Re: Web Security - what do you do?

[Gary Flynn <flynngn () JMU EDU>]

Karen Stopford wrote:
> I don’t think installing a Web Application Firewall is an adequate 
> compensating control for vulnerable code. 

Agreed.

 Appropriate bounds setting,
> input validation, use of stored procedures, etc. should be a requirement 
> for any in-house or COTS application.

How do you verify the development process and implementation
on COTS applications?

Have you been able to deny a departmental purchase of an
application because it doesn't use stored procedures
or because they can't or won't make their development process
and implementation details available for inspection?


--
Gary Flynn
Security Engineer
James Madison University
www.jmu.edu/computing/security

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature