Web Security Advisor
	DNS rebinding defenses still necessary, thanks to Web 2.0
	New defenses for automated SQL injection attacks
	PCI compliance and Web applications: Code review or firewalls?
	Worst practices: Bad security incidents to avoid
	Web scanning and reporting best practices
	Social networking Web site threats manageable with good enterprise policy
	Enterprise security in 2008: Building trust into the application development process
	PCI DSS Section 6: A plan for tackling application security
	Making the case for Web application vulnerability scanners
	Preparing for uniform resource identifier (URI) exploits

	Web Application Security (Also see Web Access Control)
	Billy Hoffman on AJAX security and browser attacks
	Data risks take shine off Google Chrome
	Verizon breach study identifies industry specific threats
	IronPort feature detects exploited websites
	PCI DSS 1.2 clarifies wireless, antivirus use
	MySpace, Facebook ignoring basic principles of security
	Positive changes coming to ModSecurity
	Kaminsky: DNS flaw capable of attacks on many fronts
	Can IBM's SMash technology secure Web applications?
	Microsoft tools won't be quick fix for SQL injection attacks

	Secure Software Development
	Microsoft opens up secure development program
	Mozilla's Snyder says security pros should press vendors on security
	Vista functionality still wins over security
	Mozilla to release Firefox threat-modeling data
	Security issues found in the Spring Framework
	Software still plagued with security holes, researcher says
	Microsoft tools won't be quick fix for SQL injection attacks
	Which automated quality assurance tools can be used to test software?
	Gary McGraw on secure software development
	Product review: Mu-4000 Security Analyzer