WebApp Sec: Re: ISA Server and SQL Injection

[Paul Johnston <paul () westpoint ltd uk>]

Hi Mark,

> Curphey> Building secure software IMHO is not just about getting the code
> right. I think any good system should be designed to handle failure. That
> goes from structured exception and error handling through to
> compartmentalizing and restraining components. The crux of it is that
> software IMHO has to protect itself. 
>  
Wise words.

Just looking back at your original email, I think you were really 
attacking not application firewalls, but the exaggerated claims many 
vendors use. And on that I have to agree with you.
Your name's kind of familiar, have our paths crossed before?

Did you read my paper? 
http://www.westpoint.ltd.uk/advisories/Paul_Johnston_GSEC.pdf
Regards,

Paul

--
Paul Johnston, GSEC
Internet Security Specialist
Westpoint Limited
Albion Wharf, 19 Albion Street,
Manchester, M1 5LN
England
Tel: +44 (0)161 237 1028
Fax: +44 (0)161 237 1031
email: paul () westpoint ltd uk
web: www.westpoint.ltd.uk