Re: applet security

["Dean H. Saxe" <dean () fullfrontalnerdity com>]

By definition, the applet will always run in a sandboxed environment  
with very limited privileges *unless* the user has granted specific  
privileges to the applet.

-dhs

Dean H. Saxe, CEH
dean () fullfrontalnerdity com
"[U]nconstitutional behavior by the authorities is constrained only  
by the peoples' willingness to contest them"
    --John Perry Barlow


On Jan 9, 2006, at 9:27 AM, Andrew Chong wrote:

> Just a quick comment, not thorough though.
>
> I believe the auditor concern is on the client-side when the applet is
> run on the users browser.
>
> You can question the auditor concern in what specific areas he is
> concern with. i.e. does the applet code run in a sand-box?
>
> Does the auditor want to do a code review? Does the applet write any
> files to the user computer? If yes, what are the control to ensure
> privacy issues. Does the applet send user information back to the your
> server. If so, what type of information? Finacial, restricted, public
> available? (data classificaton)
>
> Logically, most auditors will ask what are the technically controls  
> and
> management controls for your server side (servlets, ASP, PERL, CGI)
> rather than client end.
>
> Regards,
> Andrew Chong, CISSP
>
> -----Original Message-----
> From: test.future () gmail com [mailto:test.future () gmail com]
> Sent: Monday, January 09, 2006 6:25 PM
> To: webappsec () securityfocus com
> Subject: applet security
>
>
> Our auditor advised that controls have to be in place to use applet in
> web application. I wonder what kind of controls is available? I  
> searched
> owasp but can't find anything. Thanks for any advice.
>
> ---------------------------------------------------------------------- 
> --
> -------
> Watchfire's AppScan is the industry's first and leading web  
> application
> security testing suite, and the only solution to provide comprehensive
> remediation tasks at every level of the application. See for yourself.
> Download AppScan 6.0 today.
>
> https://www.watchfire.com/securearea/appscansix.aspx? 
> id=701300000003Ssh
> ---------------------------------------------------------------------- 
> --
> -------
>
>
> ---------------------------------------------------------------------- 
> ---------
> Watchfire's AppScan is the industry's first and leading web  
> application
> security testing suite, and the only solution to provide comprehensive
> remediation tasks at every level of the application. See for yourself.
> Download AppScan 6.0 today.
>
> https://www.watchfire.com/securearea/appscansix.aspx? 
> id=701300000003Ssh
> ---------------------------------------------------------------------- 
> ---------


-------------------------------------------------------------------------------
Watchfire's AppScan is the industry's first and leading web application 
security testing suite, and the only solution to provide comprehensive 
remediation tasks at every level of the application. See for yourself. 
Download AppScan 6.0 today.

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
-------------------------------------------------------------------------------