Security savvy Brits will shop online safely this ... » LONDON - ESET has commissioned a survey of online shopping trends in the UK which has revealed that ... Aeriandi unveils new line-up of PCI DSS complian... » OXFORD, UK: Aeriandi has unveiled its new portfolio of secure voice services. Agent Pay, IVR Assist,... Digital preservation goes mainstream as organiza... » Digital Preservation specialist, Preservica, has seen a 50% growth in new customer signings in the l... CIOReview selects Cryptosoft for 50 most promising... » Annual list showcases the 50 Most Promising IOT Solution Providers 2015. Cryptosoft makes it to CIOR... Qognify scores 5 Homeland Security Awards from Gov... » Qognify, formerly NICE Security, has announced that, for the fourth consecutive year, its physical s... AdaptiveMobile identifies hundreds of millions o... » DUBLIN AND DALLAS: AdaptiveMobile has released a new report entitled ‘Turning Grey into Gold – Adapt... Tripwire introduces ‘Search by Hash’ Functionali... » London, UK: Tripwire, Inc. has announced new search by hash functionality in Tripwire® Enterprise th... The insecurities that haunt public Wi-Fi » It’s no surprise to anyone that Wi-Fi use continues to grow. However, what is hard to believe is tha... International Alert welcomes UK Government's ... » Today International Alert, Europe’s leading peacebuilding NGO, welcomed the UK Government’s commitme... High-Tech Bridge launched a new addition to its ... » The new package, ImmuniWeb Continuous, provides customers with a real-time interactive dashboard for...


Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.


Subscribe to Vigilance Weekly

Information Security Header

UK: Ahead of a revamped DEV522: Defending Web Applications Security Essentials course which will debut at SANS Dubai this October, course tutor Jason Lam urges organisations within the region to take a closer look at secure development processes. “Many organisations in the region are increasingly utilising outsourced development to partners in India and China which offer many cost benefits,” explains Lam, “The level of coding is often very good but organisations must still control risk and mandate the security level and defensive requirements – the reality is that you can’t outsource risk.”


Lam suggests that organisations have not developed enough skill in defining and managing best practice for working with external development contractors. “The customer must always draft the development framework and then be prepared to test that the application is secure and meets the agreed standard.”

Although a valuable tool, Lam suggests that automated methods for testing the security of applications should not be the only method, “What these tools can’t test for are vulnerabilities that have emerged during development due to poorly defined logic or processes,” says Lam, “Automated testing tools can be effective in finding vulnerabilities such as SQL injection and XSS once the entry points to the web site are located, often times, the testing tools miss a large portion of the site and are totally ignorant to the business logic issues within the website.”

The DEV522 course has been updated extensively to cover some of the major trends in software development and Lam points to the HTML 5 sections as a great example of why organisations have to continually help staff to maintain a relevant skill set. “HTML5 is an incredibly powerful tool set that in many way makes for an easier and more efficient development framework,” says Lam, “But it also has a different set of requirements in terms of secure development which need to be understood and considered to create secure applications. Like all systems, there are also unique weaknesses and potential vulnerabilities when working within HTML 5 and the course will show how developers can mitigate these risks.”

Alongside his role as a certified SANS instructor, Lam heads up cyber defence at a large global financial organisation in Canada and holds a BA in computer science from York University in Toronto, Ontario, as well as the CISSP, GCIA, GCFW, GCUX, GCWN, and GCIH certifications.

The expert also points out that the OWASP Top 10 list of vulnerabilities are still out in the wild and that even with advances in modern programming languages with built in defence mechanisms, there is still a lack of core security skills at the most fundamental level. “Most university courses are still missing out on teaching secure development techniques as an active part of the curriculum,” he points out, “and this imbalance means that organisations must start from the assumption that developers, either in-house or outsourced, may not have these skills by default.”

Lam suggests that every project leader needs to have a baseline set of security skills to allow the sensible creation of a best practice process, “However, there is no universal standard – each organisation needs to build a method that suits its own environment and working practices.”

SANS Dubai 2013, the Gulf Region's largest InfoSec training event will be held at the Hilton Dubai Jumeirah resort from October 26th till November 7th 2013. Alongside Dev522, the event will also host SANS Security 504: Hacker Techniques, Exploits & Incident Handling taught by James Lyne and the popular SEC542: Web App Penetration Testing and Ethical Hacking course with Dave Shackleford. The event is rounded off by FOR408: Computer Forensic Investigations - Windows In-Depth, taught by Jess Garcia