I know not all (or even that many) of our members develop extensions for Joomla, but understanding security and its threats can be valuable anyway. Implemented improperly, PHP can become a threat to your site. Our speaker this month will enlighten us.
PHP is a very powerful language for easily developing web applications however with this power comes great responsibility ... and in this case that means not shooting yourself in the foot with lax security practices. Issues can arise from everything from language vulnerabilities and weak default settings to insecure coding practices and misconfigurations. This presentation plans to address many of these concerns by providing valuable lessons in the security of, attacks against, and management of PHP in your environment. The talk begins with an overview of PHP security, including it's known issues and corresponding security enhancements the maintainers have incorporated over time. Beginning with an in-depth discussion of Suhosin and how it can be used to lock down your PHP environment, the presentation next details PHPIDS and how it can be used to detect PHP-centric threats. The talk closes with a strategy for analyzing the risks in your PHP environment and applying corresponding PHP and platform/network mitigations to minimize your attack surface.
The speaker is Salvador Grec, who has over 17 years experience, undergraduate and graduate degrees in Electrical Engineering, and a really well known security certification. Even though his training was in Electrical Engineering, Salvador has always been more of a Computer Science person at heart going back to his VIC-20, Commodore 64, and high school computer club days. After doing the IT grind for 5 years, he discovered his love of infosec and has been pursuing this career ever since. Currently, he spends his days doing cyber security paperwork drills in building and maintaining multi-billion dollar government systems. At night he runs NovaInfosec.com, a local infosec website and tries to get some hands-on skillz.
Here is the GoToMeeting Information, in case you can't make it:
Please join my meeting, Thursday, October 18, 2012 at 7:00 PM Eastern Daylight Time.
2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (312)[masked]
Audio PIN: Shown after joining the meeting
Online Meetings Made Easy™