■
Security and Communication Networks
By Wiley InterScience
http://www.interscience.wiley.com/security
The Web Application Security Consortium / Web Hacking Incident Database 2010 Semi Annual Report
http://projects.webappsec.org/Web-Hacking-Incident-Database-2010-Semi-Annual-Report
これはちゃんと見ておこう
WHID Top 10 for 2010
1 Improper Output Handling (XSS and Planting of Malware)
2 Insufficient Anti-Automation (Brute Force and DoS)
3 Improper Input Handling (SQL Injection)
4 Insufficient Authentication (Stolen Credentials/Banking Trojans)
5 Application Misconfiguration (Detailed error messages)
6 Insufficient Process Validation (CSRF and DNS Hijacking)
7 Insufficient Authorization (Predictable Resource Location/Forceful Browsing)
8 Abuse of Functionality (CSRF/Click-Fraud)
9 Insufficient Password Recovery (Brute Force)
10 Improper Filesystem Permissions (info Leakages)
