Denim Group, Ltd. Blog

New Denim Group Team Members

Doug M., Staff Consultant, Application Development
Doug comes to Denim Group with five years of .NET development experience. He previously worked at ASNA Inc. as a Software Release Engineer in charge of designing the build and deployment processes for applications written for Microsoft .NET and IBM AS/400 platforms. He earned a bachelor’s degree in computer science from the University of Texas at San Antonio.

Mark S., Senior Consultant
Mark previously worked at the Sierra Nevada Corporation and the Southwest Research Institute. He first pursued a career in music, working at Disney World and in Yokohama, Japan. He has a master’s degree in computer science from the University of Texas at San Antonio. When not at work, he likes to spend time with his young children and play music.

Harry T., Senior Consultant
Harry is a seasoned quality assurance analyst with 17 years of experience in software development. He has worked on a number of projects, including both automated and manual testing. He is familiar with several automated testing tools. Harry most recently worked for Kantar Operations, and before that, USAA.

Joseph R., Team Consultant
Joseph is a native San Antonian and proud husband and father of three. He has a B.S. in computer science from the the University of Texas at San Antonio. Before joining Denim Group, Joseph worked for Oper8 Software for, building thick clients with web service integration. Outside of work, he enjoys soccer, cooking, and spending time with his family.

Vito R., Staff Consultant, Application Development
Vito has a B.S. in Engineering with a concentration in Computing from the Franklin W. Olin College of Engineering and an M.S. in Neuroscience from the University of Texas at Austin. He enjoys learning foreign languages, studying about the mind, and playing video games.

Anu K., Team Consultant
Anu joins Denim Group with five years of manual testing experience. She previously was an ecommerce tester at Harland Clarke. Born and raised in India, she has a bachelor’s degree in commerce from the University of Madras and post-graduate diploma in computer programming and application from the India Institute of Science in Bangalore.

Mobile Application Security Code Reviews: BSides Las Vegas Materials Online

By Dan Cornell

David Rook (@securityninja) and I gave a training class at 2011 Security BSides Las Vegas on mobile application security code reviews. We used his Agnitio code review tool to analyze a flawed application and identify potential issues.

The slides are online here:

The code for the intentionally-flawed sample Pandemobium Stock Trader application can be found online here. The code online includes both Android and iOS versions of a vulnerable application as well as the backing web services that support the apps.

Contact us for more information on application security training programs including instructor-led training for and eLearning.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous

Software Security Remediation: We Need to Actually Fix Some Vulnerabilities

By Dan Cornell

There is a lot of focus in the security industry on finding vulnerabilities so you see a lot of material out there about penetration testing, fuzzing, static analysis and so on. That is all well and good but with so much focus placed on finding vulnerabilities a lot of organizations forget about the need to actually fix vulnerabilities. We do a lot of software security remediation work at Denim Group and we’re trying to start to make more of the lessons we’ve learned publicly available to make it easier for organizations to fix the vulnerabilities they find in their software. This is the first in a series of blog posts about a framework we’ve created for software security remediation projects. You can find more in-depth information available in the HOWTO Guide we put together on the subject.

You can read the full HOWTO Guide for Software Security Vulnerability Remediation here:

How-To-Guide for Software Security Vulnerability Remediation

View more documents from Denim Group

As we have posted previously, there is data out there you can use in planning your remediation strategy. We are hoping that if organizations have a structure for their remediaiton projects as well as data-backed estimates for the level of effort involved that it will be easier to secure budget for these important initiatives. We’ll be following up with more in-depth information on the different steps in the remediation process as well as some tips on practices we have found to be successful.

Contact us for help building your organization’s software security remediation strategy.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from Denim Group's Posterous