September 2004
Preventing Buffer Overflows
by Rajesh Jose, CISSP
Buffer overflow vulnerabilities are the result of poor input validation: they enable an attacker to run his input as code in the victim. Even when care has been taken to validate all inputs, bugs might slip through and make the application insecure. This article presents the various options available to protect against buffer overflows… more →
Securing Database Connection Strings
by Sonali Gupta, GCIH
In today’s systems, we check applications for vulnerabilities, write safer code and encrypt data communication; but we often overlook the database connection string. A connection string specifies the parameters for an application to connect to a database: it holds a lot of critical information including the username and password for accessing the database. Applications traditionally pass and store connection strings in plain text. An adversary could get this data if he has access to the machine. So what is the solution to this problem?… more →
Training your Developers
by Shaheem Motlekar, GCIH, BS7799 LA
The most effective way to secure applications is by writing them securely; and the best way to achieve this is by training your development team to write safer applications. This article presents the key components of a security program for your development team… more →
Quiz: Protecting Session Cookies
How should I protect the session cookie in my web application from getting stolen?
- Use strongly random strings for the session token.
- Set the “secure” attribute for the session cookie.
- Set the “httponly” attribute for the cookie.
- All of the above.
Review: Writing Secure Code, 2nd Ed.
by Michael Howard, David LeBlanc
We take a look at the “Writing Secure Code, 2nd Ed” book by Michael Howard & David LeBlanc on safe programming practices and guidelines security principles and threat modeling… more →