June 28, 2006
Cenzic, a long-time player in the application security field, has updated its Hailstorm vulnerability-assessment tool to include the ability to scan AJAX-enabled applications for a wide range of security weaknesses. Though Hailstorm remains Web-focused and does not include many of the top 10 XML/SOA-specific vulnerabilities, the tool is able to discover vulnerabilities that even its SOA security-focused counterparts may not be able to root out. This is largely due to AJAX's reliance on the browser's scripting capabilities. Security enforcement products such as Forum Systems' XWall and Sentry, Reactivity's XML Security Gateway and Layer 7 Technologies' Secure- Span XML Gateway don't account for such factors as session management and security, because they don't interact with the browser. A pairing of Hailstorm with any of these XML/SOA-specific security tools would constitute a complete Web 2.0 and SOA security strategy.
No Single Solution