HackDig : Dig high-quality web security articles for hacker

Using Fallible Static Code Analysis to Secure Apps

Back in my younger days, I used to create apps for platforms like iOS, Android and yes, even Blackberry. Mostly, this was a hobby to fill a need which was being met by the infant app stores at the time.My primary concern wasn’t security, proper development techniques, or any of the other best practices found in the OWASP Top 10. It’s safe to say that there a
Publish At:2017-01-19 06:10 | Read:3241 | Comments:0 | Tags:Cyber Security Featured Articles Android apps development se

Security for Life: Promoting the Development of a Security Professional

This week marks the fifth and final week of National Cyber Security Awareness Month (NCSAM) 2015. A program sponsored by the Department of Homeland Security (DHS) in cooperation with the National Cyber Security Alliance and the Multi-State Information Sharing and Analysis Center, NCSAM emphasizes our shared responsibility in strengthening the cyber security
Publish At:2015-10-30 08:40 | Read:2516 | Comments:0 | Tags:Featured Articles Security Awareness development Learn Mento

AppSensor Guide v2.0.2

I have published an updated version of the OWASP AppSensor Guide, the guide to application-specific real time attack detection and response.The v2.0.2 AppSensor Guide is available free of charge digitally in DOC and PDF formats, and in print at cost from Lulu.This is a minor update that includes:Reference the extensive work on the reference code implementati
Publish At:2015-07-28 16:35 | Read:3108 | Comments:0 | Tags:testing development design threats technical specification m

Ecommerce and Financial Web Application Vulnerabilities

NCC Group has published some guidance for finance/e-commerce application penetration testers.Common Security Issues in Financially-Oriented Web Applications is arranged in the following sections:Time-of-Check-Time-of-Use (TOCTOU) and race condition issuesParameter manipulationReplay attacks (capture-replay)Rounding issuesNumerical processingCard number-relat
Publish At:2015-06-20 13:05 | Read:3618 | Comments:0 | Tags:testing development PCIDSS design threats technical specific

AppSensor Code Version 2.1 and Beyond

Last Tuesday John Melton completed and announced the release of the AppSensor version 2.1.0 reference implementation.OWASP AppSensor project defines a conceptual framework and methodology that offers prescriptive guidance to implement application intrusion detection and automated response. The reference implementation allows developers to use these powerful
Publish At:2015-06-15 13:30 | Read:2963 | Comments:0 | Tags:development design threats technical specification monitorin

The Well-Rounded Engineer

I am not a security industry luminary. In fact, prior to WhiteHat I had never worked in security. The closest I came was a consulting project using Perl::Critic for Security Audits in 2012. It was static analysis trying to uncover XSS and SQLi vulnerabilities in large, legacy Perl applications — toy compared to what Eric Sheridan and his team do here at Whit
Publish At:2015-06-12 04:40 | Read:2240 | Comments:0 | Tags:Industry Observations development web application well-round

SANS 2015 State of Application Security

The SANS Institute has published this year's survey results about application security programmes.In a change to last year's report the authors of 2015 State of Application Security: Closing theGap have identified and broken down their analysis and reporting into two groups of survey respondents - builders and defenders.Jim Bird, Eric Johnson and Frank Kim a
Publish At:2015-05-18 09:00 | Read:3233 | Comments:0 | Tags:testing information assurance disposal development maturity

Lightning OWASP Project Presentations at AppSec EU 2015

AppSec EU 2015 begins in two weeks. It is being held in Amsterdam at the Amsterdam RAI exhibition and conference centre.With the news yesterday that the number of conference attendee bookings has surpassed 400, together with the training, capture the flag competition, university challenge, application security hackathon, computer gaming, networking and organ
Publish At:2015-05-09 22:15 | Read:3887 | Comments:0 | Tags:requirements SDLC testing development owasp projects appsece

Snakes & Ladders Coming To Shoreditch

A week on Monday, on the 11th May, I will be speaking during the MAKE day at this year's Digital Shoreditch.The Digital Shoreditch Festival 2015 is a two week mass-community celebration with participants from the world of tech, creative, and all related industries, running from 11th to 24th May. The schedule for the main programme (11th-15th May) has a separ
Publish At:2015-05-01 16:30 | Read:3092 | Comments:0 | Tags:vulnerabilities design technical threats testing requirement

AppSensor CISO Briefing

Following the release of the Introduction for Developers in February, the OWASP AppSensor team has now created and published a new document aimed at Chief Information Security Officers (CISOs) and others with similar responsibilities.The CISO Briefing is a high-level overview, with pointers to the more detailed resources for specifiers, architects, developer
Publish At:2015-04-24 20:20 | Read:4021 | Comments:0 | Tags:incidents logging operation automation specification technic

Participate in the OWASP Project Summit in Amsterdam

The Open Web Application Security Project (OWASP) is supporting a project summit during the two days prior to the main AppSec EU conference.A project summit on Tuesday 19th and Wednesday 20th May has been announced and information published on the AppSec EU 2015 web site. The concept of the summit is to work on improving and extending project outputs with ot
Publish At:2015-03-31 15:30 | Read:3759 | Comments:0 | Tags:testing corrective operation maturity preventative technical

Introduction to AppSensor for Developers

Following the recent v2.0 code release and promotion to flagship status there has been increased interest in the OWASP AppSensor Project concerning application-specific real-time attack detection and response.During the OWASP podcast interview with project co-leader John Melton, the idea of creating briefings for target groups was discussed by podcast host M
Publish At:2015-03-06 06:40 | Read:4484 | Comments:0 | Tags:corrective administrative specification technical threats op

Register Today for OWASP AppSec EU 2015 in Amsterdam

The leading application security training and conference event is being held in Amsterdam from 19th to 22nd May 2015. Register today.OWASP AppSec EU 2015 is being held in the Amsterdam RAI Convention Centre just a single train stop from both Schiphol Airport in one direction, and central station in the other.AppSec EU 2015 comprises:One and two-day training
Publish At:2015-02-27 16:20 | Read:2885 | Comments:0 | Tags:testing corrective operation maturity preventative technical

Software Assurance Maturity Model Practitioner Workshop

The OWASP Open Software Assurance Maturity Model (Open SAMM) team are holding a summit in Dublin at the end of March.As part of the two-day Open SAMM Summit 2015 a full day is being allocated to software assurance practitioners and those who want to learn about using the vendor-neutral and free Open SAMM to help measure, build and maintain security throughou
Publish At:2015-02-21 02:50 | Read:3677 | Comments:0 | Tags:testing corrective standards maturity preventative technical

OWASP AppSensor Code v2.0.0 Final Release

I was extremely pleased to read yesterday that the final version of the new AppSensor reference implementation has been published following three previous release candidates.The OWASP AppSensor project defines a conceptual framework and methodology that offers prescriptive guidance to implement application intrusion detection and automated response.John Melt
Publish At:2015-01-30 16:15 | Read:2925 | Comments:0 | Tags:logging automation ids technical threats operation developme

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud