<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:wfw="http://wellformedweb.org/CommentAPI/"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:atom="http://www.w3.org/2005/Atom"
    xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
    xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
    >
<channel>
    <title>AppSec Street Fighter - SANS Institute</title>
    <atom:link href="http://software-security.sans.org/blog/feed" rel="self" type="application/rss+xml" />
    <link>http://software-security.sans.org/blog</link>
    <description>SANS Application Security Street Fighter Blog</description>
    <lastBuildDate>Wed, 19 Jun 2013 11:11:18 +0000</lastBuildDate>
    <language>en</language><item><title>&quot;WhatWorks in AppSec: ASP.NET \u0096 Defend Against Cross-Site Scripting Using The HTML Encode Shortcuts&quot;</title><link>http://software-security.sans.org/blog/2013/05/29/whatworks-in-appsec-asp-net-defend-against-cross-site-scripting-using-the-html-encode-shortcuts</link><comments>http://software-security.sans.org/blog/2013/05/29/whatworks-in-appsec-asp-net-defend-against-cross-site-scripting-using-the-html-encode-shortcuts/#comments</comments><pubDate>Wed, 29 May 2013 8:24:28 +0000</pubDate><dc:creator>SANS Institute</dc:creator><dc:category><![CDATA[.Net]]></dc:category><description><![CDATA[Eric Johnson is an instructor with the SANS Institute for DEV544: Secure Coding in .NET: Developing Defensible Applications, and an information security engineer at a financial institution, where he is responsible for secure code review assessments of Internet facing web applications. Eric has spent nine years working in software development with over five years focusing on ASP .NET web application security. His experience includes software development, secure code review, risk assessment, static source code analysis, and security research. Eric completed a bachelor of science in computer engineering and a master of science in information assurance at Iowa State University. He currently holds the CISSP and GSSP-.NET certifications and is located in Las Vegas, NV.The .NET 4.0 &amp;amp; 4.5 frameworks introduced new syntax shortcuts to HTML encode dynamic   ...]]></description><wfw:commentRss>http://software-security.sans.org/blog/2013/05/29/whatworks-in-appsec-asp-net-defend-against-cross-site-scripting-using-the-html-encode-shortcuts/feed</wfw:commentRss><comments>0</comments></item><item><title>&quot;WhatWorks in AppSec: Log Forging&quot;</title><link>http://software-security.sans.org/blog/2013/05/21/whatworks-in-appsec-log-forging</link><comments>http://software-security.sans.org/blog/2013/05/21/whatworks-in-appsec-log-forging/#comments</comments><pubDate>Tue, 21 May 2013 8:15:38 +0000</pubDate><dc:creator>SANS Institute</dc:creator><dc:category><![CDATA[defense]]></dc:category><dc:category><![CDATA[java]]></dc:category><dc:category><![CDATA[Secure SDLC]]></dc:category><description><![CDATA[Help!!! Developers are going blind from Log Files!This is a post by Sri Mallur, an instructor with the SANS Institute for SANS DEV541: Secure Coding in Java EE: Developing Defensible Applications.Sri is a security consultant at a major healthcare provider who has over 15 years of experience in software development and information security. He has designed and developed applications for large companies in the insurance, chemical, and healthcare industries. He has extensive consulting experience from working with one of the big 5. Sri currently focuses on security in SDLC by working with developers, performing security code reviews and consulting on projects. Sri holds a Masters in industrial engineering from Texas Tech University, Lubbock, TX and an   ...]]