39 lines
3.2 KiB
Markdown
39 lines
3.2 KiB
Markdown
# Subjects (2024-11-04)
|
|
|
|
1. Understanding web vulnerabilities
|
|
- Exploration areas:
|
|
1. Analyze specific vulnerabilities such as SQL injection, XSS, RCE, and zero-day vulnerabilities. How they are discovered, and their implications for web security.
|
|
2. Advanced persistent threats and how over time they target the web, as well as how they are mitigated.
|
|
- Improvement opportunities:
|
|
1. Security research and reporting, Understand how security research is conducted and how it is reported.
|
|
2. Understand how to detect and mitigate web vulnerabilities.
|
|
2. Dynamic security testing
|
|
- Exploration areas:
|
|
1. Understand how fuzzing works, fuzzing techniques, and how fuzzing can be used to detect web vulnerabilities by passing random data to inputs.
|
|
2. Explore how behavioural analysis can be used to detect anomalies in web application traffic which may indicate an attack.
|
|
- Improvement opportunities
|
|
1. By understanding how fuzzing works, we can implement a fuzzer helping to detect anomalies, edge cases, and unexpected behaviours.
|
|
2. Implement an anomaly detection system using statistical methods or machine learning to monitor and report web traffic in real-time.
|
|
3. Secure software and library development
|
|
- Exploration areas:
|
|
1. Explore how security can be incorporated in the development lifecycle of a library and software, and how to incorporate best security practices at all stages from planning to deployment.
|
|
2. Understand how to model threats and mitigate your threats. Understand modeling strategies and how to detect potential threads early in the development process.
|
|
- Improvement opportunities
|
|
1. Create a comprehensive security checklist tailored for projects using various libraries.
|
|
2. Organise best security models and thread analysis for secure programming and practices in future projects.
|
|
4. Cryptography in web security
|
|
- Exploration areas:
|
|
1. Understand and investigate how modern web applications utilise web cryptography APIs and how they can be used for secure and private communication between the server and client.
|
|
2. Explore the implications of quantum computing on current cryptographic practices and what future-proofing measures can be taken.
|
|
- Improvement opportunities
|
|
1. Understand how connections can be secure on a low-level using things like TLS.
|
|
2. Research post-quantum cryptography and implications for modern applications.
|
|
5. Ethical hacking methodologies
|
|
- Exploration areas:
|
|
1. Understand how red team vs. blue team strategies can be applied to enhance web security in various web contexts such as APIs, renderers, and server software.
|
|
2. Learn about different methodologies used in penetration testing, including reconnaissance, scanning, exploitation, and reporting.
|
|
- Improvement opportunities
|
|
1. Engage in red/blue team exercises after understanding the methodologies, trying to explore best practices in coding to protect yourself from threats.
|
|
2. After conducting tests, create detailed reports outlining findings, methodologies used, and recommended mitigations.
|
|
|
|
We ended up choosing #3 during our meeting at 2024-11-04.
|