News
Atlas Plugged: SPI Dynamics' Upgrade Secures AJAX Apps
Web application security vendor SPI Dynamics is collaborating with Microsoft to provide security testing for applications built using ASP.NET AJAX, formerly code-named "Atlas."
Web application security vendor SPI Dynamics is collaborating with Microsoft to provide security testing for applications built using ASP.NET AJAX, formerly code-named "Atlas." DevInspect 3.0 with ASP.NET AJAX support, available this month, is designed to provide an automated, secure coding framework for Atlas developers. It's one of the first security tools to analyze and remediate vulnerabilities in Atlas-based applications.
"AJAX is not insecure in and of itself," says Jason Schmitt, SPI's group product manager. "But because people are adopting a lot of different and diverse AJAX libraries, and even coding it themselves -- heavily in JavaScript and client-side code-they're making old mistakes in new ways."
Microsoft's AJAX approach is somewhat different because the applications sit on top of the ASP.NET framework, which addresses security in a lot of ways, observes Schmitt. "The same mistakes can still be made, but there's less of a chance of that with Atlas."
DevInspect 3.0 enables security analysis and automated vulnerability remediation of applications built with ASP.NET 2.0 AJAX Extensions, including partial-page-rendered content within UpdatePanel controls. It also features runtime script interpretation and security analysis of the Microsoft AJAX Library, the cross-browser and cross-platform script library that is available as part of ASP.NET AJAX Extensions. The security tool also supports discovery of ASP.NET AJAX Web services calls and in-depth security analysis of underlying JSON and SOAP Web services.
The spread of AJAX, which combines Asynchronous JavaScript, XML and other technologies in the development of interactive Web applications, has raised concerns among some security experts.
"Every major browser out there has a long history of JavaScript-related security holes," says David Wagner, associate professor of computer science at the University of California, Berkeley. "AJAX makes this risk worse because it perpetuates the use of JavaScript, and makes it harder to tighten down security policies on the browser because imposing new restrictions is likely to break Web sites."
Web sites that use AJAX also create new windows of attack. "The interface between the code running on the browser and the code running on the server is often quite complex in many AJAX applications," he says. "Most developers don't think of this interface as security-critical, but it is: Everything in that interface is exposed to hackers. The larger the attack surface, the more likely it is that the attackers will be able to find a way in."
Schmitt says his company saw the importance of AJAX security early on: "We also wanted to make sure that, from the get go, our tools worked well with the Atlas technologies."
SPI Dynamics has been working with Microsoft for some time, he adds, focusing primarily on the Atlanta-based company's developer tools. SPI is a Microsoft Gold Certified Partner and a member of Microsoft's Partner Advisory Council of the Visual Studio Industry Partner Program.
DevInspect 3.0 for Microsoft Visual Studio Team System is also set for release this month. This defect-tracking and configuration-management product is tightly integrated with the VS Team System to enable developers to share data about security defects with the entire dev team. DevInspect is currently available in an integrated offering for Microsoft Visual Studio 2003 and Visual Studio 2005.
About the Author
John K. Waters is the editor in chief of a number of Converge360.com sites, with a focus on high-end development, AI and future tech. He's been writing about cutting-edge technologies and culture of Silicon Valley for more than two decades, and he's written more than a dozen books. He also co-scripted the documentary film Silicon Valley: A 100 Year Renaissance, which aired on PBS. He can be reached at [email protected].