This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Template:Application Security News"

From OWASP
Jump to: navigation, search
Line 1: Line 1:
−
; '''Nov 21 - [http://www.csoonline.com/read/110106/fea_strong_auth_pf.html Why two-factor sucks]'''
+
; [[Image:Database_security_comparison.jpg|right|200px]]'''Nov 28 - [http://www.databasesecurity.com/dbsec/comparison.pdf Litchfield slams Oracle lack of SDL]'''
−
: "More than 90 percent of the participants in several focus groups said they didn't want to use a token to access accounts online or by phone. "The response we got was, 'Don't tell me I have to carry something to get access to my money. It's your job to protect my money, and if you don't do your job I'll find someone who will,'" says Cullinane, who is CISO of Washington Mutual, the nation's largest savings bank. "It was rather startling to get that from them."
+
: David Litchfield presents some very compelling evidence that Microsoft's SDL is paying off. A very interesting read. Not surprisingly, Microsoft is [http://blogs.msdn.com/michael_howard/archive/2006/11/22/microsoft-beats-oracle-in-security-showdown.aspx gloating] a little.
  
−
; '''Nov 13 - [http://searchappsecurity.techtarget.com/originalContent/0,289142,sid92_gci1229301,00.html Growing interest in securing SDLC]'''
+
; '''Nov 28 - [http://link Foreign software - threat or xenophobia?]'''
−
: "It's becoming an emerging area of interest for enterprises to address application portfolios and review their applications for security. The other angle is, when developing code, making sure that security is taken into consideration throughout the SDLC, instead of just testing during QA prior to GA or prior to releasing to production."
+
: Ira Winkler - "If there is one line of code written overseas, that’s one line too many. Developing it in the U.S. is not perfect, but we are talking about an exponential increase in risk by moving it overseas." John Pescatore - the focus on offshore developers is "xenophobia" but said the software security concerns raised by the DOD should serve as a useful wake-up call for all organizations that buy software.
  
−
; '''Nov 9 - [http://www.enterprisestrategygroup.com/ESGPublications/ReportListings.asp?ReportType=briefs SDL 2008 or bust!]'''
+
; '''Nov 27 - [http://myappsecurity.blogspot.com/2006/11/comparison-between-appscan-vs.html Scanner smackdown results]'''
−
: "ESG believes that other ISVs should embrace an SDL model as soon as possible and that enterprise organizations should mandate that technology vendors establish a measurable and transparent SDL process by 2008 or risk losing business."
+
: "Last month I got a chance to evaluate the two popular vulnerability assessment tools Webinspect and Appscan and I wanted to share my findings with others..."  
  
−
; '''Nov 7 - [http://www.sourceforge.net/projects/jbrofuzz JBroFuzz 0.2 Network Protocol Fuzzer Released]'''
+
; '''Nov 27 [http://www.viruslist.com/en/analysis?pubid=204791907 Malware evolution - third wave coming?]'''
−
:JBroFuzz is a stateless network protocol fuzzer for penetration tests. Written in Java (exe also available) it provides a number of generators, as well as basic checks involving SQL injection, Cross Site Scripting (XSS), Buffer/Integer Overflows, as well as Format String Errors.
+
: "All the events of the third quarter of 2006 lead me to conclude that both the Internet and the field of information security are on the verge of something totally new. I would say that the second stage of both virus and antivirus evolution is now complete. The first stage was during the 1990s, which simple signature detection was enough to combat simple viruses. At this stage, malicious code was not highly technical and did not use complex infection methods."
  
−
; '''Nov 5 - [http://portal.spidynamics.com/blogs/msutton/archive/2006/09/26/How-Prevalent-Are-SQL-Injection-Vulnerabilities_3F00_.aspx 11.3% Vulnerable to SQL Injection]'''
+
; '''Nov 26 - [http://www.esecurityplanet.com/print.php/3642321 The security snooze button]'''
−
: Micheal Sutton experimented with a survey of sites that have a parameter named "id" in the URL. He finds that 11.3% of them cough up a SQL error. "The statistics are significant as they provide evidence of the prevalence of web application vulnerabilities. Coverage of this issue has however been somewhat misleading as reports have suggested that it is a measure of what attackers are doing."
+
: Great article by Ken van Wyk. He looks at the 41% increase in published software vulnerabilities and points out that there is not a corresponding 41% increase in the amount of software, a 41% more people looking for vulnerabilities, or more researchers looking. He concludes there's a significant shift in profit motive. Caveat browsor.
  
 
; [[Application Security News|Older news...]]
 
; [[Application Security News|Older news...]]

Revision as of 16:21, 28 November 2006

Database security comparison.jpg
Nov 28 - Litchfield slams Oracle lack of SDL
David Litchfield presents some very compelling evidence that Microsoft's SDL is paying off. A very interesting read. Not surprisingly, Microsoft is gloating a little.
Nov 28 - Foreign software - threat or xenophobia?
Ira Winkler - "If there is one line of code written overseas, that’s one line too many. Developing it in the U.S. is not perfect, but we are talking about an exponential increase in risk by moving it overseas." John Pescatore - the focus on offshore developers is "xenophobia" but said the software security concerns raised by the DOD should serve as a useful wake-up call for all organizations that buy software.
Nov 27 - Scanner smackdown results
"Last month I got a chance to evaluate the two popular vulnerability assessment tools Webinspect and Appscan and I wanted to share my findings with others..."
Nov 27 Malware evolution - third wave coming?
"All the events of the third quarter of 2006 lead me to conclude that both the Internet and the field of information security are on the verge of something totally new. I would say that the second stage of both virus and antivirus evolution is now complete. The first stage was during the 1990s, which simple signature detection was enough to combat simple viruses. At this stage, malicious code was not highly technical and did not use complex infection methods."
Nov 26 - The security snooze button
Great article by Ken van Wyk. He looks at the 41% increase in published software vulnerabilities and points out that there is not a corresponding 41% increase in the amount of software, a 41% more people looking for vulnerabilities, or more researchers looking. He concludes there's a significant shift in profit motive. Caveat browsor.
Older news...
Retrieved from "https://wiki.owasp.org/index.php?title=Template:Application_Security_News&oldid=13780"