August 2004
Passwords - In Memory Still Green
by Sangita Pakala, GCIH
Passwords are the keys to applications. Any user will want to protect his/her password from others, especially attackers. That is a good practice, but is not enough.… more →
Automated Application Vulnerability Scanners
by Roshen Chandran, CISSP
Organizations have been looking at Application Vulnerability Scanners to automate the task of assessing the security of applications. This article explains how these scanners work, where to use them and where they are inadequate.… more →
Security at Software Requirements Specification
by Roshen Chandran, CISSP
Applications designed with security in mind are safer than those here security is an afterthought. Traditionally security issues are first considered during the Design phase of the Software Development Life Cycle (SDLC) once the Software Requirements Specification (SRS) has been frozen. That’s one stage too late.… more →
Quiz: Securing non-HTML content
An online banking application lets the user export account statements as text files or Excel spreadsheets. How should the application generate, store and dispatch these non-HTML content to the user’s browser?
- Maintain these files in the web server’s file system, and redirect the user to the correct file when requested.
- Store the data in a database, and create the files temporarily in the local file system when a user requests it. Then redirect the user to this temporary file.
- Store the files in a database, read it with a server program and dispatch the files directly to the browser by setting the content-type directive.
Review: Threat Modeling
by Frank Swiderski, Window Snyder
We take a look at “Threat Modeling” by Frank Swiderski, Window Snyder on the structured approach of analysing security threats.… more →