Defense-in-Depth Engineering

The talk starts from the 2021 OWASP Top Ten's Insecure Design category and argues that defense in depth has to be designed in from the start. The speaker, a product security manager at GitHub, begins with incident response: knowing which sensitive data a system handles, documenting data flows, and agreeing with responders on what to log and how long to keep it. He also covers self-service audit logging for customers and treating every state-changing request as something that must leave an accountable record.

The middle section looks at preventing regressions after an incident. Root cause and variant analysis should turn findings into tests, ideally unit tests close to the logic, with permutations of encoded payloads. Extensibility is next: parameterized queries cannot cover table names, so an allow list enforced by a before filter is a sturdier choice, and insecure exceptions should be annotated so they can be audited. A strict site-wide Content Security Policy with per-page exceptions is presented as a practical way to shrink script-source risk.

The final section covers XSS edge cases that often slip past reviews, including attribute injection, unquoted attributes, WAF bypasses, and HTML-safe opt-outs. Using DOMPurify with default settings is shown to allow many tags, attributes and event-driven behaviors, so teams should learn what their sanitizer permits. The takeaways are to design for incident response, convert incidents into tests, plan exceptions, and understand third-party libraries.