In your opinion, how has the Web security scene evolved in the last few years?

It might sound odd, but one big difference for me is that only a few years ago people barely knew that “Web application security” existed or that firewalls and SSL didn’t protect a website. Today, almost everyone I talk to, from coast to coast and country to country, has that figured out. Now everyone wants to know what the latest trends and best practices are. The other big difference is the availability of knowledge. Before, the information people needed to secure a website really wasn’t documented. Now, people have access to websites with hundreds of white papers, presentations, and books right at their fingertips. If you want to secure a website, the information to do so is out there.

Have new development techniques brought more problems?

Some experts like to say that Ajax or Web 2.0 is the harbinger of new attacks. I’m not one of them. Fundamentally, we’re dealing with the same problems in the same locations. The challenges that Ajax brings land more on the security vendor than on the enterprise. We have to find vulnerabilities in these custom Web applications and Ajax-enabled applications are much more difficult to do so. Read any of Network Computing’s scanner product reviews and you’ll see what I mean.

What are the security tools/services that you use on a daily basis and couldn't live without?

I’ve blogged about the speed hack contests we hold at the office. This is where we race to find the first and the best vulnerability in a never-before-seen-website. For speed, nothing beats Firefox, the Web Developer Toolbar, and having the Paros or Burp proxy handy. If I happen to get stuck on an XSS filter, call up RSnake’s XSS cheat sheet, use the encoders at the bottom, and that usually does the trick.


If I woke up tomorrow back at Yahoo!, or was responsible for the security of any website, (I know I’m biased here) the honest answer is I’d get the Sentinel Service deployed immediately. The service is easy and complete, but most of all a security professional’s time is precious. Sure they could do the vulnerability assessment work themselves with each site update, but it’s a poor use of their time and expertise. Their time and expertise is better spent focusing on strategic solutions and big picture thinking, rather than trying to identify, prioritize and weeding through the next hundred Cross-Site Scripting, SQL Injection, or whatever other vulnerabilities there might be.

Are websites that you assess more insecure today in comparison to 3 years ago?

I’d say today’s websites probably have less vulnerabilities, but they’ve also never been more at risk. While SQL Injection seems to be on the decline and Cross-Site Scripting filters are far more common, the number of attackers and attack techniques has increased dramatically. The bad guys go where the money is and right now that’s the Web. To monetize, all they have to do is capitalize on one single vulnerability. So, if an organization is only going after the low hanging fruit, that isn’t going to help much, since Web attacks are targeted. Websites that do better are the ones whose security posture makes is hard enough on the bad guy where it’s in their best interest to try some place else.