McAfee, Inc.'s Foundstone Professional Services to Launch Free Tools to Combat the Growing Threat of Virtual Shoplifting

SANTA CLARA, Calif., June 13 /PRNewswire-FirstCall/ -- McAfee, Inc. , the leading dedicated security company, today announced that Foundstone Professional Services will launch a series of free tools that teach developers, programmers, architects and security professionals how to create more secure software. The tools will also review the root causes of increasingly prolific crimes such as e-shoplifting, session hi-jacking and identity theft.

"In the evolving security risk landscape, hackers and malicious insiders are an undeniable threat to organizations," said Kevin Weiss, president, McAfee, Inc. "As a division of McAfee, Foundstone Professional Services is an integral part of the company's commitment to moving the security industry forward by providing instructional courses and unique tools that enable consultants to better understand the mindset of malicious hackers."

Vulnerabilities such as cross-site scripting and hidden field manipulation are frequent within Web applications,(1) resulting in a surprising number of corporate and commercials sites being exposed to hackers and often suffering from information highway robbery.(2) Foundstone tools replicate interconnected real-world application scenarios including travel, banking and shipping, each written in a different programming language, to demonstrate the potential cross-platform risks to a business' own applications, and those they are connected to.

"In the race to take storefronts online, most Web applications were developed with a focus on functionality, not security. As a result, organizations may be experiencing theft of goods, services or data without even realizing it," said Mark Curphey, vice president, Foundstone Professional Services, a division of McAfee, Inc. "These tools provide developers with a unique opportunity to practice hands-on hacks and expose vulnerabilities safely within real-world scenarios to gain a better understanding of the potential issues. Forewarned is forearmed, and developers can incorporate this knowledge into the building or fixing of more robust and secure applications."

According to Gartner, through 2008, application security will become an important evaluation criterion, weighted as high as system functionality. Organizations that integrate security into their software development life cycles will experience an 80 percent decrease in critical vulnerabilities found in their publicly released software or externally facing Web applications.(3)

The following educational tools will be released over the coming month, each accompanied by a learning whitepaper:

-- Hacme Bank: Simulates a real world Web services enabled online banking application, built with known and common vulnerabilities.

-- Hacme Shipping: Web based shipping application written in ColdFusion MX7, using the Model-Glue framework and MySQL database.

-- Hacme Travel: Simulates a travel reservation system, allowing users to attempt common exploits against a client-server type of application written in C++.

-- Hacme Books: Built on the popular Java 2 Enterprise Edition (J2EE) technology, it includes security vulnerabilities in both the application design and implementation.

-- Hacme Flowers: Replication of an online flower store, written in PHP.

Foundstone is also releasing a number of resource tools, aimed at providing more efficient and relevant practices for application developers and consultants:

-- HacPac: Aggregates security testing tools and information, software updates and news. A "one-stop shop" brought right to the desktop for security consultants.

-- CodeScope: Is designed to help application developers and code reviewers determine the complexity and scope of a code base and validate adherence to best coding practice.

-- SiteScout: Produces site map and site statistics based on user navigation, automating the process of how information flows through the application and provides threat modeling.

-- CredDigger: An assessment tool that notes user credentials and tries to determine each and every host and Microsoft domain for which they are valid.

For more information, please visit: http://www.foundstone.com/. About McAfee, Inc.

McAfee, Inc., headquartered in Santa Clara, California and the leading dedicated security company, delivers proactive and proven solutions and services that secure systems and networks around the world. With its unmatched security expertise and commitment to innovation, McAfee empowers home users, businesses, the public sector, and service providers with the ability to block attacks, prevent disruptions, and continuously track and improve their security. http://www.mcafee.com/.

NOTE: McAfee and Foundstone are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the United States and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners. (C) 2006 McAfee, Inc. All Rights Reserved.

(1) OWASP Top Ten Most Critical Web Application Security Vulnerabilities: http://www.owasp.org/documentation/topten.html

(2) Web Application Security Consortium List of Incidents: http://www.webappsec.org/projects/whid/list_year_2006.shtml

(3)Integrate Security Best Practices and Tools Into Software Development Life Cycle, 10 February 2006; Amrit T. Williams Neil MacDonald