<div><br></div> Against external attacks, Drools supports knowledge base signing and checking using standard asymmetric keys infrastructure. Regarding the web application, I will let one of the guvnor guys to talk about. Against internal attacks, i.e., someone deliberately adding a malicious rule into the application, the only way is through company policies and processes that ensure a workflow for rule approval. Drools offers audit logs (runtime) and standard versioning history (in guvnor, authoring time) to track changes.<div>
<br></div><div> Edson<br><div><br><br><div class="gmail_quote">On Wed, Nov 9, 2011 at 11:42 AM, kapokfly <span dir="ltr"><<a href="mailto:ivan.jiang.ww@foxmail.com">ivan.jiang.ww@foxmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Not sure if anyone can share their experiences what kind of test cases on<br>
Drools security should be developed and ensured?<br>
<br>
As the rule is just a piece of codes in String format which can be hooked<br>
into JVM, we can assume that might open some holes and necessary security<br>
test cases need to be designed against.<br>
<br>
Anyone can share their experiences on this?<br>
<br>
Thanks...<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
View this message in context: <a href="http://drools.46999.n3.nabble.com/Security-test-cases-for-Drools-tp3494072p3494072.html" target="_blank">http://drools.46999.n3.nabble.com/Security-test-cases-for-Drools-tp3494072p3494072.html</a><br>
Sent from the Drools: User forum mailing list archive at Nabble.com.<br>
_______________________________________________<br>
rules-users mailing list<br>
<a href="mailto:rules-users@lists.jboss.org">rules-users@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/rules-users" target="_blank">https://lists.jboss.org/mailman/listinfo/rules-users</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br> Edson Tirelli<br> JBoss Drools Core Development<br> JBoss by Red Hat @ <a href="http://www.jboss.com">www.jboss.com</a><br>
</div></div>