The unfortunate truth about networked applications is that an attacker only needs to know one thing you didn't know to get past your defenses. You need to know everything, they don't.
The odds aren't in your favour. You're eventually going to get hacked.
That's the bad news. But if you stop thinking about a security compromise as that thing you close your eyes and hope never happens", and instead start thinking about it as an inevitability, then you can start making better security decisions.
"If they compromise my web servers, how do I protect my application servers?"
"If they break my application server code, how can I prevent them from gaining a foothold on my infrastructure?"
"If they poison my web-site with cross-site scripting, how do I find out before my users get hurt?"
In short: "If I’m going to get hacked, how do I make it hurt less?"
This is a talk about defense in depth.
Building a secure system isn’t about luck, it’s about planning.
Tom Eastman is a developer, sysadmin, and teacher. He is a lead consultant for SafeStack Limited, a specialist security company that weaves secure best-practices into agile and fast growing organisations. Prior to that he was a technical lead and architect for Catalyst, New Zealand's largest company specialising in open source technology.
Geelong is Victoria's second largest city, located on Corio Bay, and within a short drive from popular beach-front communities on the Bellarine Peninsula as well as being the gateway to the famous Great Ocean Road
linux.conf.au is widely regarded by delegates as one of the best community run Linux conferences worldwide and is the largest Linux and Open Source Software conference in the Asia-Pacific.
Our Sponsors help make linux.conf.au become the awesome conference everyone comes back to year after year. Come see who's on board this year, or find out how to get in contact with us