The What, Why and How of Software Security : Security Conference/ Workshop

TechNet Webcast: Configuring with Least Privilege in SQL Server 2008

Varun Sharma — Sat, 20 Jun 2009 23:00:09 GMT

I recently presented a TechNet Webcast on the topic “Configuring with Least Privilege in SQL Server 2008”.

The topics covered in the Webcast are:-

1. Configuring SQL Server service accounts with least privilege. Service isolation is also explained.

2. Configuring accounts connecting to SQL Server from a Web application (Principals) with least privilege.

3. Running xp_cmdshell with a proxy so that the account invoking xp_cmdshell need not be a sysadmin.

4. Running SQL Server jobs with least privilege.

The Webcast can be viewed here:-

http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?culture=en-US&EventID=1032415807&CountryCode=US

Virtual techdays: Top 5 Web Application security bugs in custom code

Varun Sharma — Mon, 16 Feb 2009 07:23:00 GMT

Microsoft Virtual TechDays is starting from the 18th February 09. In the security track, I will be presenting on the topic “Top 5 Web Application Security bugs in custom code”. As a security engineer in the ACE Team, I have been reviewing line-of-business applications for the past two years. In this presentation, I will talk about the most common security mistakes that developers make while writing code. Since developers from various geographical locations tend to make the same mistakes, the audience can take back a lot of practical knowledge and apply it to secure their applications.

NASSCOM – DSCI Information Security Summit 2008 Security Tutorial

Varun Sharma — Mon, 24 Nov 2008 14:38:13 GMT

My colleague Sagar and I will be conducting an application security workshop at the NASSCOM – DSCI Information Security Summit 2008 on the 1st December in IIIT, Hyderabad, India.

More information can be found here:-

http://www.nasscom.in/Nasscom/Templates/CustomEvents.aspx?id=55164

The agenda is here:-

http://www.nasscom.in/upload/59314/Agenda_Tutorial.pdf

ClubHACK 2007: I will be presenting some “Subtle Security Flaws”

Varun Sharma — Mon, 26 Nov 2007 14:52:00 GMT

In its own words, "ClubHACK is one of its kind hacker's convention in India which serves as a meeting place for hackers, security professionals, law enforcement agencies and all other security enthusiasts."

At ClubHACK, I will talk about some interesting and subtle security flaws found while assessing business applications, which principles were not followed that resulted in the flaws and why, no matter how good a developer you are, you should always follow the basic principles of software security.