<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="ProgId" content="Word.Document"><meta name="Generator" content="Microsoft Word 11"><meta name="Originator" content="Microsoft Word 11"><link rel="File-List" href="file:///C:%5CDOCUME%7E1%5Ccmijcg0%5CLOCALS%7E1%5CTemp%5Cmsohtml1%5C01%5Cclip_filelist.xml"><style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-style-parent:"";
margin:0in;
margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-fareast-font-family:"Times New Roman";}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;
mso-header-margin:.5in;
mso-footer-margin:.5in;
mso-paper-source:0;}
div.Section1
{page:Section1;}
-->
</style>
<p class="MsoNormal">I just wanted to chime in with my two cents on the top N
list.<br>
<br>
I have witnessed (and developed) secure programs that were built to defend
attacks identified in secure requirements (i.e. data validation and data transformation)
<span style=""> </span>But the one vulnerability that keeps
popping up is weak authentication.<span style=""> </span>Most
business apps rely (and can only afford) one the most basic use of authentication;
username and passwords.<span style=""> </span><span style=""> </span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I would like to see the basic the use of one tier authentication
on a Bug Parade list. It is by design a weak link and I think the business
community needs to understand that a stronger authentication policy is just as
important as data validation.<span style=""> </span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I agree with GEM when he wrote that Executives don't care
about technical bugs; but a Bug Parade lists does help highlight the usual list
of suspects that need to be dealt with. Thus it justifies the additional spending on secure design and development.<br></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Jason Grembi</p>
<br clear="all"><br>-- <br>THE INFORMATION CONTAINED IN THIS MESSAGE AND ANY ATTACHMENT MAY BE PRIVILEGED, CONFIDENTIAL, PROPRIETARY OR OTHERWISE PROTECTED FROM DISCLOSURE. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, copying or use of this message and any attachment is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and permanently delete it from your computer and destroy any printout thereof.<br>