Re: [WEB SECURITY] Interview With Jeremiah Grossman on ClickJacking attack

[Bil Corry <bil@xxxxxxxxx>]

Martin O'Neal wrote on 10/6/2008 11:06 AM: 
> Many of us aren't sitting on our wobbly corporate arses.  We are 
> diligently working away to help organisations fix their problems at 
> source; in the applications.

Rafal's point of becoming "fix it" people was calling out to organizations on a budget; which presumably means those that can't afford the services of Corsaire.  Given the magnitude of the number of sites compromised by some recent SQLi attacks, clearly there is a huge gaping hole between "how to exploit" and "how to protect."

Last year, I was in a position where I needed to hire a handful of web developers and as part of my interview process, I asked each one to describe XSS, CSRF, and SQLi and the ways to mitigate them within a webapp.  Out of the thirty or so interviewees, only one could describe SQLi, and no one could discuss XSS and CSRF.  I got a lot of comments such as, "I've heard of that before, but I'm not sure exactly what it is."  I had to shift my original hiring criteria (and expectations) and do training for all the new hires.

Beyond that though is an even more fundamental problem -- many small sites believe they are not a target because they don't store credit card information or other private data.  I recently spoke at a webapp dev conference and spent the first 10 minutes discussing why developers should even care about webappsec before I could even get into XSS, CSRF, etc.  Clearly there are a lot of resources available for anyone so inclined to learn, but if the small sites don't believe they're a target, then they're not going to pay attention to anything security-related.


- Bil


----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA