<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Secure By Default</title>
	<atom:link href="http://www.securebydefault.info/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.securebydefault.info</link>
	<description>Designing, building and testing software for better security</description>
	<lastBuildDate>Mon, 09 Jan 2012 16:34:10 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>How to install Arachni on Mac OS X Lion</title>
		<link>http://www.securebydefault.info/2012/01/09/how-to-install-arachni-on-mac-os-x-lion/</link>
		<comments>http://www.securebydefault.info/2012/01/09/how-to-install-arachni-on-mac-os-x-lion/#comments</comments>
		<pubDate>Mon, 09 Jan 2012 16:18:29 +0000</pubDate>
		<dc:creator>stephendv</dc:creator>
				<category><![CDATA[Testing]]></category>

		<guid isPermaLink="false">http://www.securebydefault.info/?p=19</guid>
		<description><![CDATA[Since I am now hairless after installing Arachni on OS X, I&#8217;ll hopefully save someone else the same ordeal. Various problems with the OS X toolchain not playing nice with the latest Ruby, then nokogiri causing a segfault because of using an old version of libxml2&#8230; etc. Anyway, finally got a working version as follows: [...]]]></description>
		<wfw:commentRss>http://www.securebydefault.info/2012/01/09/how-to-install-arachni-on-mac-os-x-lion/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>ORM validation</title>
		<link>http://www.securebydefault.info/2012/01/07/orm-validation/</link>
		<comments>http://www.securebydefault.info/2012/01/07/orm-validation/#comments</comments>
		<pubDate>Sat, 07 Jan 2012 18:45:20 +0000</pubDate>
		<dc:creator>stephendv</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.securebydefault.info/?p=16</guid>
		<description><![CDATA[@EoinKeary got me thinking about data validation again, in particular the security implications of relying on data val in the ORM tier when numerous attacks can be performed on the presentation and middle tiers before hitting ORM. I still prefer the approach of only defining data validation rules in one place, and that place should [...]]]></description>
		<wfw:commentRss>http://www.securebydefault.info/2012/01/07/orm-validation/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>HTTP Fingerprinting tool</title>
		<link>http://www.securebydefault.info/2009/11/10/http-fingerprinting-tool/</link>
		<comments>http://www.securebydefault.info/2009/11/10/http-fingerprinting-tool/#comments</comments>
		<pubDate>Tue, 10 Nov 2009 12:23:44 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[http fingerprinting]]></category>

		<guid isPermaLink="false">http://www.securebydefault.info/2009/11/10/http-fingerprinting-tool/</guid>
		<description><![CDATA[A promising HTTP fingerprinting tool: http://useofwords.blogspot.com/2009/11/introducing-htrosbif.html]]></description>
		<wfw:commentRss>http://www.securebydefault.info/2009/11/10/http-fingerprinting-tool/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Security Gap Analysis of Struts2</title>
		<link>http://www.securebydefault.info/2009/05/11/security-gap-analysis-of-struts2/</link>
		<comments>http://www.securebydefault.info/2009/05/11/security-gap-analysis-of-struts2/#comments</comments>
		<pubDate>Mon, 11 May 2009 07:57:54 +0000</pubDate>
		<dc:creator>stephendv</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[gap analysis]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[struts2]]></category>

		<guid isPermaLink="false">http://www.securebydefault.info/2009/05/11/security-gap-analysis-of-struts2/</guid>
		<description><![CDATA[http://www.owasp.org/images/b/be/A_Gap_Analysis_of_Application_Security_in_Struts2.pdf]]></description>
		<wfw:commentRss>http://www.securebydefault.info/2009/05/11/security-gap-analysis-of-struts2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>PCI scoring contradiction</title>
		<link>http://www.securebydefault.info/2009/04/20/pci-scoring-contradiction/</link>
		<comments>http://www.securebydefault.info/2009/04/20/pci-scoring-contradiction/#comments</comments>
		<pubDate>Mon, 20 Apr 2009 08:31:15 +0000</pubDate>
		<dc:creator>stephendv</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[CVSSv2]]></category>
		<category><![CDATA[PCI]]></category>

		<guid isPermaLink="false">http://www.securebydefault.info/2009/04/20/pci-scoring-contradiction/</guid>
		<description><![CDATA[Risk ratings in a PCI security assessment are directly based on CVSS v2 scores, here&#8217;s an extract from CVSS v2 scoring guide: SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the impact to a user&#8217;s system could be much greater [...]]]></description>
		<wfw:commentRss>http://www.securebydefault.info/2009/04/20/pci-scoring-contradiction/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Digg like security news site</title>
		<link>http://www.securebydefault.info/2008/09/09/digg-like-security-news-site/</link>
		<comments>http://www.securebydefault.info/2008/09/09/digg-like-security-news-site/#comments</comments>
		<pubDate>Tue, 09 Sep 2008 11:35:09 +0000</pubDate>
		<dc:creator>stephendv</dc:creator>
				<category><![CDATA[News]]></category>

