Web 2.0 Security - Defending AJAX, RIA, AND SOA

Web 2.0 Security - Defending AJAX, RIA, AND SOA
| 2007-12-04 00:00:00 | | 0 | Computer Security

Service-Oriented Architecure (SOA), Rich Internet Applications (RIA), and Asynchronous Java and eXtended Markup Language (Ajax) comprise the backbone behind now-widespread Web 2.0 applications, such as MySpace, Google Maps, Flickr, and Live.com. Although these robust tools make next-generation Web applications possible, they also add new security concerns to the fi eld of Web application security. Yamanner-, Sammy-, and Spaceflash-type worms are exploiting client-side Ajax frameworks, providing new avenues of attack, and compromising confidential information. Portals such as Google, Netflix, Yahoo, and MySpace have witnessed new vulnerabilities recently, and these vulnerabilities can be leveraged by attackers to perform phishing, cross-site scripting (XSS), and cross-site request forgery (CSRF) exploitation. Web 2.0 Security: Defending Ajax, RIA, and SOA covers the new field of Web 2.0 security. Written for security professionals and developers, the book explores Web 2.0 hacking methods and helps enhance next-generation security controls for better application security. Readers will gain knowledge in advanced footprinting and discovery techniques; Web 2.0 scanning and vulnerability detection methods; Ajax and Flash hacking methods; SOAP, REST, and XML-RPC hacking; RSS/Atom feed attacks; fuzzing and code review methodologies and tools; and tool building with Python, Ruby, and .NET. Whether you?re a computer security professional, a developer, or an administrator, Web 2.0 Security: Defending Ajax, RIA, and SOA is the only book you will need to prevent new Web 2.0 security threats from harming your network and compromising your data.

User review
Good Reference Book

Buy this book if you want to have decent information on tools to use for testing and defending your applications against various Web 2.0 security-related vulnerabilities. I deducted one star because I felt that some parts of the book were redundant and some concepts were not explained well, but overall I am quite happy with this book!

User review
VERY VERY HIGHLY RECOMMENDED!!

Are you a security- professional or developer? If you are, this book is for you! Author Shreeraj Shah, has done an outstanding job of writing a great book that explores Web 2.0 hacking methods.

Shah, begins by covering real life Web 2.0 applications that offer a better perspective on the overall infrastructure. Next, the author focuses on the overall Web 2.0 changes and their impact on security. Then, he discusses Web services footprinting and identifies access points for SOA as well as an understanding of application discovery and profiling to identify internal Web 2.0 resources. The author continues by discussing the XSS attack vector and its security implications for Web 2.0 applications. In addition, the author explores the security concerns growing around RSS, mashup, and widgets. He also provides an overview of SOA and the security concerns associated with it. Next, the author takes a look at ModSecurity for Apache and IhttpModule for the .NET framework, as well as some tricks with which you can identify Ajax-based requests and act upon them on the server side. Finally, he covers some interesting tools, techniques, references, and cheat sheets.

This most excellent book addresses several critical aspects of Web 2.0 security/. What's most important though, is that this book addresses in detail both tactical attack vectors and defense strategies, while focussing on web 2.0.

Download this book!

Free Ebooks Download

Read more..

Open Source Systems Security Certification

Open Source Systems Security Certification
| 2008-11-14 00:00:00 | | 0 | Computer Security

Open Source Advances in Computer Applications book series provides timely technological and business information for:

Enabling Open Source Systems (OSS) to become an integral part of systems and devices produced by technology companies;

Inserting OSS in the critical path of complex network development and embedded products, including methodologies and tools for domain-specific OSS testing (lab code available), plus certification of security, dependability and safety properties for complex systems;

Ensuring integrated systems, including OSS, meet performance and security requirements as well as achieving the necessary certifications, according to the overall strategy of OSS usage on the part of the adopter.

The first attempt to create a standard for security certification of software dates back to 1985 with the creation of the TCSEC standard, commonly referred to as Orange Book (USDoD 1985) in the US. In the following years, the need of such a certification also emerged in other countries, leading to the creation of similar local security certification such as ITSEC in Europe (ITSEC 1991) and CTCPEC in Canada (CSE 1993). Since these certifications are totally independent from each other, the cost of certifying software at an international level was obviously high. This was one of the key factors that led to the creation of an international standard for software security certification.

Open Source Systems Security Certification discusses Security Certification Standards and establishes the need to certify open source tools and applications. This includes the international standard for the certification of IT products (software, firmware and hardware) Common Criteria (ISO/IEC 15408) (CC 2006), a certification officially adopted by the governments of 18 nations, including United States, Germany, France, UK and Italy.

Without security certification, open source tools and applications are neither secure nor trustworthy. Open Source Systems Security Certification also addresses and analyzes the urgency of security certification for security-sensible markets, such as telecommunications, government and the military through provided case studies.

Open Source Systems Security Certification is designed for professionals, consultants and companies trying to implement an OSS-aware IT governance strategy, SMEs looking for a way to attract new markets traditionally held by proprietary products (e.g., network security and operation centers, Linux-based network switching systems) or to reduce costs. OSS development communities wishing to ensure their products become part of dynamically composed complex systems will find this volume invaluable. This book is also suitable for researchers and advanced-level students in computer science.

 

Download this book!

Free Ebooks Download