Thursday
Room 3
16:20 - 17:20
(UTC+01)
Talk (60 min)
BOLA, BOPLA, and BFLA: Let’s get rid of broken authorization!
Broken authorization is one of the most common vulnerabilities found in IT-systems.
This talk will dive into three vulnerabilities:
- BOLA (Broken Object Level Authorization)
- BOPLA (Broken Object Property Level Authorization)
- BFLA (Broken Function Level Authorization)
Why are these three vulnerabilities all in the top five from OWASP Top 10 API? Why are these some of the most common security mistakes a developer makes? How do we systematically protect against them and drastically reduce our attack surface? These are all questions that will be answered in this talk.
Through code examples of both good and bad code we will increase our understanding of how we effectively implement authorization. Fixing these vulnerabilities can actually be quite easy with good design patterns that factors in security at all levels of the application.
Eivind Jahr Kirkeby
Eivind is a developer and an application security expert. At Omegapoint Norge he works as Head of Cybersecurity and helps customers with their security concerns. He has extensive experience in crafting secure applications, and reviewing applications for security.