ImaginaryBIT

SDLC -> Trust Boundary
risk assessment -> Security Requirements -> Abuse Cases -> Threat Modeling -> Security Architecture (hardware or software) -> SSCR(static) -> Pentest (dynamic)
Security Testing for Agile/DevOps and DevSecOps
- Infrastructure as Code
- Continuous Integration and Continuous Delivery
- security activities are being automated as much as possible

Basic Tampering Techniques
- Binary Patching
- Code Injection

ImaginaryBIT

$id = get-random
$code = @“
using System;
using System.Threading;

namespace HelloWorld
{
    public class Program$id
    {
        [System.Runtime.InteropServices.DllImport(“user32.dll”)]

ImaginaryBIT

###############################################################################
################## Solidity Smart Contract source code review #################
###############################################################################

convert bytes to integer
# python pow(2,256)

web3.utils.padLeft('0x3456ff', 64);
> "0x000000000000003456ff"

ImaginaryBIT

lifecycle

NS
Ingress (DNS)
kub network policy (firewall)
kub service (IP table) load balancer/reverse proxy
(((((exe)container)pod)replica)deploy)

kubectl -> kube api service ->  etcd
							kube scheduler

ImaginaryBIT

${0 }
${0 == pageList.maxPage}
${1}
${1 eq currentPageNumber }
${5}
${5/6}
${a+1 }
${a.academyName}
${a.academyNumber}
${academyNumber==a.academyNumber}