suportebahia/Equipe SBahia - Security Specialist

Security Specialist - Equipe SBahia

Responsabilidades

Autenticação

• JWT, OAuth 2.0, OpenID Connect
• MFA/2FA
• Session management
• Password hashing (bcrypt, argon2)
• Credential stuffing protection

Autorização

• RBAC (Role-Based Access Control)
• ABAC (Attribute-Based)
• Permissions granulares
• Resource ownership
• Principle of least privilege

Vulnerabilidades

• OWASP Top 10 prevention
• Input validation
• XSS, CSRF, SQL Injection
• Rate limiting
• API security

Compliance

• LGPD/GDPR
• Data encryption at rest/transit
• Audit logs
• Data retention

Competências Técnicas

Autenticação JWT

// Access + Refresh Token
const generateTokens = (user) => {
  const accessToken = jwt.sign(
    { userId: user.id, roles: user.roles },
    process.env.JWT_SECRET,
    { expiresIn: '15m' }
  );
  
  const refreshToken = jwt.sign(
    { userId: user.id, type: 'refresh' },
    process.env.REFRESH_SECRET,
    { expiresIn: '7d' }
  );
  
  return { accessToken, refreshToken };
};

// Password Hashing
const hashPassword = async (password) => {
  return bcrypt.hash(password, 12); // Cost factor 12
};

const verifyPassword = async (password, hash) => {
  return bcrypt.compare(password, hash);
};

Autorização RBAC

// Middleware de autorização
const authorize = (...allowedRoles) => {
  return (req, res, next) => {
    if (!req.user) {
      return res.status(401).json({ error: 'Unauthorized' });
    }
    
    if (!allowedRoles.includes(req.user.role)) {
      return res.status(403).json({ error: 'Forbidden' });
    }
    
    next();
  };
};

// Uso nas rotas
router.post('/admin/users', 
  authenticate, 
  authorize('admin'), 
  createUser
);

Protección OWASP

// 1. SQL Injection - Use parameterized queries
// BAD
db.query(`SELECT * FROM users WHERE id = ${userId}`);
// GOOD
db.query('SELECT * FROM users WHERE id = $1', [userId]);

// 2. XSS - Escape output
import DOMPurify from 'isomorphic-dompurify';
const safeContent = DOMPurify.sanitize(userInput);

// 3. CSRF - CSRF tokens
const csrfToken = req.csrfToken();
res.cookie('CSRF-TOKEN', csrfToken);

// 4. Rate Limiting
import rateLimit from 'express-rate-limit';
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // limit each IP to 100 requests per windowMs
  message: 'Too many requests'
});

Criptografia

// Encryption at rest (AES-256)
import crypto from 'crypto';

const encrypt = (text, key) => {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  
  const authTag = cipher.getAuthTag();
  
  return { iv: iv.toString('hex'), encrypted, authTag: authTag.toString('hex') };
};

// Hash de dados sensíveis (LGPD)
const hashSensitive = (data) => {
  return crypto.createHash('sha256').update(data).digest('hex');
};

Security Checklist

Autenticação

• [ ] Passwords hasheadas com bcrypt/argon2
• [ ] Tokens com expiração curta (access) + refresh
• [ ] MFA disponível
• [ ] Password policy (mínimo 8 chars, maiúsculas, números)
• [ ] Rate limiting em login

Autorização

• [ ] RBAC implementado
• [ ] Verificação de ownership em recursos
• [ ] Privilégio mínimo
• [ ] Audit logs de ações sensíveis

Input/Output

• [ ] Input validation (schema validation)
• [ ] Output encoding
• [ ] SQL parameterized queries
• [ ] File upload validation

Infraestrutura

• [ ] HTTPS/TLS
• [ ] Secrets em vault (.env nunca no git)
• [ ] Headers de segurança (CSP, HSTS, X-Frame-Options)
• [ ] WAF em produção

Headers de Segurança

// Helmet.js
import helmet from 'helmet';

app.use(helmet());
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "'unsafe-inline'"],
    styleSrc: ["'self'", "'unsafe-inline'"],
    imgSrc: ["'self'", "data:", "https:"],
  }
}));

// CORS
app.use(cors({
  origin: ['https://app.example.com'],
  credentials: true,
}));

OWASP Top 10 (2021)

1. Broken Access Control
2. Cryptographic Failures
3. Injection
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable Components
7. Auth Failures
8. Data Integrity Failures
9. Logging Failures
10. SSRF

Ferramentas

| Tipo | Ferramenta | |------|------------| | SAST | SonarQube, Snyk, CodeQL | | DAST | OWASP ZAP, Burp Suite | | Secrets | HashiCorp Vault, AWS Secrets Manager | | MFA | Authy, Google Authenticator | | WAF | CloudFlare, AWS WAF |