February 2009
Measuring the Value of Remote Application Security Testing
by Paresh Amin, CISSP
It sometimes takes a major application security breach to get us fired up to test our applications. The recent breach at Hannaford Bros. is a good example where attackers managed to steal up to 4.2 million credit card and debit card numbers. It pays to be proactive when doing application security testing. Measuring the value of application and network security testing is the first step as what is measured can be improved. [Disclosure: Paladion/Plynt provides remote application security testing.]… more →
Selecting Application Security Vendors – Part II
by Sachin Varghese
In March 2005, Jose Varghese outlined the best practices for selecting application security vendors in Palisade. That article gave pointers to mid size and large enterprises who are leveraging external application expertise or intending to leverage external resources. Fours year later, we review the themes in that article. Have those criteria changed over these years when application security has moved from back-stage to center-stage? As we reviewed the criteria, we observed that the core principles Jose laid out in 2005 still hold true.… more →
Virtual Keyboard and the Fight Against Keyloggers
by Santosh Jadhav
Welcome to Safe Bank’s net banking. Please enter your net banking userid and password.
Userid: 15236523
Password: *************
Action = submit.jsp
and you have logged into net-banking application. Wow!!! You can now view your account balance, do third party funds transfer and much more.… more →
Quiz: Mitigating the risk of CSRF attacks
Cross Site Request Forgery (CSRF) is an attack that tricks the victim into taking some action on the vulnerable application without the victim’s knowledge. CSRF attack can be carried out in different ways. Which of the following aspects in an ASP.NET application would not help mitigate the risk of CSRF attacks?
- Use of ViewStateUserKey
- Use of CSRFGuard httpModule
- Secure against XSS attacks
- Setting the HttpOnly attribute of the session cookie