Tips

Tips

• The importance of input validation

  Web applications are vulnerable if you don't practice input validation. Learn how to prevent application attacks such as buffer overflow, SQL injection and cross-site scripting.  Continue Reading

• Buffer overflow tools facilitate application testing

  Web applications are the conduit for buffer overflow attacks on the Web server. As such, it's imperative to make sure your applications cannot be exploited. These tools can help you out.  Continue Reading

• Hacking for Dummies -- Chapter 16, Web applications

  Web application security is the subject of this free book excerpt. Kevin Beaver reviews application vulnerabilities, exploits, malware and countermeasures. Application hacks covered include insecure login mechanisms, directory traversal attacks and ...  Continue Reading

• Find Ajax security flaws using tests

  Ajax security problems can be found by doing manual tests. What should you look for in order to prevent an attack? Andres Andreu provides some advice in this tip excerpted from the book Professional Pen Testing for Web Applications.  Continue Reading

• Penetration testing techniques -- Chapter 6, Professional Pen Testing for Web Applications

  To successfully pen test your applications, you need the right tools in your toolbox. In this chapter, author Andres Andreu reviews a sampling of such tools and how to use them to get the results you're after.  Continue Reading

• Integrating application security with application delivery

  Application security should be integrated when planning your application infrastructure and investing in software development and equipment, Amir Peles warns. Neglecting application security leaves your applications open to exploits.  Continue Reading

• SQL injection: Secure your Web applications

  SQL injection exploits wreak havoc on vulnerable Web sites. Expert Caleb Sima explains how to protect your applications against these popular and destructive injection attacks.  Continue Reading

• Software patching principle

  Even if a company does all that it can to create perfect software, inevitably some vulnerabilities slip by. That's why it's essential to have an incident response process, as well as a plan for software patching.  Continue Reading

• CRLF injection attacks: How they work and what to do about them

  CRLF injection exploits aren't as famous as SQL or LDAP injections, but they're just as damaging to vulnerable applications. Learn how this attack works and what you can do to defend your apps.  Continue Reading

• Adding 'fudge' to your passwords

  Safe passwords are integral to Web application security. Unfortunately, recalling many complicated passwords is difficult. If you must write down your passwords to remember them, use this tip to create a safer password record.  Continue Reading

• Secure applications require security-aware end users

  Having secure applications requires more than eliminating vulnerabilities in your code. Columnist Ken Salchow Jr. says end users must also understand that their actions can have serious security repercussions -- and companies need to provide ...  Continue Reading

• Ajax in Action -- Chapter 7, Security and Ajax

  "Security and Ajax" looks at the issue of security in Ajax from a number of angles. Ajax is a Web technology and many of the issues that it faces are no different from any other Web app. This chapter covers the basic ground, concentrating on ...  Continue Reading

• .NET Framework features security mechanism

  The .NET Framework includes a simple but very flexible identity-based security mechanism. The key to using it is a detailed understanding of the Principal and Identity objects.  Continue Reading

• Input Validation Attacks -- Chapter 6, Hacking Exposed Web Applications, Second Edition

  Input validation routines serve as a first line of defense for a Web application. Buffer overflow, directory traversal, cross-site scripting and SQL injection are just a few of the attacks that can result from improper data validation. This chapter ...  Continue Reading

• New exploits demand multi-layer threat protection

  Application security cannot be attained without securing every layer, Amir Peles explains. Specialized attacks are proliferating, and they require specialized countermeasures.  Continue Reading

• Internet Site Security -- Chapter 12: Developing Secure Internet Applications

  Web application security is a difficult task, and programming errors compound Internet insecurity. Software developers will benefit from the tips in this free book excerpt. This chapter breaks down internet security, starting with common sources of ...  Continue Reading

• Data security requires multi-layer approach

  There's no question that it's essential to protect data. To guard it adequately, however, you must take a multi-pronged approach that includes application security.  Continue Reading

• Understanding directory traversal attacks

  Directory traversal attacks are the very common, very dangerous HTTP exploits you never hear about. For the sake of your Web applications, it's time to start taking notice.  Continue Reading

• Discover the power of .NET's code access security

  Input validation is easy with .NET's security tools. Sangita Pakala explains how you can use Link Demand and Strong Names to block it.  Continue Reading

• Ways to automate SQL injection testing

  Manual testing for SQL injection requires much effort with little guarantee that you'll find every vulnerability. CISSP Kevin Beaver offers a better way: automated SQL injection testing.  Continue Reading

• Beginning Cryptography with Java -- Chapter 2, Symmetric Key Cryptography

  Java authentication and authorization is integral to Java application security. "Symmetric Key Cryptography" introduces the concept of symmetric key cryptography and how it is used in the Java Cryptography Extension (JCE). Author David Hook ...  Continue Reading

• Re-examining the worm: How to protect your applications

  Worms have the potential to disrupt or destroy your applications. It's important to re-examine this old but potentially devastating exploit. Amir Peles explains how worms can attack your applications and what you can do to stave them off in this ...  Continue Reading

• Blind SQL injection attacks explained

  Most security professionals know what SQL injection attacks are and how to protect their Web applications against them. But they may not know that their preventative measures may be leaving their applications open to blind SQL injection attacks. SQL...  Continue Reading

• The coming invasion: Will XML overtake the enterprise network?

