Difference between revisions of "Template:Application Security News"

Revision as of 20:13, 1 December 2006

Nov 30 - What? Ajax is secure now?

Nice article making the point that Ajax is not necessarily insecure. Read it carefully folks - it isn't easy to build a secure Ajax application, just possible. And remember that although the article doesn't mention it, Ajax apps use new parsers and interpreters that haven't been very well tested for security.

Nov 30 - Democracy Schlemocracy

A paper from NIST argues that touchscreen voting machines are "more vulnerable to undetected programming errors or malicious code" and that "potentially, a single programmer could 'rig' a major election."

Nov 28 - Litchfield slams Oracle lack of SDL

David Litchfield presents some very compelling evidence that Microsoft's SDL is paying off. A very interesting read. Not surprisingly, Microsoft is gloating a little.

Nov 28 - Foreign software - threat or xenophobia?

Ira Winkler - "If there is one line of code written overseas, that’s one line too many. Developing it in the U.S. is not perfect, but we are talking about an exponential increase in risk by moving it overseas." John Pescatore - the focus on offshore developers is "xenophobia" but said the software security concerns raised by the DOD should serve as a useful wake-up call for all organizations that buy software.

Nov 27 - Scanner smackdown results

"Last month I got a chance to evaluate the two popular vulnerability assessment tools Webinspect and Appscan and I wanted to share my findings with others..."

Nov 27 Malware evolution - third wave coming?

"All the events of the third quarter of 2006 lead me to conclude that both the Internet and the field of information security are on the verge of something totally new. I would say that the second stage of both virus and antivirus evolution is now complete. The first stage was during the 1990s, which simple signature detection was enough to combat simple viruses. At this stage, malicious code was not highly technical and did not use complex infection methods."

Nov 26 - The security snooze button

Great article by Ken van Wyk. He looks at the 41% increase in published software vulnerabilities and points out that there is not a corresponding 41% increase in the amount of software, a 41% more people looking for vulnerabilities, or more researchers looking. He concludes there's a significant shift in profit motive. Caveat browsor.

Older news...