Browse by Tags
All Tags »
testing »
security (RSS)
My first article on the topic of security testing and risk management is now published in the March 2009 issue of Testing Experience magazine, pages 28-30. http://www.testingexperience.com/subscribe.php (free online subscription takes you to PDF download
Read More...
The Office security team typically targets memory-corruption bugs in the software like buffer overruns, integer overruns, and format strings... http://www.darkreading.com/document.asp?doc_id=159305
Read More...
J.D. Meier has posted a decent index of videos covering performance testing, ASP.NET 2.0, and VSTS: http://blogs.msdn.com/jmeier/archive/2007/11/22/videos-security-performance-testing-and-visual-studio-team-system.aspx
Read More...
The Unintended Consequences of the Information Age Lecture Series: Our Infrastructures: Online and Vulnerable? Jointly sponsored by The Center for Information Assurance and Cybersecurity, UW-INSER, the MS Program in Strategic Planning for Critical Infrastucture,
Read More...
"Click Here" http://blogs.msdn.com/jmeier/archive/2007/03/24/patterns-practices-security-videos.aspx
Read More...
Here's the link... http://www.cigital.com/silverbullet/show-006/
Read More...
Security researchers have all the fun. This paper describes how the Strider HoneyMonkey Exploit Detection system uses active client honeypots (AKA "honey monkeys") to find web sites that exploit browser vulnerabilities. ftp://ftp.research.microsoft.com/pub/tr/TR-2005-72.pd
Read More...
This is not a Microsoft sponsored talk, and the term "webinar" makes me cringe, but it might be worth it for testers in the crowd: "In this Webinar, the primary author of all three books of the "How to break.." series will take you on a journey through
Read More...
I remember a few years ago at a software quality conference in Portland telling people in the hallway after talks about these cool static code analysis tools we had, but then having to admit they were just internal. Fast forward to today, the news is
Read More...
Some starting points for sharpening the security saw: Threat Modeling (MSDN) http://Channel9.Msdn.Com/Security (MSDN/Channel9/PAG security wiki)
Read More...
This really belongs in the comments field of my last blog post, but it turned out I had more thoughts to vent and this would make a monster of a comment, so here goes: What more could there be to dynamic analysis than code coverage and profiling? Probably
Read More...
An internal email discussion on how to help people write code that doesn't require administrative privileges yielded the following links, hope somebody out there finds this helpful: Top Ten Tips for Secure Testing (#1 tip - test as non-admin): http://www.microsoft.com/whdc/driver/security/test-tips.mspx
Read More...
