Web development is a complex realm since you need to know different technologies and how they interact. You have server components that run in the back-end such as the database and the business logic and on the other hand client code running in the browser. These components are sometimes developed using different programming languages and tools. On top of that you have to know how to deploy the server architecture that drives the database and business logic and on the browser side you sometimes need to know a number of different technologies such as HTML, CSS, JavaScript (AJAX) and Flash.
Because of this complexity the whole issue of Web related security and privacy is very challenging. As part of trying to keep up with this challenge a couple of our developers attended the OWASP Israel 2007 Conference.
OWASP (The Open Web Application Security Project) is a worldwide free and open community focused on improving the security of application software. The OWASP community includes educational organizations, commercial companies, and individuals from all over the world. Together, OWASP forms an application security community that works together to create methodologies, documents and tools that are freely available for the entire world to use.
Some of OWASPs interesting and useful projects include :
- OWASP Top Ten - a document that lists the 10 most serious Web application vulnerabilities, discusses how to protect against them, and provides links to more information
- OWASP Guide - a massive document covering all aspects of Web application and Web service security
- OWASP WebScarab - a tool for performing all types of security testing on Web applications and Web services
The conference (which BTW was free) turned out to be a very good one and our developers returned with new and relevant information about issues such as Cross Site Scripting (XSS) and Cross Site Request Forgery (CSRF) and much more. Even though we have taken both security and privacy into consideration when developing our application since day one, we still have to constantly stay alert for new threats and techniques.
Comments