I’m still in New York for the FISD conference, listening to Team Cymru talk about the state of cybercrime as I wait for my turn at the podium (to talk about information-centric security and DLP). One problem with travel is keeping up with the news, so I pretty much missed the Applescript vulnerability and now have to write it up for TidBITS on the plane before Monday.
I’ve been absolutely flattered by some of the positive comments on our posts this week, especially the database posts. But as much as I enjoy the credit for someone else’s work, I’d like to remind everyone that I’m not the only blogger here at Securosis anymore.
Your Web application connects to a database. You supply the user name and password, establish the connection, and run your query. A very simple, easy to use, and essential component to web applications.
How do we know our code is bug free? What makes us believe that our application is always going to work?
This is a very scary thing. I wrote a blog post last year about this type of thing in response to Rich’s post on lax wireless security. I was trying to think up scenarios where this would be a problem, and the best example I thought of is what I am going to call the “Pink Slip Virus 2008”.
Mozilla is trying to set a world download record. Then add in NoScript, and enjoy some (more) secure browsing.
(I think it starts at 10 PT).
It’s a good thing Adrian joined when he did, because I’m slammed with speaking events this week and he gets to mind the blog.
‘I’m not sure if it’s the innate human desire to recognize patterns even when they don’t exist, or if the stars really do align on occasion, but sometimes a series of random events hit at just the right time to inspire a little thought.
In a previous post I have noted that ultimately SQL Injection is a database attack through a web application proxy, and that the Database and the associated Database Administrators need to play a larger part in the defense of data and applications. I recommended a couple steps to assist in combating attacks through the use of stored procedures to help in input parameter validation. I also want to make additional recommendations in the areas of separation of duties and compartmentalization of…
Earlier today I had a bit of a shock when our fearless editor Chris Pepper congratulated me on our 500th post. I started this blog just under two years ago to test the waters of this whole new media thing. Much to my surprise, almost exactly a year after that I took the plunge, quit a heck of a good job, and turned Securosis into a company, not just a place for my random rants. Over that time Chris joined me as editor, and David Mortman as an occasional contributor.