Oct 14, 2011 OWASP Enterprise Security API (ESAPI)

The ESAPI is a free and open collection of all the security methods that a developer needs to build a secure Web application. You can only use the interfaces and build your own implementation using the infrastructure of your company. Or, you can user the reference implementation as a starting point. In concept, the API is independent of language. However, the first deliverable of the project is a Java API and a Java reference implementation. Efforts to build ESAPI in. NET and PHP are running.

Unfortunately, the available platforms and tools (Java EE, Struts, Spring, etc ...) simply do not provide sufficient protection. This leaves developers with responsibility for designing and building security mechanisms. This reinvented the wheel for each application leads to a loss of time and massive security holes.

Cost savings through reduced development time and increased safety due to use of strong security methods tested and carefully designed to provide developers with massive advantages over organizations that are trying to deal with security using secure programming techniques for this purpose. This API is designed to automatically take over many aspects of application security, making these issues invisible to developers.

OWASP ESAPI project is led by Jeff Williams , who serves as volunteer chairman of OWASP and is the CEO of Aspect Security. Jeff is a software developer that specializes in application security since 1995. ESAPI is the result of more than a decade of code review and penetration testing of critical business applications. If you want to volunteer to help in the project, may contact you in jeff.williams @ owasp.org.

Download Now

This version is the first public release and will undoubtedly undergo a significant revision in the coming months. We are looking for organizations willing to use ESAPI in a pilot program and work with us to make this library better. Please contact jeff.williams @ owasp.org for more information. If you are interested in application security, please join the mailing list OWASP ESAPI and help make ESAPI better!

• Repository
• Report problems

Latest version (earlier versions are published in the repository)

• Complete ESAPI JAR file v1.1.1 (Java 1.4 compatible)
• Source file ESAPI v1.1.1

Getting Started

• Online Javadoc
• PowerPoint Presentation ESAPI

Architecture

The ESAPI architecture is very simple, it's just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to adjust the existing application security, and provide a solid foundation for further development. New development projects should consider integrating ESAPI in your framework to make security happen automatically. ESAPI ESAPI comes with a filter that minimizes the changes required in its application base.

ESAPI covers most of the security challenges faced by developers. ESAPI provides the ability for developers to create applications that are protected against almost all the risks described in the OWASP Top Ten . Compare this coverage with automated scanning tools and static analysis, and then consider as better spent their time.

[ Read More ]

Oct 13, 2011 Heard of 2D bar codes? It's awesome!

QR code from the URL http://qrcode.kaywa.com/

While crawling through web, I found this awesome technique called QR codes. It is short for "Quick Response Code", a 2D bar code system, which first introduced in Japan way back in time (1994 precisely, says wikipedia :) ). These codes could be the future, where every magazines and papers carry out these to give some important details or the URL of it to their readers. These codes can be easily read by an Apple iPhone, Android... or basically from any phone with a camera and a QR reader app!
So, what is it exactly?
You might be wondering is it a way to communicate secret message? or just another bar code to be used in your grocery store. Well, it's not a secret cipher where you have to know the key to decode it. Well then, what's the use of it? Suppose you are this big guy/gal who has a business card for yourself. How much time will customers of yours will keep your card in their pocket when you give it to them; a month? say two months max, then surely they might lose it somewhere or may be end up in laundry! But if you print your QR code in it, they can scan it, and store your info as a 'contact' in their phone. Problem solved! One other occasion is, you can show your web sites URL from that image, and interested people can quickly scan it and go to your site. For instance, the above QR image opens this weblog. QR codes are expected to be a popular technology especially between smartphone users.
How to create them
I used QR-Code Generator to create them. There are plenty of free sites available for creating these QR codes. From there, you can create an image out of a URL, which when detected, will redirect you to that URL in your mobile browser. Else, you can simply store a text you like. For example, here's my business card. Decode it and see ;)

Here's a video of using QR codes in business cards.

[ Read More ]

Oct 7, 2011 HTML5 vs Flash – How Does It Affect You?

The manner in which most videos are currently played through browsers these days is through a Flash plugin. This works pretty well but Flash unfortunately requires a lot of computing power. A new web standard HTML5 is trying to change that. HTML5 has been designed with audio and video codecs which should take less processing [...]

[ Read More ]

The iPhone and HTML5 – What’s Happening There?

There has been a fair amount of press concerning the new HTML5 standard and how it may impact video playback and rich web content as an alternative to Flash. HTML5 is supposed to be more efficient than Flash in terms of processing load. The testing is inconclusive but one area where HTML5 seems to be [...]

[ Read More ]