></description><wfw:commentRss>http://software-security.sans.org/blog/2013/05/21/whatworks-in-appsec-log-forging/feed</wfw:commentRss><comments>0</comments></item><item><title>&quot;Security Testing: Less, but More Often can make a Big Difference&quot;</title><link>http://software-security.sans.org/blog/2013/01/14/security-testing-less-but-more-often-can-make-a-big-difference</link><comments>http://software-security.sans.org/blog/2013/01/14/security-testing-less-but-more-often-can-make-a-big-difference/#comments</comments><pubDate>Mon, 14 Jan 2013 6:42:06 +0000</pubDate><dc:creator>Jim Bird</dc:creator><dc:category><![CDATA[Pentest]]></dc:category><dc:category><![CDATA[Secure SDLC]]></dc:category><description><![CDATA[Late last year SANS conducted a survey on application security practices in enterprises. One of the questions asked in the survey was how often organizations are doing security testing. The responses were:No security testing policy for critical apps: 13.5%Only when applications are updated, patched or changed: 21.3%Annually: 14.3%Every 3 months: 18.0%Once a month: 9.5%Ongoing: 23.3%What was most interesting to me is that almost  of organizations are doing security testing on an ongoing, near-continuous basis &amp;mdash; testing applications as they are being developed or changed.The only way to test this frequently, and the effective way to scale security testing in large enterprises with thousands of applications and hundreds of web sites, is by relying heavily on   ...]]></description><wfw:commentRss>http://software-security.sans.org/blog/2013/01/14/security-testing-less-but-more-often-can-make-a-big-difference/feed</wfw:commentRss><comments>2</comments></item><item><title>&quot;Ask the Expert - Jim Manico&quot;</title><link>http://software-security.sans.org/blog/2012/11/26/ask-the-expert-jim-manico</link><comments>http://software-security.sans.org/blog/2012/11/26/ask-the-expert-jim-manico/#comments</comments><pubDate>Mon, 26 Nov 2012 5:38:17 +0000</pubDate><dc:creator>SANS Institute</dc:creator><dc:category><![CDATA[Ask the Expert]]></dc:category><dc:category><![CDATA[defense]]></dc:category><dc:category><![CDATA[Top25]]></dc:category><description><![CDATA[Jim Manico is the VP of Security Architecture for WhiteHat Security, a web security firm. Jim is a participant and project manager of the OWASP Developer Cheatsheet series. He is also the producer and host of the OWASP Podcast Series.1. Although SQL Injection continues to be one of the most commonly exploited security vulnerabilities in the wild, Cross Site Scripting (XSS) is still the most common security problem in web applications. Why is this still the case? What makes XSS so difficult for developers to understand and to protect themselves from?Mitigation of SQL Injection, from a developer point of view, is very straight forward. Parameterize your queries and bind your variables!Unfortunately, ]]></description><wfw:commentRss>http://software-security.sans.org/blog/2012/11/26/ask-the-expert-jim-manico/feed</wfw:commentRss><comments>2</comments></item><item><title>&quot;Ask the Expert - Dan Cornell&quot;</title><link>http://software-security.sans.org/blog/2012/11/05/ask-the-expert-dan-cornell</link><comments>http://software-security.sans.org/blog/2012/11/05/ask-the-expert-dan-cornell/#comments</comments><pubDate>Mon, 05 Nov 2012 8:48:11 +0000</pubDate><dc:creator>SANS Institute</dc:creator><dc:category><![CDATA[Ask the Expert]]></dc:category><description><![CDATA[Dan Cornell has over fifteen years of experience architecting and developing web-based software systems. As CTO and Principal, he leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and currently serves as the OWASP San Antonio chapter leader, member of the OWASP Global Membership Committee and co-lead of the OWASP Open Review Project. Dan has spoken at such international conferences as RSA, OWASP AppSec USA, and OWASP EU Research in Greece.The cost of fixing software bugs has been studied for a long time now, with experts like Capers Jones collecting data from development and maintenance projects around the world. But up until recently there has been very little data available on the cost of remediating security vulnerabilities. Denim Group is one   ...]]></description><wfw:commentRss>http://software-security.sans.org/blog/2012/11/05/ask-the-expert-dan-cornell/feed</wfw:commentRss><comments>2</comments></item></channel></rss>