  The flood of XML traffic means security control is much more elusive. Regardless, the XML processing load, and more importantly the security of XML content, has to be addressed.  Continue Reading

• Technology alone cannot defeat Web application attacks: Understanding technical vs. logical vulnerab

  Application security expert Jeremiah Grossman explains why Web site security can't be fully automated. Web sites have logical vulnerabilities that require a human mind to understand.  Continue Reading

• ASP.NET 2.0 MVP Hacks and Tips -- Chapter 14, Security Hacks

  Secure ASP.NET application development is easy with these security hacks. This free chapter provides ASP.NET 2.0 developers with tips to prevent exploits such as SQL injection in .NET Web applications.  Continue Reading

• Threat modeling enhanced with misuse cases

  Misuse cases capture all the possible attacks on an application, as well as mitigation steps. Anurag Agarwal explains how they can help architects correct design flaws, help developers understand a hacker's approach and write more secure code, and ...  Continue Reading

• Professional Java Development with the Spring Framework -- Chapter 10: Acegi Security System for Spr

  Java development isn't complete without sound application security practices. Programmers using the Spring Framework will learn security measures in this free book excerpt on the Acegi Security System.  Continue Reading

• Protecting encrypted data from attacks

  You may think of encryption as a way to secure your client data. Hackers, however, see encryption as the express carpool lane, allowing them to bypass your entire security infrastructure and get to your applications. In this tip Amir Peles explains ...  Continue Reading

• Application security increased by static and dynamic code analysis

  Integrating security measures into the software development life cycle (SDLC) is crucial Web application security. One of these measures is source code analysis, which includes both static and dynamic analysis.  Continue Reading

• Stronger authentication needed for Web applications

  Most people think of authentication as validating the identity of the user for a session. While that is certainly accurate, in today's world of sophisticated attacks, Web application developers and security experts need to consider strengthening ...  Continue Reading

• Web application security changes with SOA

  Application security is affected by SOA. Here are some tips for protecting your Web apps.  Continue Reading

• Biometric authentication replacing passwords: Does authentication get better or worse?

  Biometric authentication eliminates some of the problems we see with password authentication, but it also raises questions. As columnist Anurag Agarwal points out, you can't get new fingerprints if yours are stolen like you can with passwords.  Continue Reading

• Mini-tutorial: The Java security model

  Mike Chapple takes a look under the hood of Java.  Continue Reading

• SQL injection: Developers fight back

  SQL injection attacks are a popular threat against application security. Anurag Agarwal provides 10 steps developers can use to secure their Web applications against SQL injection.  Continue Reading

• Professional VB 2005 -- Chapter 13: Security in the .NET Framework 2.0

  Application security tools and security features are included in the latest version of VB.NET. Learn about these Web app security features in this free book excerpt.  Continue Reading

• The power of behavioral-based analysis

  Application security tools, if not configured properly, could lead to false positives. What's needed, according to columnist Amir Peles, is behavioral-based analysis that can inspect application usage patterns and can discern between an attack and ...  Continue Reading

• What's new with SAML?

  With SAML getting even more use these days, it's worth taking a closer look at this protocol. In this tip, Ed Tittel discusses the assertions and protocols of SAML 1.1.  Continue Reading

• Secure SDLC: Integrating security into your software development life cycle

  Integrating security into the SDLC is essential for developing quality software. While there are no standard practices, these guidelines can help you develop a custom process for a secure software development life cycle.  Continue Reading

• Perl taint mode can help prevent buffer overflow vulnerabilities

  How Perl's taint mode can help you find insecure code.  Continue Reading

• Get a leg up on XML security development with security toolkits

  In this tip, Ed Tittel discusses XML security development with two different security toolkits.  Continue Reading

• Application security: Past myths, present excuses

  Increasingly, hackers are targeting Web applications. The problem is exacerbated by the fact that development managers wrongly think the security technologies they have relied on in the past will protect those apps. Anurag Agarwal sets the record ...  Continue Reading

• Penetration testing best practices

  Penetration testing can help you find critical vulnerabilties in your Web applications. Here are some best practices for pen testing to achieve application security.  Continue Reading

• Myth-busting Web application buffer overflows

  If someone managed to exploit a buffer overflow in a Web application, it would result in a critical situation. But the chance of that happening to a custom Web application is slim. Focus instead on cross-site scripting and SQL injection ...  Continue Reading

