• My Web app security epiphany: The Lysol Effect

    05 Jan 2012

    I just had an epiphany in the bathroom. I know, I know…bear with me.

    I thought to myself, Why is it people use Lysol to cover up, um, smells and such in the bathroom?? Sure Lysol kills the problem at the source but, goodness gracious, there are other means of consideration than to merely cloud up the bathroom covering up something that probably shouldn’t be there in the first place! Know what I mean? Why not take preventive measures to keep things in check rather than junk up the bathroom and surrounding areas with yet another foul scent?

    Then it hit me…this social dilemma is no different than people relying solely on Web application firewalls for Web security. We know problems like SQL injection, XSS and session management are there. Why not just fix the flaws rather than covering them up? I wrote about this in a piece on PCI DSS 6.6 compliance four years ago and I still see and hear about this a lot…priorities I suppose.

    Anyway….apparently I have an uncanny ability to tie bathroom logic in with information security. It’s an awful personality flaw. Please don’t hold it against me.