Security Management Strategies for the CIO
Email Alerts
-
What is the best way to manually test for buffer overflows?
There are two ways of reviewing a program for buffer overflows. Michael Cobb explains how to examine a program's source code and file code. Ask the Expert
-
How can an enterprise-wide network prevent denial-of-service attacks?
Denial-of-service (DoS) attacks are often associated only with one type of flood attack, but there are many to look out for. Information security threats expert John Strand weighs in. Ask the Expert
-
Are social networking sites an easy target for malicious hackers?
With the rise of social networking giants like MySpace and Facebook, it makes sense that there would also be a rise in malware to attack them. Ask the Expert
-
What are the dangers of cross-site request forgery attacks (CSRF)?
Ed Skoudis defines the threats posed by cross-site request forgery attacks (CSRF), and explains how they are similar and different from cross-site scripting attacks. Ask the Expert
-
How should application developers manage cookies?
Cookies hold data, such as user preferences and session tracking credentials. In this expert Q&A, Ed Skoudis explains how application developers can define and manage the cookies appropriately. Ask the Expert
-
What software development practices prevent input validation attacks?
Improper input validation leads to numerous kinds of attacks, including cross-site scripting, SQL injection and command injection. In this expert Q&A, Michael Cobb reviews the most important application development practices. Ask the Expert
-
What is the relationship between shellcode and exploit code?
Is shellcode always considered exploit code? In this expert response, Michael Cobb breaks down the two malware terms. Ask the Expert
-
How to test an e-commerce Web site's security and privacy defenses
Assessing the security of e-commerce sites means checking up on their associated servers, databases and applications. In this expert response, Michael Cobb explains where to start. Ask the Expert
-
Can fuzzing identify cross-site scripting (XSS) vulnerabilities?
Fuzzing may find weaknesses in software, but the testing process can't find every flaw. Ed Skoudis explains what other tools are necessary when looking for cross-site scripting vulnerabilities. Ask the Expert
-
Can Snort stop application-layer attacks?
Even though Snort can add an important layer of defense for applications, it won't fix the underlying problem of poorly written ones. Michael Cobb reveals a more efficient technique for patching up XSS and SQL injection vulnerabilities. Ask the Expert