RE: applet security

["Andrew Chong" <andrewjw () singnet com sg>]

Just a quick comment, not thorough though.

I believe the auditor concern is on the client-side when the applet is
run on the users browser.

You can question the auditor concern in what specific areas he is
concern with. i.e. does the applet code run in a sand-box?

Does the auditor want to do a code review? Does the applet write any
files to the user computer? If yes, what are the control to ensure
privacy issues. Does the applet send user information back to the your
server. If so, what type of information? Finacial, restricted, public
available? (data classificaton)

Logically, most auditors will ask what are the technically controls and
management controls for your server side (servlets, ASP, PERL, CGI)
rather than client end.

Regards,
Andrew Chong, CISSP

-----Original Message-----
From: test.future () gmail com [mailto:test.future () gmail com] 
Sent: Monday, January 09, 2006 6:25 PM
To: webappsec () securityfocus com
Subject: applet security


Our auditor advised that controls have to be in place to use applet in
web application. I wonder what kind of controls is available? I searched
owasp but can't find anything. Thanks for any advice.

------------------------------------------------------------------------
-------
Watchfire's AppScan is the industry's first and leading web application 
security testing suite, and the only solution to provide comprehensive 
remediation tasks at every level of the application. See for yourself. 
Download AppScan 6.0 today.

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
------------------------------------------------------------------------
-------


-------------------------------------------------------------------------------
Watchfire's AppScan is the industry's first and leading web application 
security testing suite, and the only solution to provide comprehensive 
remediation tasks at every level of the application. See for yourself. 
Download AppScan 6.0 today.

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
-------------------------------------------------------------------------------