Securing the PHP Environment with PHPSecInfo

PHPSecInfo is an easy to install, easy to use security auditing tool for the PHP environment. PHPSecInfo provides an equivalent to the phpinfo() function that reports security information about the PHP environment, and offers suggestions for improvement.

This talk will cover:

• The current state of security in open source web applications written in PHP
• The importance of securely configuring PHP
• The primary audiences for open source web applications, and how PHPSecInfo can be useful to each
• The role PHPSecInfo can play in a multilayered security approach
• Deploying, modifying, and extending PHPSecInfo
• The Zend_Environment_Security module in the Zend Framework