		<guid isPermaLink="false">http://www.securebydefault.info/2008/09/09/digg-like-security-news-site/</guid>
		<description><![CDATA[Steve at Mandalorian has created a Diggesque website for security news. Looks spanky. http://news.mandalorian.com/]]></description>
		<wfw:commentRss>http://www.securebydefault.info/2008/09/09/digg-like-security-news-site/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Seam Remoting&#8217;s default allow</title>
		<link>http://www.securebydefault.info/2008/09/08/seam-remotings-default-allow/</link>
		<comments>http://www.securebydefault.info/2008/09/08/seam-remotings-default-allow/#comments</comments>
		<pubDate>Mon, 08 Sep 2008 10:04:46 +0000</pubDate>
		<dc:creator>stephendv</dc:creator>
				<category><![CDATA[Design]]></category>
		<category><![CDATA[frameworks]]></category>

		<guid isPermaLink="false">http://www.securebydefault.info/2008/09/08/seam-remotings-default-allow/</guid>
		<description><![CDATA[Stumbled on another difference in approach between security types and developer types in the Seam remoting functionality. Remoting makes it a doddle to easily access your Seam server side beans on the client side&#8230; including domain objects. E.g. if you had a server side bean called User.java: @Entity public class User { private String username; [...]]]></description>
		<wfw:commentRss>http://www.securebydefault.info/2008/09/08/seam-remotings-default-allow/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Integrating security into QA testing</title>
		<link>http://www.securebydefault.info/2008/02/18/integrating-security-into-qa-testing/</link>
		<comments>http://www.securebydefault.info/2008/02/18/integrating-security-into-qa-testing/#comments</comments>
		<pubDate>Mon, 18 Feb 2008 10:56:25 +0000</pubDate>
		<dc:creator>stephendv</dc:creator>
				<category><![CDATA[Testing]]></category>

		<guid isPermaLink="false">http://www.securebydefault.info/2008/02/18/integrating-security-into-qa-testing/</guid>
		<description><![CDATA[I wrote about this some time ago. Fortify are now doing a webinar on this topic.]]></description>
		<wfw:commentRss>http://www.securebydefault.info/2008/02/18/integrating-security-into-qa-testing/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Security Testing with Watij</title>
		<link>http://www.securebydefault.info/2008/02/15/testing-with-watij/</link>
		<comments>http://www.securebydefault.info/2008/02/15/testing-with-watij/#comments</comments>
		<pubDate>Fri, 15 Feb 2008 20:07:21 +0000</pubDate>
		<dc:creator>stephendv</dc:creator>
				<category><![CDATA[Testing]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[security testing]]></category>
		<category><![CDATA[unit tests]]></category>
		<category><![CDATA[watij]]></category>

		<guid isPermaLink="false">http://www.securebydefault.info/2008/02/15/testing-with-watij/</guid>
		<description><![CDATA[Watij is a tool designed for functional web testing. It&#8217;s effectively a Java API which drives an instance of Internet Explorer. You can then use your favourite unit testing framework to structure tests and make assertions of the results. Like similar functional testing tools, watij can be used to script security defects in web applications. [...]]]></description>
		<wfw:commentRss>http://www.securebydefault.info/2008/02/15/testing-with-watij/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Defining security requirements</title>
		<link>http://www.securebydefault.info/2008/01/12/defining-security-requirements/</link>
		<comments>http://www.securebydefault.info/2008/01/12/defining-security-requirements/#comments</comments>
		<pubDate>Sat, 12 Jan 2008 21:02:47 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[Design]]></category>
		<category><![CDATA[Secure SDLC]]></category>
		<category><![CDATA[security requirements]]></category>
		<category><![CDATA[security standards]]></category>

		<guid isPermaLink="false">http://www.twisteddelight.org/security-testing/2008/01/12/defining-security-requirements/</guid>
		<description><![CDATA[The vast majority of security assessments I&#8217;ve worked on have used &#8220;best practice&#8221; to define the security requirements of the application under test. Clients are content to rely on security assessment firms to decide what should and shouldn&#8217;t be tested, and this is usually OK for bug hunting.  But apart from the well known bugs [...]]]></description>
		<wfw:commentRss>http://www.securebydefault.info/2008/01/12/defining-security-requirements/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>

