[17157] in bugtraq
Re: Cross site scripting: a long term fix
daemon@ATHENA.MIT.EDU (Doug Winter)
Wed Oct 11 18:37:04 2000
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Message-ID: <977755564D4BD411973D00C04FA06D122CFD41@vulture.b2europe.com>
Date: Wed, 11 Oct 2000 11:38:04 +0100
Reply-To: Doug Winter <dwinter@BUSINESSEUROPE.COM>
From: Doug Winter <dwinter@BUSINESSEUROPE.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
> From: Erik Peterson [mailto:axiom@NULL.NET]
>
> Solution: AppShield from www.sanctuminc.com
Having read the documents, this seems to move the burden of effort and
responsibility for application security from developers to operational
staff, who need to configure the AppShield beasty on a per-application
basis. (correct me if I'm wrong, but I can't see how it can generically
detect these attacks, and their website certainly shows screenshots of a
per-page configuration screen). It also adds yet another layer of potential
risk to availability.
This means that the ops staff will need to delve into the application,
checking for potential instances of insecure coding, which is inappropriate
and managerially very difficult to introduce due to poor
skills/responsibility mix. Ideally operational staff should concentrate on
operational matters, and not need to become application developers also
(although it's always nice to have a couple who can do both :-).
The problem is rarely that of unskilled developers but of unaware specifiers
who don't consider non-functional requirements (security, performance,
availability, operability etc.) explicitly in specification and acceptance.
This means they aren't considered in resource estimates by developers (who
are always under pressure to deliver NOW) which means they don't get done.
Doug Winter
Chief Technology Officer
--
T: +44 (0)20 7961 0341
M: +44 (0)7879 423 002
E: dwinter@businesseurope.com
3 Waterhouse Square, Holborn Bars, 142 Holborn, London EC1N 2NX
