. HTTP
3. HTML
4. CSS
5. Browser Scripts
6. Doc Types
7. Plug-ins
Browser Security
1. Content Isolation
2. Origin Inheritance
3. Outside Same-Origin
4. Other Boundaries
5. Content Recognition
6. Rouge Scripts
7. Site Privileges
Future
1. New Security Features
2. Other Browser Mechanisms
3. Common Web Vulnerabilities

Resumen del Recurso

	Creado por Ron Kuper hace más de 9 años