Table Of Content

APEX Security - Preventing unauthorized access to your data Recx APEXConnect2015 [email protected] Preventingunauthorizedaccesstoyourdata Recx and APEX Security APEXSecurityConsultancyforUKGov. since2009. DevelopingApexSecproductsince2010. ContinualAPEXSecurityResearch(platform,samples,public applications). PresentingatvariousOUGconferencesinUKsince2012. Published"Hands-OnOracleApplicationExpressSecurity: BuildingSecureAPEXApplications"in2013. PresentedatODTUGKScope13inNewOrleans. PresentedatAPEXForuminVienna,2014. SponsoredAPEXWorldinNetherlands,2014. PresentedatODTUGKScope14inSeattle. [email protected] Preventingunauthorizedaccesstoyourdata Recx and APEX Vulnerabilities SQLInjection-wwv_flow_utilities.gen_popup_list (APEX<3.2.1,CVE-2010-0892). SQLInjection-ApplicationBuilder4000, (APEX<4.1,CVE-2011-3525). Cross-SiteScripting-Doubletagging (APEX<4.1.1,CVE-2012-1708). ItemProtection-Bypassvulnerability (APEX<4.2.1,CVE-2013-1519). ORDSURLRestrictionBypass (ORDS<2.0.8). SQLWorkshopPrivilegeEscalation (APEX<4.2.6,CVE-2014-6483). "WewouldliketorecogniseandthankRecxLtd. fortheuseoftheir ApexSecanalysisengine,whichhasbeenusedtoimprovethe securityofOracleApplicationExpress..."-Oracle [email protected] Preventingunauthorizedaccesstoyourdata Access-Control Inthissessionwearegoingtolookataccess-control-thisterm coversthefollowingareaswithinAPEXapplications: Apache/ORDS Authentication Authorisation ItemProtection [email protected] Preventingunauthorizedaccesstoyourdata Web Server & ORDS EnableSSLandonlyallowHTTPSconnections. Stripdowntheweb/applicationservers: Removefeatures,legacycontent,defaultfiles,admininterfaces... WebserverURLrestrictions: Allowonly/i/and/ords/,considermod_rewrite ORDSconfiguration: DefineinclusionList: f,p,z,wwv_*,apex* Databaseschemapermissions: ProcedureswithEXECUTEgrantedtoPUBLICcanbeaccessedvia thebrowser. [email protected] Preventingunauthorizedaccesstoyourdata Authentication DefineanAuthenticationScheme: ApplicationExpressAccounts-Usedforsmallerapplications andduringdevelopment. Custom-Mostcommon;ensurecodeisreviewed,operatesas expected,anditemsareprotected. LDAPDirectory-Widelyused,setUsernameEscapingto Standard. HTTPHeaderVariable-UsedinsomeSSOsolutions;prevent directHTTPaccess(spoofheader). OracleApplicationServerSingleSign-On-Neverobserved. Notrecommended: DatabaseAccounts NoAuthentication OpenDoorCredentials [email protected] Preventingunauthorizedaccesstoyourdata Authentication Anycustomauthenticationschemeshouldconsider: Accountsignupandactivation-whereanapplicationallows userstosignuptheiridentifyshouldbeverified,forexampleby sendinganactivationlinktotheiremailaddress. Accountlockout-anaccountshouldbetemporarilydisabled aftersuccessiveattemptstoauthenticationwithanincorrect password. [email protected] Preventingunauthorizedaccesstoyourdata Authentication Anycustomauthenticationschemeshouldconsider: Passwordstorage-ensureuserpasswordsarestoredusinga strongcryptographichashingalgorithm,saltedwitha user-specificvalue. Passwordcomplexity-dependingonthesensitivityofdata withintheapplicationandtheprivilegesoftheaccount,users mustbeforcedtochoosesuitablycomplexpasswords. Passwordage-usersshouldchangetheirpasswordsregularly. Passwordreset-whenusersforgettheirpasswords,anyreset mechanismmustverifytheiridentity(secretquestions,emaila resetlink). Considertwo-factorauthenticationforsensitiveapplicationsor transactions(token,SMS) [email protected] Preventingunauthorizedaccesstoyourdata Passwords Source: http://xkcd.com/936/ [email protected] Preventingunauthorizedaccesstoyourdata Authorisation ApplyauthorisationtoAPEXcomponentstoprovideRoleBased AccessControl. APEXpagesthatarenotlinkedtocanstillbeaccessed (sequentialURLpagenumbering). Watchoutforinconsistenciessuchasauthorisationschemes appliedtobuttonsandtheirassociatedprocesses. Authorisationinconsistencydemonstration... [email protected] Preventingunauthorizedaccesstoyourdata

Description:

Continual APEX Security Research (platform, samples, public applications). Presenting at various OUG conferences in UK since 2012. Published "Hands-On Oracle Application Express Security: Application Builder 4000,. (APEX

APEX Security - Preventing unauthorized access to your data PDF

26 Pages·2015·0.4 MB·English

Checking for file health...

Save to my drive

Quick download

Download

Download APEX Security - Preventing unauthorized access to your data PDF Free - Full Version

by Unknow| 2015| 26 pages| 0.4| English

Download APEX Security - Preventing unauthorized access to your data by in PDF format completely FREE. No registration required, no payment needed. Get instant access to this valuable resource on PDFdrive.to!

Free Download PDF

About APEX Security - Preventing unauthorized access to your data

Detailed Information

Author:	Unknown
Publication Year:	2015
Pages:	26
Language:	English
File Size:	0.4
Format:	PDF
Price:	FREE

Download Free PDF

Safe & Secure Download - No registration required

Why Choose PDFdrive for Your Free APEX Security - Preventing unauthorized access to your data Download?

100% Free: No hidden fees or subscriptions required for one book every day.
No Registration: Immediate access is available without creating accounts for one book every day.
Safe and Secure: Clean downloads without malware or viruses
Multiple Formats: PDF, MOBI, Mpub,... optimized for all devices
Educational Resource: Supporting knowledge sharing and learning

Frequently Asked Questions

Is it really free to download APEX Security - Preventing unauthorized access to your data PDF?

Yes, on https://PDFdrive.to you can download APEX Security - Preventing unauthorized access to your data by completely free. We don't require any payment, subscription, or registration to access this PDF file. For 3 books every day.

How can I read APEX Security - Preventing unauthorized access to your data on my mobile device?

After downloading APEX Security - Preventing unauthorized access to your data PDF, you can open it with any PDF reader app on your phone or tablet. We recommend using Adobe Acrobat Reader, Apple Books, or Google Play Books for the best reading experience.

Is this the full version of APEX Security - Preventing unauthorized access to your data?

Yes, this is the complete PDF version of APEX Security - Preventing unauthorized access to your data by Unknow. You will be able to read the entire content as in the printed version without missing any pages.

Is it legal to download APEX Security - Preventing unauthorized access to your data PDF for free?

https://PDFdrive.to provides links to free educational resources available online. We do not store any files on our servers. Please be aware of copyright laws in your country before downloading.

The materials shared are intended for research, educational, and personal use in accordance with fair use principles.