Defence Secretary gives kudos to Royal Navy's prof... » The Defence Secretary has praised the Royal Navy’s professionalism after witnessing the advanced sea... Cubic awarded $4.1 million Training Order for U.S.... » SAN DIEGO, Calif.: Cubic Corporation has announced that it was awarded a new order valued at $4.1 mi... Clavister receives initial order to secure 40 re... » Clavister receives initial order to secure 40 regional offices for Brazilian federal authority, foll... KEY ROLE OF TRAINING AND DEVELOPMENT IN THE SECURI... » Education is a process of giving and receiving systematic instruction and skills especially at a sch... Varonis DatAnywhere enables ATMI employees to shar... » LONDON (UK): Varonis Systems, Inc. has announced it has enabled the employees of ATMI to use cloud-s... The Devil is in the Data - Infographic » Irish image and data auditing company PixAlert have released an infographic highlighting the signifi... Wargaming Brings its Naval MMO to gamescom 2014 » Wargaming has announced its presence at gamescom 2014, the world's largest trade fair for interactiv... Barracuda Backup achieves VMware Ready status » Basingstoke: Barracuda Networks, Inc. has announced that Barracuda Backup has achieved VMware Ready™... Valuing the Police Report » Her Majesty's Inspectorate of Constabulary (HMIC) has rated the Metropolitan Police Service (MPS) as... Fonix Mobile selects Alert Logic to extend its s... » London: London-based SMS messaging and mobile payment billing company Fonix Mobile has chosen Alert ...

CLICK HERE TO

Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.

READ MORE

Subscribe to Vigilance Weekly

Information Security Header

UK: Ahead of a revamped DEV522: Defending Web Applications Security Essentials course which will debut at SANS Dubai this October, course tutor Jason Lam urges organisations within the region to take a closer look at secure development processes. “Many organisations in the region are increasingly utilising outsourced development to partners in India and China which offer many cost benefits,” explains Lam, “The level of coding is often very good but organisations must still control risk and mandate the security level and defensive requirements – the reality is that you can’t outsource risk.”

 

Lam suggests that organisations have not developed enough skill in defining and managing best practice for working with external development contractors. “The customer must always draft the development framework and then be prepared to test that the application is secure and meets the agreed standard.”

Although a valuable tool, Lam suggests that automated methods for testing the security of applications should not be the only method, “What these tools can’t test for are vulnerabilities that have emerged during development due to poorly defined logic or processes,” says Lam, “Automated testing tools can be effective in finding vulnerabilities such as SQL injection and XSS once the entry points to the web site are located, often times, the testing tools miss a large portion of the site and are totally ignorant to the business logic issues within the website.”

The DEV522 course has been updated extensively to cover some of the major trends in software development and Lam points to the HTML 5 sections as a great example of why organisations have to continually help staff to maintain a relevant skill set. “HTML5 is an incredibly powerful tool set that in many way makes for an easier and more efficient development framework,” says Lam, “But it also has a different set of requirements in terms of secure development which need to be understood and considered to create secure applications. Like all systems, there are also unique weaknesses and potential vulnerabilities when working within HTML 5 and the course will show how developers can mitigate these risks.”

Alongside his role as a certified SANS instructor, Lam heads up cyber defence at a large global financial organisation in Canada and holds a BA in computer science from York University in Toronto, Ontario, as well as the CISSP, GCIA, GCFW, GCUX, GCWN, and GCIH certifications.

The expert also points out that the OWASP Top 10 list of vulnerabilities are still out in the wild and that even with advances in modern programming languages with built in defence mechanisms, there is still a lack of core security skills at the most fundamental level. “Most university courses are still missing out on teaching secure development techniques as an active part of the curriculum,” he points out, “and this imbalance means that organisations must start from the assumption that developers, either in-house or outsourced, may not have these skills by default.”

Lam suggests that every project leader needs to have a baseline set of security skills to allow the sensible creation of a best practice process, “However, there is no universal standard – each organisation needs to build a method that suits its own environment and working practices.”

SANS Dubai 2013, the Gulf Region's largest InfoSec training event will be held at the Hilton Dubai Jumeirah resort from October 26th till November 7th 2013. Alongside Dev522, the event will also host SANS Security 504: Hacker Techniques, Exploits & Incident Handling taught by James Lyne and the popular SEC542: Web App Penetration Testing and Ethical Hacking course with Dave Shackleford. The event is rounded off by FOR408: Computer Forensic Investigations - Windows In-Depth, taught by Jess Garcia