The What, Why and How of Software Security

1. Consider a Microsoft Office SharePoint Server 2007 site that will be used as a “Document Approval System”. Certain users will be “Editors” and they will be able to upload documents for approval. Another set of users will be “Approvers”. These users Read More...

Quite a few web applications encrypt query string values. This is generally done as an added measure to prevent unauthorized access. Since the end user cannot chose a value and then encrypt it, changing parameters becomes difficult. But encryption is Read More...

I have seen quite a few web applications that rely on disabling controls for authorization. Consider this code:- The scenario may be that the page has to be displayed in a read-only manner for certain roles, or after submission of some details but prior Read More...

Consider the following architecture for an intranet application. A thick client installed on the user’s machine connects to a web service which in turn connects to the database. The web service authenticates the caller using windows authentication. It Read More...