A decade ago, we began doing business over the web. Browsers and web servers became the building blocks of services and applications on the Internet. Web application security was a major concern in 2000, but little progress has been made to fix the problems. In 2009, the underground cyber economy grew in leaps and bounds. Spam has become a lucrative business. Writing exploits fetches real money. Large scale breaches of customer data are on the rise. You can purchase pay-per-hour distributed denial of service attacks. The effectiveness of antivirus software has fallen well below acceptable levels. Today, it is impossible for an average user to “survive the web” without falling prey to scams or malware.

This talk explores how well known vulnerabilities and bugs play a key part in creating the attack patterns of tomorrow – the objectives, motives and how all the pieces of the puzzle fit together.

We need to take another look at the fundamental building blocks that deliver our web applications. Are browsers and protocols capable of delivering secure web applications? Standards have evolved, but without a focus on application security. In our quest for a slicker Web 2.0, have we compromised on fundamental security principles? Although there is no clear solution in sight, it is time that we start asking for what is really needed.

About Saumil Shah

Saumil continues to lead the efforts in e-commerce security research and product development at Net-Square. His focus is on researching vulnerabilities with various e-commerce and web based application systems, system architecture for Net-Square’s tools and products, and developing short term training programmes. Saumil also provides information security consulting services to Net-Square clients, specializing in ethical hacking and security architecture. He holds a designation of Certified Information Systems Security Professional. Saumil has had more than nine years experience with system administration, network architecture, integrating heterogenous platforms, and information security and has perfomed numerous ethical hacking exercises for many significant companies in the IT area. Saumil is a regular speaker and trainer at security conferences such as BlackHat, RSA, etc.

Previously, Saumil was the Director of Indian operations for Foundstone Inc, where he was instrumental in developing their web application security assessment methodology, the web assessment component of FoundScan – Foundstone’s Managed Security Services software and was instrumental in pioneering Foundstone’s Ultimate Web Hacking training class.

Prior to joining Foundstone, Saumil was a senior consultant with Ernst & Young, where he was responsible for the company’s ethical hacking and security architecture solutions. Saumil has also worked at the Indian Institute of Management, Ahmedabad, as a research assistant and is currently a visiting faculty member there.

Saumil graduated from Purdue University with a master’s degree in computer science and a strong research background in operating systems, networking, infomation security, and cryptography. At Purdue, he was a research assistant in the COAST (Computer Operations, Audit and Security Technology) laboratory. He got his undergraduate degree in computer engineering from Gujarat University, India. Saumil is a co-author of “Web Hacking: Attacks and Defense” (Addison Wesley, 2002) and is the author of “The Anti-Virus Book” (Tata McGraw-Hill, 1996)