12Robots is a great blog that frequently covers ColdFusion security and secure web coding topics. Take a look - Jason Dean covers things like input validation and cookies, and those posts make a great reference for ColdFusion developers.
Most of us probably don't run open proxies ourselves - but if you're a higher education security analyst, you probably have at least one on campus, even if you'd prefer not to. That means that your threats may come from inside your border, and worse, that it may be open on purpose.
What do they get used for? Well, a great way to find out is to make an open proxy honeypot.
What can you do with an open proxy acting as a honeypot? Here's a great example - Ryan Barnett from the Web Application Security Consortium has a very interesting presentation available about traffic they observed through a proxy honeypot. It is well worth the read.
Most of us are headed down a road to securing the business side of our institutions, but the academic and student sides are often more problematic. We'll continue to see open proxies, both on our networks, and in use by our users. The good news is that the next time someone asks you about the dangers of open proxies, you'll have an excellent case study in hand.
Heise Security posted their PHP focused Security Know-how for web application security. While it is focused on PHP security, much of the content is applicable in a general way to any web application programming environment. They're targeting a reasonably technical user, so this isn't suited to showing your management to make things easily understood for them, but this is a good article for your local PHP developer to read.
If you don't read anything else, make sure you read the last page - it covers the most important security settings in php.ini.
This catches the other side of Matt's post - build your applications to be secure, and lock them down first, then test them. As all three of us can attest, even good developers make mistakes, but having standards and being aware of security practices is a good start.
