There is no doubt in my mind that some very strong experts out there have put WAF or WAF-like technology to good use.  However, WAF is dead and dying regardless.
I think that very large-installation, Internet-facing web applications require Anti-DDoS technology in the form of an appliance, preferably one that does rate-based behavior detection.  I often [...]

As many of you have probably already heard, SANS, in a combined effort with MITRE released the CWE/SANS Top 25 Most Dangerous Programming Errors. There have been numerous discussions on both the Secure Coding List and Webappsec mailing lists, along with a column from Gary McGraw and 11 reasons why Top 10 (or Top [...]

An audit framework for evaluating structured security program frameworks
How many readers implemented a new security plan for 2006 or 2007? How many had clients that implemented a new security program? Which frameworks were involved?
Possible frameworks (Criteria)

No structured security program, or one based around a single vendor or regulation
Mike Rothman’s Pragmatic CSO (P-CSO)
Gunnar Peterson’s [...]

A lot of commotion has recently been stirred up around California Governer’s, Arnold Schwarzennegar’s recent vetoing of a bill (AB 779) that would strictly mandate all merchants to comply with. Many have scoffed at the Governer’s “caving to lobbyists and members of the retail industry.” You know what?? I actually agree with the Governer’s vetoing [...]

Today I came across a news article in reply to a question asked by Steven D. Levitt, “If you were a terrorist, how would you attack?” The blog posting has struck controversy among many people, and it just reminds me of all the full-disclosure debates we have had in the security industry. Does spelling out [...]