2
votes
2answers
214 views

Building a web application security focused team

I work as an application architect at larger company that builds web applications using both .Net and Java technologies. These are sold to and accessed by other businesses (not consumers). We have ...
10
votes
2answers
654 views

Security quiz for developers

Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally ...
5
votes
2answers
207 views

Recommendations for documenting security code review

How should I document the results of a security code review? Does anyone know of any resources for reviewers that provide guidance on how they should document their findings? Maybe a document that ...
2
votes
3answers
295 views

Help me find the right Security Consultant for the stage our organization is in

We are a small company (< 20 ppl), have developed a fairly complex backend platform that exposes a web services API and we are currently productizing a SaaS-based offering that is a client to the ...
2
votes
2answers
197 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...