@stake Announces Results of its Security Analysis of Microsoft .NET Framework and IBM WebSphere.

Business Editors

CAMBRIDGE, Mass.--(BUSINESS WIRE)--June 3, 2003

Digital security consulting firm @stake, Inc., today announced the results of its independent security analysis of two environments for building and deploying Web-based applications and XML services -- Microsoft's(R) .NET Framework Version 1.1, running in Windows(R) Server 2003, and IBM's WebSphere(R) Java(TM) 2 Enterprise Edition (J2EE) framework, running in both Unix(R) and Linux environments. The analysis, which was funded by Microsoft, was performed with no assistance from any of the vendors involved. The research shows that while both frameworks provide comprehensive tools and infrastructure for building secure Web applications and Web services, the .NET Framework on Windows Server 2003 better complies with security best practices and requires less effort to secure.

To evaluate the platforms, @stake developed a scoring system for calculating "security best practice compliance" and "ease of securing" metrics. When the scores for three scenarios -- Web application, Web service and Intranet application -- were calculated, the .NET Framework scored higher than WebSphere in both areas by a narrow margin. @stake's findings define the strengths and weaknesses of each framework in relation to feature completeness, level of security provided by default, and the overall level of effort required to bring solutions built on the platforms to a level compliant with security best practices.

"The study is a great resource for software developers who are designing, developing, testing and maintaining the security of their Web applications," said James Mobley, president and CEO, @stake, Inc. "Microsoft has made significant progress on application platform security. Windows Server 2003 and the .NET Framework 1.1 were clearly built with security in mind and received strong ratings from our research team."

Research Methodology

Using unique skills, tools and methodologies developed by its Application Center of Excellence and its Attack Simulation Center of Excellence, the @stake team created a comprehensive methodology for assessing the security features included with standard deployments of Windows Server 2003 with the .NET Framework 1.1 and IBM WebSphere on Unix and Linux. To ensure objectivity, security analysts at three industry research firms validated the methodology and reviewed the comparative strategy.

@stake analyzed the level of effort required to minimize all inherent attack surfaces present in out-of-the-box installations of the 1) Host/Operating systems, 2) Web Servers and 3) Application Server environments. For each platform, @stake defined these three high-level categories, each with several major areas of analysis. The 16 areas of analysis, including communications security, cryptography, Web services security, authentication, information disclosure and session management, were further broken down into 45 distinct topics. Each topic contained a set of best practices that defined the security benchmark for the area, based on security features that are frequently implemented incorrectly. @stake defined sixty-seven host and application security best practices in total, such as user data input validation, executing code with least privilege, and opaque and unpredictable session identifiers. Finally, each best practice included test cases designed to measure each platform's compliance. 103 test cases in total were defined.

To score the best practices and test cases, @stake developed a scorecard. The scorecard quantifies each platform's compliance with best practices and the level of effort required to implement an application using best practices. The level of effort is based on the effort associated with completing each test case. Each platform was rated on a score of one to five (five being the best). Level of effort included implementation complexity, quality of available documentation and sample code made available from the vendors, developer administrator skills needed and time required to implement.

For more information on the methodology, scoring and findings from this independent study, download a copy of the executive summary or full report at www.atstake.com.

About @stake, Inc.

@stake, the premier digital consulting firm, provides security services and award-winning products to assess and manage risk in complex enterprise environments. The company's SmartRisk services cover key aspects of security, including applications, critical infrastructure, wireless and wired networks, storage systems, education, and incident readiness. @stake consultants combine technical expertise with a business focus to create comprehensive security solutions for industry leading companies in financial services, information technology, energy & utilities, healthcare, and telecommunications. As the first company to develop an empirical model that measures Return On Security Investment (ROSI), @stake keeps security investments in line with business requirements. Headquartered in Cambridge, MA, @stake has offices in London, New York, Raleigh, San Francisco, and Seattle. For more information, go to www.atstake.com.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

WebSphere is a registered trademark of IBM Corporation in the United States, other countries, or both.

Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Other company, product and service names may be trademarks or service marks of their respective owners.