• Two-factor authentication and compliance: What it is and isn't

  The Federal Financial Institutions Examination Council has mandated that federal institutions deploy two-factor authentication for online banking. But what constitutes two-factor authentication is open to interpretation.  Continue Reading

• Defining and preventing buffer overflows

  Kurt Seifried describes buffer-over flow attacks and how you can guard against them.  Continue Reading

• SOA requires enterprise application security integration architecture

  Web application security in SOA-based systems can be very difficult to achieve. This tip explains how to use authentication and authorization methods, such as JAAS and SAML, will help secure your Web services.  Continue Reading

• How to Break Web Software: Functional and Security Testing of Web Applications and Web Services -- C

  Web application security is dependent on proper coding and session management, and Web application developers must take it upon themselves to code state information so they can enforce rules about page access and session management. This chapter ...  Continue Reading

• Architectural Risk Analysis -- Chapter 5, Software Security: Building Security In

  Architectural risk analysis plays an essential role in any solid software security program. By explicitly identifying risk, you can create a good general-purpose measure of software security, especially if you track risk over time. So, how do you do...  Continue Reading

• Penetration testing versus code review

  Penetration testing and code review both have their advantages. Which application security method is more effective at finding critical vulnerabilities?  Continue Reading

• Core Security Patterns: Best Practices and Strategies for J2EE, Web Services, and Identity Managemen

  Application security should be implemented throughout the Java software development life cycle. Learn how to achieve a secure Java SDLC in this free excerpt from Core Security Patterns: Best Practices and Strategies for J2EE, Web Services, and ...  Continue Reading

• Exploiting Software: How to Break Code -- Chapter 7, Buffer Overflow

  How does software break? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems and antivirus software not keeping out the bad guys? This book provides the answers. In particular, this free excerpt takes a ...  Continue Reading

• An inside look at XML encryption

  At the core of Web services security is the ability to encrypt information sent out as XML documents, using XML encryption.  Continue Reading

• Securing Web services -- More than just Web application security

  Web services need application firewalls, as well as other countermeasures, to guard against exploits. Michael Hanson explores your options.  Continue Reading

• Vulnerability assessment: Leave the scanning to someone else?

  Vulnerability assessment is a crucial component of application security. However, Robert Scheier advises readers that vulnerability scans have their limitations.  Continue Reading

• Securing Web apps against authenticated users

  Michael Cobb says you can improve Web site security by securing Web applications from authenticated users and avoiding client-side authentication.  Continue Reading

• Security tool: SecureSphere 2.0

  This anomaly detector from Imperva can help guard against a host of attacks such as XSS and SQL injection. Read more about this security tool.  Continue Reading

• Using Metasploit for real-world security tests

  Metasploit's penetration tester can pinpoint vulnerablities in your Web applications. Here are some tips for properly using this application security tool.  Continue Reading

• Protecting Web applications a paradox for security professionals

  Application security can be difficult to implement. Using the right tools and writing secure programs are good places to start.  Continue Reading

• Cross-site scripting: Intro to XSS

  Cross-site scripting vulnerabilities abound. James Michael Stewart gives an overview of XSS.  Continue Reading

• Preventing SQL Injection attacks

  Learn what a SQL injection exploit is, and how to defend yourself. Mike Chapple offers five methods to reduce the possibility of a future SQL injection attack on your applications.  Continue Reading

• Web app security tools and products find source code vulnerabilities

  Web application security depends upon good coding and good security products. This tip sorts through some of the methods you can use to secure your apps.  Continue Reading

• How to avoid authentication bypass attacks

  Strong authentication methods may not fully protect your applications. George Wrenn offers some tips for avoiding authentication bypass attacks.  Continue Reading

• SQL injection defense tactics

  SQL injection exploits are dangerous, but not difficult to prevent. James C. Foster explains how proper input validation and other methods can secure your code.  Continue Reading

• Deal with cross-site scripting

  Cross-site scripting vulnerabilities are a serious problem in application security. Mike Chapple offers basic information an XSS exploit.  Continue Reading

• Metasploit: A penetration testing tool you shouldn't be without

  This easy-to-use penetration testing tool from Metaslpoit can help you uncover vulnerabilities in your code.  Continue Reading

• Web application security tool: HIVE 3.0

  Web application attacks can be thwarted with Sentryware's HIVE 3.0. The application security tool blocks XSS, SQL injection, buffer overflow and more.  Continue Reading

• Source code security scanners: A revamped option for securing custom software

  Automated source code analysis and penetration testing tools allow software makes greater freedom for incorporating application security into their software development life cycles (SDLC).  Continue Reading

• Beware: Security testing tools won't find everything

  Security testing tools can save you countless hours of legwork, but relying too much on them could ultimately weaken your network's defenses.  Continue Reading

• Securing Web services: XML firewalls

  Web services are vulnerable to attack. XML firewalls can help keep these applications secure.  Continue Reading