This document discusses securing PHP environments and introduces PHPSecInfo, a tool for securing PHP development. It is presented by Ed Finkler, a PHP developer since 1999 who works at CERIAS at Purdue University. The document notes that PHP is very popular, powering over 34% of domains and many high-profile sites. However, PHP applications also represented a large portion of vulnerabilities in 2006 according to NIST data, demonstrating a need for tools that help secure PHP development.

1. Securing the
PHP Environment
with PHPSecInfo
Ed Finkler
coj@funkatron.com / @funkatron
www.cerias.purdue.edu / @cerias
20080724

2. Me and We
I'm a big dork
PHP dev since 1999
Secure PHP dev since 2003
Work for The Center for Education and Research in
Information Assurance and Security (CERIAS) @ Purdue
University - www.cerias.purdue.edu

3. The ubiquity of PHP
PHP is very, very popular
Nearly impossible to find a hosting service that doesn’t
support PHP in some form
About 34% of all domains report using PHP
PHP is very easy to learn
PHP provides results quickly
Time between setup and seeing results is very short

4. The ubiquity of PHP
PHP powers many busy, high-profile sites
Wikipedia
Facebook
Wordpress.com
Digg
Flickr
Yahoo!