webappsec.dev

$less ~/slides/security-signals

// deck 03 · NDSS MADWeb

Security Signals

Making Web Security Posture Measurable At Scale

NDSS MADWeb · San Diego · 2025· 41 slides· Michele Spagnuolo, David Dworken, Artur Janc, Sal Díaz, Lukas Weichselbaum

pdf ↓ 2.0 MB

  1. Slide 1: Security Signals
  2. Slide 2: Google's Approach to Web
  3. Slide 3: Web Security is hard, especially at Google
  4. Slide 4: Secure-by-Design or Fail to Scale
  5. Slide 5: Security Signals
  6. Slide 6: Collecting Signals
  7. Slide 7: Collecting Security Signals
  8. Slide 8: Reverse Proxies as Observability Hooks
  9. Slide 9: Collecting Data: Challenges
  10. Slide 10: Collecting HTTP Request & Response Data
  11. Slide 11: Collecting Security-Related HTTP Headers
  12. Slide 12: Synthetic Security Signals
  13. Slide 13: Collected Synthetic Security Signals
  14. Slide 14: Auxiliary Data
  15. Slide 15: Processing Signals
  16. Slide 16: Security Signals Pipeline
  17. Slide 17: Security Signals Pipeline (continued)
  18. Slide 18: Cardinality Reduction
  19. Slide 19: Security Signals Tables
  20. Slide 20: Targeted Security Research &
  21. Slide 21: Example: Cross-Site Request Forgery
  22. Slide 22: Example: Cross-Site Request Forgery Remediation
  23. Slide 23: Example: Cross-Site Request Forgery Remediation (continued)
  24. Slide 24: Example: Cross-Origin Resource Sharing Remediation
  25. Slide 25: Example: Cross-Origin Resource Sharing Remediation (continued)
  26. Slide 26: Adoption of Web Security
  27. Slide 27: Deploying Trusted Types across Alphabet
  28. Slide 28: Deploying Trusted Types across Alphabet (continued)
  29. Slide 29: Deploying Trusted Types across Alphabet (continued)
  30. Slide 30: Measuring Runtime
  31. Slide 31: Surfacing Security-Relevant Trust Relationships
  32. Slide 32: Surfacing AI/ML Properties
  33. Slide 33: Monitoring and Regression
  34. Slide 34: From Reactive Security Reviews to Scaling Security
  35. Slide 35: Security Signals Frontends
  36. Slide 36: Target Audiences
  37. Slide 37: UI for Security Engineers
  38. Slide 38: UI for Security Engineers (continued)
  39. Slide 39: Web Security Portal for Product Engineers
  40. Slide 40: Dashboards for Executives
  41. Slide 41: Thank you!
1 / 41

// key slides

  1. 3The scale: 8,000+ services, ~1,000 domains, trillions of requests
  2. 7Architecture: the reverse proxy feeds the signal store
  3. 29Four years of Trusted Types coverage, past 600 services
  4. 40The executive dashboard: adoption gauges per control

// what you take away

  • Reverse proxies log sampled traffic, up to 1%, with no bodies and no query strings.
  • Frameworks add synthetic signals in a header the proxy strips before it leaves.
  • The signals tracked the Trusted Types rollout to 600+ services in two years.