Suggestions
Sixto Pablo Martín García
Technical Program Manager
Sixto García is a highly skilled and experienced web developer, with a focus on PHP, Java, and Python/Django, CMS, database administration, and identity management, including SAML and Single Sign-on. He has worked with Open Source Software for many years and has contributed significantly to several projects, including the SAML PHP Toolkit, Java Toolkit, and Python Toolkit. At OneLogin, he served as a Senior Software Engineer and previously as a Lead Toolkit Developer and SAML Engineer. Sixto's background includes a Bachelor's degree in Computer Science and Software Engineering from the University of Seville. He is also proficient in systems integration, REST APIs, project management, and e-learning.
Highlights
It makes me really sad each time I read about the Golder/Silver SAML attack technique from people/companies working in the "cybersecurity" area.
Private Keys used to sign SAML Messages or to Decrypt SAML elements MUST be managed safely and can't be exposed in any way and protect them should be priority 1. You need to monitor any possible access to them and warn any third party trusting its related public cert if they are compromised. Similar to changing passwords in any system, if you were reusing it (badly done) if your password somehow got leaked.
Do we also need to warn people that if the private key used in HTTPs is exposed, anyone can set an MITM attack and read their traffic?
Wonder what? The "Private" of the "Private Key" means that it needs to be kept secret and should not be exposed. In SAML, it is like the master password used to encrypt the password you store in a Secret Manager/ Password Storage service. If you get it, you have access to any secret related to that master password, and then you can use them to gain access to apps.
Are we adopting clickbait also in this area? If so, let me introduce the Bronze SAML attack technique:
Bronze SAML attack consists of, through social engineering, making the service provider's system administrator believe that you are the system administrator of the IdP and that you are going to rotate the key/cert of the Identity Provider in a couple of days, and you send an attached public cert that should be registered. If you manage to deceive the app's administrator and the public key starts to be trusted by the app, you will now be able to enter the app by generating SAML messages and signing them with the related private key you possess, impersonating anyone on the app related to that IdP.
#bronze #saml #cybersecurity
Workato is #hiring! We're looking for a new teammate based in India to join our team.
At Workato, ensuring our services are always available, reducing the number of incidents, and providing top-notch support to our customers is crucial. It's no surprise that Workato has earned numerous awards for our dedication to excellence:
- APPEALIE SaaS Awards https://lnkd.in/d4mn-vH3
- Workato Leads G2 IPAAS Ranking https://lnkd.in/dYqQd8b5
- Gartner Magic Quadrant Leader https://lnkd.in/dK_JAdv7
The role of Customer Centric Engineer is a key position in our company. If you are proficient in Ruby & Rails, have experience integrating APIs, excel at troubleshooting, have empathy, and can handle pressure, this position could be yours!
- Bangalore. https://lnkd.in/dVJgKSDm
- Hyderabad. https://lnkd.in/dDPuZjag
P.S. This role requires working American hours (9:00 am - 6:00 pm PDT)
Looking forward to your application!
