A revised version (but still a draft) of the Enough With Default Allow in Web Applications! paper is now available for download. (My previous post on this topic is here.) The major changes in this version include:
Decided to use a flat model of resources, rather than a hierarchical one, after realising the nested approach would make models very difficult to read for any non-trivial application. Also, we wanted to support the virtual patching case, which doesn't work with nesting very well.
Behaviours can now specify character encodings, which is very important in order to properly parse parameters.
We've allowed for a per-model data dictionary, which would allow parameter types to be defined once and reused throughout the model.
Many clarifications and small fixes throughout.
Update (4 Aug 2008): Updated links to point to the final version (spell-checked, reviewed and branded) of the paper.
About LevelBlue
LevelBlue secures what's next with intelligence-led security delivering visibility and speed to stop threats faster.
As the world’s largest and most analyst-recognized pure-play managed security services provider,
our AI-powered managed services and cyber expertise across managed, advisory, and incident response services help clients operate with confidence.
Learn more about us.
