Flex: Enterprise security implementation using Chimp, permission based filtering component

This post covers how you can implement enterprise security solution for flex applications. You can implement flex side security using Chimp which is permission based filtering of flex components using metadata and Spring Security on the server side and integrating the two.

This is part of the series of posts:

Flex then, now & tomorrow – From a java developer’s perspective
Flex: Cairngorm (MVC), SpringActionscript (IOC) and other Cairngorm Extensions
Flex: SpringActionscript (IOC) & SpringActionscript Cairngorm Extension Sample Code Examples
Flex: Cairngorm View Notifications Strategies, Responders from Command to View
Flex: Choosing the right flex data transfer strategy and designing the application accordingly
Flex Tips&Tricks

to cover different strategies in flex development using Cairngorm framework to solve different practical problems.

Consider an enterprise application where you need to have security on both flex side and server side. You want access control on flex side and depending on user roles you would like to create, remove, hide, enable particular view components in the application. Similarly, have access control on the server side that user having specific roles only would be able to use some service, package or call some particular methods.

There is very nice article by Ryan on Enterprise security for Flex which covers the spring security integration and flex side security implementation using chimp.

Network Security Assessment

Network Security Assessment by Chris McNab is really nice book to get the clear idea about the different strategies used from both offensive and defensive point of view to secure your network.

If you have any questions related to :

NSA – Rationale
What is done?
Tools Required
How is done?

Feel free to have a look:

http://books.google.co.in/books?id=_g6MHX88bXUC

Security Mailing Lists:

• BugTraq, http://www.securityfocus.com/archive/1
• VulnWatch, http://www.vulnwatch.org
• NTBugTraq, http://www.ntbugtraq.com
• Full Disclosure, http://lists.netsys.com/pipermail/full-disclosure/
• Pen-Test, http://www.securityfocus.com/archive/101
• Web Application Security, http://www.securityfocus.com/archive/107
• Honeypots, http://www.securityfocus.com/archive/119
• CVE Announce, http://archives.neohapsis.com/archives/cve/
• Nessus development, http://list.nessus.org/
• Nmap-hackers, http://lists.insecure.org/nmap-hackers/

Vulnerability Databases and Lists:

• MITRE CVE, http://cve.mitre.org
• ISS X-Force, http://xforce.iss.net
• OSVDB, http://www.osvdb.org
• BugTraq, http://www.securityfocus.com/bid/
• CERT vulnerability notes, http://www.kb.cert.org/vuls/
• Secunia, http://www.secunia.com

First Message

This blog will contain all kind of topics including technical, humour and security & hacks related stuff. Please wait the updates will come soon.