<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>

<channel>
	<title>good code, secure software</title>
	<atom:link href="http://mikeware.us/goodcode/?feed=rss2" rel="self" type="application/rss+xml" />
	<link>http://mikeware.us/goodcode</link>
	<description>It's time to start being less reactive and more proactive</description>
	<pubDate>Sat, 17 Dec 2011 16:07:02 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.6.3</generator>
	<language>en</language>
			<item>
		<title>My Threat Modeling Talk @ OWASP AppSec USA</title>
		<link>http://mikeware.us/goodcode/?p=270</link>
		<comments>http://mikeware.us/goodcode/?p=270#comments</comments>
		<pubDate>Sat, 17 Dec 2011 16:07:02 +0000</pubDate>
		<dc:creator>mikeware</dc:creator>
		
		<category><![CDATA[Secure Design]]></category>

		<category><![CDATA[Threat Modeling]]></category>

		<category><![CDATA[linkedin]]></category>

		<guid isPermaLink="false">http://mikeware.us/goodcode/?p=270</guid>
		<description><![CDATA[OWASP recently posted videos of all talks from the OWASP AppSec USA conference held in Minneapolis in September 2011.
You can find my talk on an approach for &#8220;simplifying threat modeling&#8221; here. Grab my slides here.
Check it out and let me know what you think. Would love to hear from you and your thoughts on where [...]]]></description>
		<wfw:commentRss>http://mikeware.us/goodcode/?feed=rss2&amp;p=270</wfw:commentRss>
		</item>
		<item>
		<title>GC Labs: Securing URL Redirects</title>
		<link>http://mikeware.us/goodcode/?p=260</link>
		<comments>http://mikeware.us/goodcode/?p=260#comments</comments>
		<pubDate>Mon, 04 Oct 2010 00:46:09 +0000</pubDate>
		<dc:creator>mikeware</dc:creator>
		
		<category><![CDATA[Indirection]]></category>

		<category><![CDATA[URL Redirects]]></category>

		<category><![CDATA[Redirection]]></category>

		<guid isPermaLink="false">http://mikeware.us/goodcode/?p=260</guid>
		<description><![CDATA[Can attackers control URL redirection functionality exposed by your application? 

Unvalidated Redirects and Forwards is #10 on the 2010 <a href="http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project">OWASP Top Ten 10 List</a>. Sites that are vulnerable often expose a servlet or server-side script that constructs the URL being transferred to using data that is received from the client (i.e., something that can be controlled by an attacker). A lot of sites simply accept a URL as input to the redirection script, and that's what gets them into trouble.]]></description>
		<wfw:commentRss>http://mikeware.us/goodcode/?feed=rss2&amp;p=260</wfw:commentRss>
		</item>
		<item>
		<title>GC Labs: Mitigating XML Entity Expansion Attacks with Xerces</title>
		<link>http://mikeware.us/goodcode/?p=234</link>
		<comments>http://mikeware.us/goodcode/?p=234#comments</comments>
		<pubDate>Sat, 20 Mar 2010 15:57:37 +0000</pubDate>
		<dc:creator>mikeware</dc:creator>
		
		<category><![CDATA[GC Labs]]></category>

		<category><![CDATA[Secure Coding]]></category>

		<category><![CDATA[XML Entity Expansion]]></category>

		<category><![CDATA[XML Processing]]></category>

		<category><![CDATA[entity expansion]]></category>

		<category><![CDATA[Xerces]]></category>

		<category><![CDATA[XML]]></category>

		<guid isPermaLink="false">http://mikeware.us/goodcode/?p=234</guid>
		<description><![CDATA[Here are a few typical questions from my &#8220;assessment runbook&#8221; that I ask for an app that accepts and parses XML data that can be controlled by an attacker (think file uploads, web services, stored XML content made up of inputs from an external user, etc.):
(1) Is there a check to enforce a maximum number [...]]]></description>
		<wfw:commentRss>http://mikeware.us/goodcode/?feed=rss2&amp;p=234</wfw:commentRss>
		</item>
		<item>
		<title>Are your regular expressions anchored?</title>
		<link>http://mikeware.us/goodcode/?p=216</link>
		<comments>http://mikeware.us/goodcode/?p=216#comments</comments>
		<pubDate>Fri, 26 Feb 2010 14:49:39 +0000</pubDate>
		<dc:creator>mikeware</dc:creator>
		
		<category><![CDATA[Input Validation]]></category>

		<category><![CDATA[regex]]></category>

		<category><![CDATA[validation]]></category>

		<guid isPermaLink="false">http://mikeware.us/goodcode/?p=216</guid>
		<description><![CDATA[I recently found a SQL injection vulnerability in a J2EE app where a request parameter is used to construct a dynamic JDBC query via string concatenation. When I discussed the issue with the developer, he became confused and said &#8220;Wait, I&#8217;m validating this field against a white list like you said a few weeks ago, [...]]]></description>
		<wfw:commentRss>http://mikeware.us/goodcode/?feed=rss2&amp;p=216</wfw:commentRss>
		</item>
		<item>
		<title>BSIMM: A Descriptive Model of Software Security</title>
		<link>http://mikeware.us/goodcode/?p=211</link>
		<comments>http://mikeware.us/goodcode/?p=211#comments</comments>
		<pubDate>Thu, 28 Jan 2010 15:29:53 +0000</pubDate>
		<dc:creator>mikeware</dc:creator>
		
