Access your Pro+ Content below.
Web app security devices highlight source code vulnerabilities
This article is part of the September 2004 issue of Information Security magazine
Are your Web applications secure? Online businesses apps, which are wide open at port 80, put that question to the test daily. Developed for functionality with little thought to security, custom apps are typically vulnerable to attacks such as buffer-overflow exploits, cross-site scripting and SQL injection. If companies don't lock down their Web apps, security risks will increase as corporate dependency on Internet and intranet applications rises, along with site complexity, language depth and overall functionality. The Web apps' exposure to attack is driving the need for developers with both expert application security and deep programming skills. Faced with the need to develop secure applications in the absence of uniform expertise, organizations have two basic options for improving Web application security: A range of services that employ security development specialists to design, vet and/or troubleshoot applications. A growing field of generally immature but promising products that identify security issues both before and ...
Access this Pro+ Content for Free!
Features in this issue
Despite heightened post-9/11 security awareness, the U.S. is exposed to numerous critical infrastructure threats.
Emerging Web app security services and products bring source code vulnerabilities to light, writes James C. Foster.
Offshoring is good for business, but lax security practices can torpedo your investment.
Columns in this issue
Would you tell your enterprise security secrets if you could hear others? Lawrence Walsh explains why he thinks communication in the security field is lacking.
Measuring risk and forming best practices relies on learning from past experiences. Analyst Jay Heiser explains how security tactics in the past, echo in todays world.
Do you rush to deploy patches, hot fixes or service packs as soon as possible? Victor Garza explains why this may not necessarily be the right decision.
See why Watchfire's acquisition of Sanctum does not spell the end for web app security.
The information security officer will soon go the way of the dodo bird.