With frequent reports in the news of successful hacker attacks on Web sites, application security is no longer an afterthought. More than ever, organizations realize that security has to be a priority while applications are being developed-not after. Developers and QA professionals are learning that Web application security vulnerabilities must be treated like any other software defect. Organizations can save time and money by identifying and correcting these security defects early in the development process. Ryan English helps you overcome the “deer in the headlights” look when you are asked to begin testing applications for security issues. See real world examples of company Web sites that have been hacked because of vulnerable applications and see how the attacks could have been avoided.

• Security defect categories and responsibility areas

Just when you think your application is free of defects, you find security vulnerabilities lurking beneath the surface. Penetration testing can help you get them before they get you. Ryan English discusses vulnerabilities and offers five steps to organizations looking to start a Web application security initiative.

Why should hackers have all the good tools? Marnie Hutcheson takes a look at Ecyware's GreenBlue Inspector, an inexpensive tool that automates gray box vulnerability testing for simple data types, buffer overflow, SQL injection, and cross-site scripting in forms, cookies, and client requests.

Many organizations are beginning to deploy Web services as the preferred way to interact electronically with employees, customers, and trading partners. To ensure that these Web services implementations are secure, vulnerability assessment and rigorous testing must be built into the Web services development process. Jack Quinnell describes the current "best practices" in developing and testing the security of an enterprise's Web services applications. He explains what makes Web services vulnerable to attacks and the characteristics of both design-centric and attack-centric vulnerabilities. Learn how to identify and test these vulnerabilities during development and in operational settings. Find out about the latest technology to support testing Web services security. Go away with a new appreciation for the security risks inherent in Web services and what you can do about them.