		<category><![CDATA[Build Security In]]></category>

		<category><![CDATA[Maturity]]></category>

		<guid isPermaLink="false">http://mikeware.us/goodcode/?p=211</guid>
		<description><![CDATA[Gary McGraw discusses prescriptive vs. descriptive models, and why/how BSIMM helps model the reality of software security initiatives in our industry.
]]></description>
		<wfw:commentRss>http://mikeware.us/goodcode/?feed=rss2&amp;p=211</wfw:commentRss>
		</item>
		<item>
		<title>Teaching Fortify SCA About Confidential Data</title>
		<link>http://mikeware.us/goodcode/?p=204</link>
		<comments>http://mikeware.us/goodcode/?p=204#comments</comments>
		<pubDate>Wed, 25 Nov 2009 02:52:25 +0000</pubDate>
		<dc:creator>mikeware</dc:creator>
		
		<category><![CDATA[Fortify SCA]]></category>

		<category><![CDATA[Fortify]]></category>

		<category><![CDATA[Static Analysis]]></category>

		<guid isPermaLink="false">http://mikeware.us/goodcode/?p=204</guid>
		<description><![CDATA[In Cigital's latest newsletter, I explain a few <a href="http://www.cigital.com/newsletter/2009-11-tips.php">tips for gaining assurance that Fortify SCA is "seeing" code (specifically private or confidential data) the way you think it should be</a>.]]></description>
		<wfw:commentRss>http://mikeware.us/goodcode/?feed=rss2&amp;p=204</wfw:commentRss>
		</item>
		<item>
		<title>OWASP XSS cheat sheet</title>
		<link>http://mikeware.us/goodcode/?p=194</link>
		<comments>http://mikeware.us/goodcode/?p=194#comments</comments>
		<pubDate>Fri, 03 Apr 2009 01:28:45 +0000</pubDate>
		<dc:creator>mikeware</dc:creator>
		
		<category><![CDATA[Cross-site Scripting]]></category>

		<category><![CDATA[XSS]]></category>

		<guid isPermaLink="false">http://mikeware.us/goodcode/?p=194</guid>
		<description><![CDATA[OWASP has published a very well written <a href="http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet" target="_blank">XSS cheat sheet</a>.]]></description>
		<wfw:commentRss>http://mikeware.us/goodcode/?feed=rss2&amp;p=194</wfw:commentRss>
		</item>
		<item>
		<title>Applying Basic Trust Concepts to Software Module Design</title>
		<link>http://mikeware.us/goodcode/?p=158</link>
		<comments>http://mikeware.us/goodcode/?p=158#comments</comments>
		<pubDate>Fri, 20 Mar 2009 19:07:06 +0000</pubDate>
		<dc:creator>mikeware</dc:creator>
		
		<category><![CDATA[Secure Design]]></category>

		<category><![CDATA[Module]]></category>

		<category><![CDATA[Trust]]></category>

		<guid isPermaLink="false">http://mikeware.us/goodcode/?p=158</guid>
		<description><![CDATA[As a consultant who reviews code a lot, this statement immediately got me thinking about trust at the code-level. Trust issues are fun to think about -- not only because there are bookoos of trust-related issues in today's apps (particularly mashups) but also because they are difficult to mitigate through good defensive design. As a software design enthusiast, I believe we can apply the concept of trust attacks as described above to low-level module design (think the <i>Class</i> keyword in Java or <i>class</i> keyword is C++) by changing one word in the second sentence:]]></description>
		<wfw:commentRss>http://mikeware.us/goodcode/?feed=rss2&amp;p=158</wfw:commentRss>
		</item>
		<item>
		<title>Building Security In Maturity Model (BSIMM)</title>
		<link>http://mikeware.us/goodcode/?p=140</link>
		<comments>http://mikeware.us/goodcode/?p=140#comments</comments>
		<pubDate>Wed, 11 Mar 2009 04:24:32 +0000</pubDate>
		<dc:creator>mikeware</dc:creator>
		
		<category><![CDATA[Build Security In]]></category>

		<category><![CDATA[Maturity]]></category>

		<category><![CDATA[BSIMM]]></category>

		<category><![CDATA[Process]]></category>

		<guid isPermaLink="false">http://mikeware.us/goodcode/?p=140</guid>
		<description><![CDATA[A lot has been said about what companies *should do* to build secure software. Ever wonder what companies *really do*? Now you can -- the <a href="http://bsi-mm.com" target="_blank">Building Security In Maturity Model (BSIMM)</a> recently <a href="http://blogs.wsj.com/digits/2009/03/04/new-effort-hopes-to-improve-software-security/" target="_blank">went public</a>.]]></description>
		<wfw:commentRss>http://mikeware.us/goodcode/?feed=rss2&amp;p=140</wfw:commentRss>
		</item>
		<item>
		<title>IO Chokepoints: J2EE Filters</title>
		<link>http://mikeware.us/goodcode/?p=115</link>
		<comments>http://mikeware.us/goodcode/?p=115#comments</comments>
		<pubDate>Wed, 14 Jan 2009 06:13:51 +0000</pubDate>
		<dc:creator>mikeware</dc:creator>
		
		<category><![CDATA[Secure Coding]]></category>

		<category><![CDATA[Secure Design]]></category>

		<category><![CDATA[IO Chokepoints]]></category>

		<category><![CDATA[J2EE]]></category>

		<guid isPermaLink="false">http://mikeware.us/goodcode/?p=115</guid>
		<description><![CDATA[This is the first post in a series covering tactics for implementing input and output chokepoints in J2EE. My goal is to describe different techniques in separate posts and then summarize the tradeoffs involved in putting them in place in a final post. In this first post, I'll show you how to setup a J2EE servlet filter to perform HTML escaping on multiple servlet-related input sources.]]></description>
		<wfw:commentRss>http://mikeware.us/goodcode/?feed=rss2&amp;p=115</wfw:commentRss>
		</item>
	</channel>
</rss>

