Web Application Defender's Cookbook

Part II: Asymmetric Warfare

The control of a large force is the same principle as the control of a few men: it is merely a question of dividing up their numbers. Fighting with a large army under your command is nowise different from fighting with a small one: it is merely a question of instituting signs and signals.

—Sun Tzu in The Art of War

The web application security industry has been often compared to the early years of the automobile industry with regard to the lack of mandated security controls such as seatbelts and airbags. Experts rightfully point out that today's web applications are much like the cars of yester-year in that the focus is on features and not on the safety of the users. While there are similarities between the safety evolutions of these two industries, I want to focus on one specific marketing campaign that was used to promote the Porsche Boxster automobile. Within a print advertisement in an automobile magazine, Porsche presented the following text:

“Newcaritis.” That’s a technical term for the unanticipated problems that show up in early production cars. No matter how large the automaker, how vaunted its reputation, how extensive its pre-production testing program or how clever its engineering staff, there’s nothing like putting several thousand cars in the devilish little hands of the public to uncover bugs that the engineers never dreamed of.

This scenario is not unique to the automobile industry. Just as new, unforeseen defects and bugs are found when ...