Ajax Security Acceptance

Its time again for AjaxWorld, the largest Ajax conference in the US. Bryan and I are thrilled. AjaxWorld offered us back-to-back sessions so we can do a 90+ minute workshop on how to break into Ajax applications. We will not only hit the major themes like increased attack surface, code transparency, etc, but are also demonstrating some more advanced features such as control flow manipulation, reversing client logic, exploiting Offline Ajax applications, and Mashup/Aggregate hacking. All of which we are covered in our upcoming book, Ajax Security.

Sharp eyed readers will note that 90+ minute is a ridiculous amount of time. This is on par with how much time the keynote speakers and presentations are given. Normal speaking slots are only 40 or 45 minutes! AjaxWorld did this because, well, they love SPI. We have spoken at the every AjaxWorld held so far. We give solid presentations that developers can understand and they personally invite us back every time.

Which leads me to my point.

I think people are starting to get the message about Ajax Security. Lets use AjaxWorld as a barameter of Ajax Security acceptance. When we spoke at the first AjaxWorld, SPI's was the only presentation talking to developers about Ajax Security. That was 1 talk about security out of around 100 presentations. And it was packed. At the 2nd AjaxWorld, SPI talked about Ajax security, and was joined by another presentation on security given by Dan Cornwell of Sprajax fame. Sure there were a few other presentations that had the word "secure" or "security" in the title but these were mainly product pitches and none offered product agnostic security advice to developers about the risks they face. Thats 2 presentations out of 100+ talking about security.

Now we get to AjaxWorld West 2007 and there are 5 presentations about security and all of them look great. Brian Chess from Fortify, Joe Stagner from Microsoft, Byran and I from SPI/HP, Danny Allen from Watchfire/IBM, and Pothiraj Selvaraj from CGE. I am absolutely floored by the turn out. And its not just more security speakers at Ajax conferences. There are other indications that people are accepting Ajax Security. We are seeing a number of books on Ajax Security come out. Ajax frameworks are starting to implement security features natively. In some cases framework developers are reaching out directly to the web security companies that seem to get it. For example SPI has been to Redmond multiple times this year working with the ASP.NET and Atlas teams. We see security vendors and consultants who were in denial about Ajax have toned down the rhetoric. Now vendors from the scanner and source code analysis spaces are joining SPI on stage this year at AjaxWorld. We've gone from a 20 something with long hair talking about Ajax security to CTOs and CEOs, and VPs spreading the message. And that is extremely satisfying.

I suppose if anything, AjaxWorld 2007 is a nice breath of fresh air. A cause SPI has been championing for nearly 2 years now is becoming more mainstream and finding acceptance in the Security and Development communities. I welcome my friendly competitors to the party, even if they were a little late and got lost along the way. :-) Because at the end of the day, more smart people working on tough problems helps everyone.

And thats the kind of thing that makes me want to go to work everyday.