21. // ... String password = request.getParameter( "password" ); // ... " userid='" + u sername + "' " + " AND password='" + password + "'" ; // ... String username = request.getParameter ( "username" ) ; String query = "SELECT …" + username ResultSet rs = stmt.executeQuery(query); String username = request.getParameter( "username" ); String query = "SELECT * from tUsers where " +' ResultSet rs = stmt.executeQuery(query); Sistemi White-Box (es. SQL Injection) … a un Sink da un Source …
22. IBM Rational AppScan Ecosystem AppScan Standard Ed (desktop) AppScan Enterprise user (web client) AppScan Source Ed for Automation IBM Rational Web Based Training for AppScan AppScan Source Ed for Developer / Remediation AppScan Ent. QuickScan (web client) AppScan Tester Ed (scanning agent) (QA clients) Rational Build Forge Rational Quality Manager Rational Application Developer Rational Software Analyzer Rational ClearCase Rational ClearQuest / Issue Management CODE Build security testing into the IDE* BUILD Automate Security / Compliance testing in the Build Process QA Security / compliance testing incorporated into testing & remediation workflows SECURITY Security & Compliance Testing, oversight, control, policy, audits AppScan Source Ed for Security AppScan Enterprise / Reporting Console / Source Ed Core
Although the number of vulnerabilities affecting Web applications has grown at a staggering rate, the growth demonstrated in the first half of 2009 and continuing through the second half may indicate the start of a plateau, at least in standard (off-the-shelf) software applications for the Web. These figures do not include custom-developed Web applications or customized versions of these standard packages, which also introduce vulnerabilities.
![Agenda ,[object Object],[object Object],[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)