Atlas Plugged: SPI Dynamics' Upgrade Secures AJAX Apps
Web application security vendor SPI Dynamics is collaborating with Microsoft to provide security testing for applications built using ASP.NET AJAX, formerly code-named "Atlas."
Web application security vendor SPI Dynamics is collaborating with Microsoft to provide security testing for applications built using ASP.NET AJAX, formerly code-named "Atlas." DevInspect 3.0 with ASP.NET AJAX support, available this month, is designed to provide an automated, secure coding framework for Atlas developers. It's one of the first security tools to analyze and remediate vulnerabilities in Atlas-based applications.
Microsoft's AJAX approach is somewhat different because the applications sit on top of the ASP.NET framework, which addresses security in a lot of ways, observes Schmitt. "The same mistakes can still be made, but there's less of a chance of that with Atlas."
DevInspect 3.0 enables security analysis and automated vulnerability remediation of applications built with ASP.NET 2.0 AJAX Extensions, including partial-page-rendered content within UpdatePanel controls. It also features runtime script interpretation and security analysis of the Microsoft AJAX Library, the cross-browser and cross-platform script library that is available as part of ASP.NET AJAX Extensions. The security tool also supports discovery of ASP.NET AJAX Web services calls and in-depth security analysis of underlying JSON and SOAP Web services.
Web sites that use AJAX also create new windows of attack. "The interface between the code running on the browser and the code running on the server is often quite complex in many AJAX applications," he says. "Most developers don't think of this interface as security-critical, but it is: Everything in that interface is exposed to hackers. The larger the attack surface, the more likely it is that the attackers will be able to find a way in."
Schmitt says his company saw the importance of AJAX security early on: "We also wanted to make sure that, from the get go, our tools worked well with the Atlas technologies."
SPI Dynamics has been working with Microsoft for some time, he adds, focusing primarily on the Atlanta-based company's developer tools. SPI is a Microsoft Gold Certified Partner and a member of Microsoft's Partner Advisory Council of the Visual Studio Industry Partner Program.
DevInspect 3.0 for Microsoft Visual Studio Team System is also set for release this month. This defect-tracking and configuration-management product is tightly integrated with the VS Team System to enable developers to share data about security defects with the entire dev team. DevInspect is currently available in an integrated offering for Microsoft Visual Studio 2003 and Visual Studio 2005.