Denim Group, Ltd.

John Dickson and Sheridan Chambers at BlackHat

By Dan Cornell

John Dickson and Sheridan Chambers will be out at BlackHat this week. Follow John on Twitter @johnbdickson  Here is a video regarding some of John's plans at BlackHat:

--Dan
dan _at_ denimgroup.com
@danielcornell

Austin Business Journal Mention

By Dan Cornell

The Austin Business Journal article is essentially a re-run of the San Antonio Business Journal article about things we're doing in Austin.  No such thing as bad press, though!

--Dan
dan _at_ denimgroup.com

Denim Group In Austin: Article in the Business Journal

By Dan Cornell

This has been a busy news week for Denim Group (or perhaps a slow news week out there in the world...)  The San Antonio Business Journal published an article today about some of the work we're doing in Austin with Texas State agencies.  The link points to only part of the article - you have to have an online subscription or a print copy for the full version.  Or you can call me at the office and I'll be happy to read it aloud...

Oh and as the article mentions, we're hiring.

--Dan
dan _at_ denimgroup.com

(Photo is of our management team at the annual Denim Group holiday party.  Who needs a "gray hair" CEO when you can rent Santa Claus by the hour...)

Denim Group Listed on the Inc 5000

By Dan Cornell

We just got word that Denim Group has been included on the Inc 5000 list of the fastest growing private companies in America.  This is a fantastic honor and we wanted to take this opportunity to thank all of Denim Group's fantastic employees for all their hard work getting us to this point as well as all of Denim Group's awesome clients for trusting us with their business.  1101 this year - headed to the number 1 slot next year.

August 20, 2008
Sheridan Chambers
Denim Group, Ltd.
3463 Magic Drive
San Antonio, TX 78229

Dear Sheridan Chambers:

On behalf of Inc., I am delighted to recognize your accomplishment in earning the rank of 1101 on the 2008 Inc. 5000, which celebrates the fastest-growing private companies in America.
For more than 27 years, the Inc. 5000 has served as a benchmark for the most innovative, dynamic, and successful companies in the nation. As an Inc. 5000 honoree, Denim Group, Ltd. is now a member of the most influential business club in America. The company you keep is notable, as Inc. 5000 alumni include Bill Gates of Microsoft, Larry Ellison of Oracle, and many more.

The entire team at Inc. commends you on your success and recognizes the commitment that has gone into building your company into what it is today.
Congratulations to you and your team.

Sincerely,

John Koten
CEO and Editor in Chief
Mansueto Ventures
Publisher of Inc.

--Dan
dan _at_ denimgroup.com

Top 5 Software Security Predictions for 2008

By Dan Cornell

Top 5 Software Security Predictions for 2008

1. More Software Security Vendor Acquisitions

As the industry matures there will be more consolidation.  As larger mainstream vendors buy up software security companies that will give software security tools further distribution, but it will not necessarily result in deeper adoption as adoption up until now has been significantly driven by independent vendor evangelism.

2. Cross Site Scripting is the New Buffer Overflow

Buffer overflows used to allow attackers to run arbitrary code on servers, where valuable data lived.  Now that most new server side applications are being written in safer languages such as .NET and Java buffer overflows are on the decline (See the changes between the OWASP Top 10 2004 and Top 10 2007).  With Web 2.0 and other trends moving more data onto the client side, hosted in browsers, the ability to run malicious code in client browsers (XSS) will become paramount for attackers.  Also cross site scripting as a class of problem encompasses many subtle variations that will persist even when obvious XSS flaws have been addressed - just like we saw with buffer overflows at attackers moved from stack overflows to heap overflows to format string attacks.

3. More Combined Attacks on the Horizon

General awareness of software security issues has improved in recent years.  Most developers these days have at least heard of SQL injection attacks, and tool adoption by large organizations has started to stem the tide of SQL injection and other simple vulnerabilities from high-profile and critical applications.  As these individual pieces become more secure, attackers will start to look for more subtle attacks.  These will involve combining different attack vectors such as SQL injection and Cross Site Scripting (XSS) The recent mass SQL injection attack that injected malicious HTML and JavaScript into databases is a good example and is a harbinger of things to come.  Also, using Cross Site Request Forgery (CSRF) attacks to weave attacks across separate applications will continue to gain steam.  As the components become more mature, more vulnerabilities will come from the interactions between these components.

4. Academia Will Start to Get In On the Act

Up to this point there has been comparatively limited work done in academia that was specifically focused on software security.  In 2008 I suspect several prominent institutions will announce software security-specific efforts.  This is great because it will hopefully start the long road toward security being taught throughout the computer science curriculum rather than as specialized add-on coursework.

5. Social Networking is Going to Have a Rough Year

With so many people becoming involved in multiple Social Networking sites, so much valuable personal data being stored in those sites and with increased programmability being made available, vulnerabilities will skyrocket as threats and countermeasures in this environment are not well understood.

2007 was a tremendously exciting year for application security and I think 2008 is going to blow it away.  Tremendous strides have been made in education, testing and countermeasures but equal if not more progress has been made by attackers as they evolve their methods and - even more importantly - their goals.

--Dan

PS - Picture is another I took in Costa Rica.  It has been LOLGuana-ed up solely to aggravate Sheridan Chambers, who hates LOLCats more than anyone I know.  Even I'm getting annoyed so I guess I ought to lay off for a while.