NICE launches video search solution to pinpoint an... » RA’ANANA, ISRAEL: When time is of the essence, security and public safety organizations will no long... Checkpoint Systems implements RFID at Inditex Dist... » Checkpoint Systems has been selected by the Inditex Group to implement Radio Frequency Identificatio... Research reveals growing concern about fraud thr... » A new Transactis-Retail Knowledge survey of leading loss prevention professionals shows that 88% see... NICC Sets new requirements for Customer Line Ident... » London: NICC, the UK’s technical forum for telecommunications, has published its updated specificati... First all-amputee team set record with English Cha... » Four Blesma Members have become the first all-amputee team to successfully swim the English Channel.... World of tanks to get race mode » Wargaming has announced the addition of Tank Rally mode to its free-to-play online action game World... Alert Logic launches UK Data Centre » London, UK: Alert Logic has completed its European Data Centre and now available for partners and cu... 20th Anniversary of VAWA: "...the decency of the A... » JB...advancing Bidenism with respect to womenfolks Watch the Video: www.youtube.com/embed/HpL-A6Z... Lord-Lieutenant of Hampshire presents Sonardyne wi... » Lord-Lieutenant of Hampshire presents Sonardyne with Queen’s Award for 6G Sonardyne International L... Rehousing TYphoon Aircraft of Number 1 (Fighter) ... » The Rt Hon Michael Fallon MP, UK Secretary of State for Defence The Typhoon aircraft of Number 1(Fi...

CLICK HERE TO

Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.

READ MORE

Subscribe to Vigilance Weekly

Information Security Header

UK: Ahead of a revamped DEV522: Defending Web Applications Security Essentials course which will debut at SANS Dubai this October, course tutor Jason Lam urges organisations within the region to take a closer look at secure development processes. “Many organisations in the region are increasingly utilising outsourced development to partners in India and China which offer many cost benefits,” explains Lam, “The level of coding is often very good but organisations must still control risk and mandate the security level and defensive requirements – the reality is that you can’t outsource risk.”

 

Lam suggests that organisations have not developed enough skill in defining and managing best practice for working with external development contractors. “The customer must always draft the development framework and then be prepared to test that the application is secure and meets the agreed standard.”

Although a valuable tool, Lam suggests that automated methods for testing the security of applications should not be the only method, “What these tools can’t test for are vulnerabilities that have emerged during development due to poorly defined logic or processes,” says Lam, “Automated testing tools can be effective in finding vulnerabilities such as SQL injection and XSS once the entry points to the web site are located, often times, the testing tools miss a large portion of the site and are totally ignorant to the business logic issues within the website.”

The DEV522 course has been updated extensively to cover some of the major trends in software development and Lam points to the HTML 5 sections as a great example of why organisations have to continually help staff to maintain a relevant skill set. “HTML5 is an incredibly powerful tool set that in many way makes for an easier and more efficient development framework,” says Lam, “But it also has a different set of requirements in terms of secure development which need to be understood and considered to create secure applications. Like all systems, there are also unique weaknesses and potential vulnerabilities when working within HTML 5 and the course will show how developers can mitigate these risks.”

Alongside his role as a certified SANS instructor, Lam heads up cyber defence at a large global financial organisation in Canada and holds a BA in computer science from York University in Toronto, Ontario, as well as the CISSP, GCIA, GCFW, GCUX, GCWN, and GCIH certifications.

The expert also points out that the OWASP Top 10 list of vulnerabilities are still out in the wild and that even with advances in modern programming languages with built in defence mechanisms, there is still a lack of core security skills at the most fundamental level. “Most university courses are still missing out on teaching secure development techniques as an active part of the curriculum,” he points out, “and this imbalance means that organisations must start from the assumption that developers, either in-house or outsourced, may not have these skills by default.”

Lam suggests that every project leader needs to have a baseline set of security skills to allow the sensible creation of a best practice process, “However, there is no universal standard – each organisation needs to build a method that suits its own environment and working practices.”

SANS Dubai 2013, the Gulf Region's largest InfoSec training event will be held at the Hilton Dubai Jumeirah resort from October 26th till November 7th 2013. Alongside Dev522, the event will also host SANS Security 504: Hacker Techniques, Exploits & Incident Handling taught by James Lyne and the popular SEC542: Web App Penetration Testing and Ethical Hacking course with Dave Shackleford. The event is rounded off by FOR408: Computer Forensic Investigations - Windows In-Depth, taught by Jess Garcia