Almost all organizations let their users browse the Internet. From a firewall point of view, this means allowing the “http” service (technically, tcp on port 80) from the internal net, to anywhere. Because this port is practically certain to be open, almost every Web application now communicates over tcp/80. This creates a pretty serious concern for information security officers, because not all Web applications are born equal. Continue Reading »