Gartner Group estimates that three-fourths of today's successful Web attacks do not happen via network security flaws but rather by entering directly through defects in application code. To thwart these attacks, you need to institute security procedures and technologies throughout the development lifecycle. Through a review of recent Web application breaches, Dennis Hurst exposes the methods hackers use to execute break-ins via the Web using security defects in the underlying code. In addition to revealing hacker exploits, Dennis outlines coding practices for developing secure Web applications and describes available automated security code testing tools that can help you protect your systems. After completing this session, you will be well versed in the underlying protocols that allow hackers to exploit Web-based applications and, more importantly, understand how to better protect critical applications throughout development.

Since the publication of the test process improvement (TPI®) model in the 1990s, many organizations have used it to help establish and improve their test processes. By doing so, they have tested the hypothesis that improving test processes results in better insight into system
quality and a more repeatable and efficient test process. Over the past five years, Ruud Teunissen and his consultant colleagues have gathered many facts and figures about the results of test process improvement initiatives. Learn the details of what other companies have achieved from test process improvement using the model, including examples of a 50 percent reduction of live incidents caused by inaccurate testing and a 40 percent reduction of long-term testing costs. Build a case for process improvement, discover what the TPI® model can do for you, and find out how to manage expectations should you embrace the model.

Step right up! Come see the sights! Join in the fun! The circus is in town and admission is free with your STAREAST badge. Right before your very eyes, our security testing ringmaster Mike Andrews demonstrates for you the wonders of Web security testing. Behold death-defying feats of SQL injection. Stare open-mouthed as he hacks a site using the cross-site scripting attack. Watch him hijack a Web session before your very eyes. Find out how and why Web servers are the most attacked resource on the Internet and what you can do to protect yours. Learn the history of some successful and insidious Web hacks and the freak-show of hackers that perpetrate them.

Bring your laptop with wireless access, and join in the attack! We will set up a wireless network and Web site with known vulnerabilities on an intranet in the session room so you can have a go at finding security bugs.

"QA is the bottleneck” ... "Why does QA take so long?" ... "You need to test faster." Often, key project stakeholders either do not understand QA or have difficulty quantifying the effects that increasing or decreasing test time will have on the project. First American CREDCO found the solution was to turn QA into a full service organization, complete with a "Quality Rainbow" menu of options to be purchased. Want it quicker and willing to accept a higher risk? Then select from Column 1. Want low risk and willing to take the time to ensure the product is pristine? Then select from Column 5. Whether your test team is small or large, you can learn to "in-source" QA services, set time and efforts expectations up front, and measure the value of QA activities so that QA does not become a roadblock to project success.

• A method to specify and quantify the services provided by a QA group