Comments on: Sage Live – Serious SaaS Security Issues

By: Mandar

Mandar — Mon, 15 Jun 2009 10:22:52 +0000

Good article. FYI..BEA Aqualogic is now Oracle WebCenter. 🙂

By: SecurityPlease

SecurityPlease — Thu, 09 Apr 2009 21:33:52 +0000

Admittedly I only read to the part about plain text password exposed in GET request. In addition to it being plainly visible, this data would be exposed through browser history, router logs and web server logs.

By: OnSeaside

OnSeaside — Fri, 20 Feb 2009 17:23:10 +0000

I have never liked Sage. Every company I have dealt with had it (bar one) and every accountant I had loved it – they simply did not know better. Having your accounting system on line is fantastic, especially for smaller companies if the team is not all in one place.
In two companies I introduced Netsuite. The advantage Netsuite offered is that it integrates a CRM system with an accounting system. You can even build in an online ordering system, an e-marketing system and lots of other goodies. Yes it is expensive, but then it also offers a lot and I always felt it was very secure.
As a business manager and not an accountant it has always been important to keep track of what my business was doing. Netsuite offers that. I have no connection with them at all, and whilst I constantly fought the costs, I loved the product.

By: Hawkeye

Hawkeye — Thu, 05 Feb 2009 15:22:02 +0000

No matter how good your developers are, any web-based system holding sensitive data should be tested by external security consultants – “penetration testers” in the jargon. The ways to hack into a web system are many and varied and are often highly detailed – you really need experts who know what they are doing.

Bottom line: I wouldn’t go near any sensitive web-based system if it hasn’t been penetration tested by specialists. Regardless of whether this was a beta system it clearly was not penetration tested. It should have been before it made it even half-as-far as been available for semi-public testing.

That alone says to me that Sage don’t know what they are doing.

By: Matt Chatterley

Matt Chatterley — Thu, 22 Jan 2009 10:36:25 +0000

@Stuart – No they won’t feel the credit crunch. Because if they use their own online system – someone will have nicked their password and locked them out by now!

By: Dan

Dan — Thu, 22 Jan 2009 09:23:46 +0000

Im almost tempted to build a system myself to show how it should be done.

To the drawing board now…

By: Matt Chatterley

Matt Chatterley — Thu, 22 Jan 2009 09:11:35 +0000

We are building up a pretty serious investment in SaaS with a few products due to launch this year (all going well) – and I have to say – some of the things pointed out above are nothing short of scary.

Once you consider the reputation Sage have amongst ‘laymen’, and the sort of data that they are ‘protecting’ – it’s even scarier.

By: Stuart Gilbertson

Stuart Gilbertson — Thu, 22 Jan 2009 08:34:18 +0000

Sage wont be feeling the credit crunch as they’re still living in 1997.

By: Ben Kepes

Ben Kepes — Thu, 22 Jan 2009 08:16:26 +0000

I’ve just about got to the point where I’d advise Sage, Intuit and MYOB to all develop by acquisition – it’s probably the only feasible option open to them given the abortion of products that SageLive, BBO and QBOE have generally seemed to be (beta or otherwise)

By: Peter Hodge

Peter Hodge — Thu, 22 Jan 2009 02:32:13 +0000

I have been waiting for Sage to do this for a few years now and like you I thought it would add great credibility to the market.

I investigated Sage’s desktop version last year for a company wide deployment for a client. I found it to be a fantastic product, well over priced but still a good service. While it was first choice out of the services investigated it fell short because of cost. Even then Sage were already offering a hosted version through a company here in NZ.
http://www.appserv.co.nz

What i can’t understand is how Sage could screw up their own offering so badly when others were offering their product as a hosted version already.

Seems the term “proper SaaS player” won’t be attributed to Sage any time soon, especially when some one else is beating them at their own game with their own product.

By: Alan Barlow

Alan Barlow — Thu, 22 Jan 2009 01:41:37 +0000

Hi Duane

Clearly Sage has security issues which need resolving and thats a huge worry as data-security and data-integrity are the two top priorities in this game and something which I personally highlight to any new hires a number of times during their initial few weeks… yes i DRUM it into them 😉

I think Sage management should firstly re-evaluate their development plan (if they have one) and ensure security is at the top of the list. Secondly they should check the experience and technical savy of the development team and make changes if necessary as the system will only be as good as the people building it.

Something else I had to laugh at in your screen grabs was the obvious carrying of permissions and credentials within URL strings… really smart, NOT!

Kind regards
Alan Barlow
CTO & Chief Software Architect
ProWorkflow.com

By: Duane Jackson

Duane Jackson — Thu, 22 Jan 2009 00:39:11 +0000

Vuk,

Thanks for the comments. I’m the first to admit I struggle to be objective when it comes to Sage.

I almost did include comments about it being in beta. But decided it’s not relevant. They’re encouraging real businesses to put real business data in there.

I’ve just re-read my link regarding BEA, and you’re spot on. I’d mis-read it. I’ll add a correction note to the main blog piece.

By: Sam Law

Sam Law — Thu, 22 Jan 2009 00:30:18 +0000

Terrifying is probably the correct word to use after reading your blog, I’m not in the UK and I found this through twitter – http://twitter.com/benkepes/status/1137634227 – but I would strongly advise that no-one uses Sage at least in the current form until these are all resolved.

By: Vuk

Vuk — Thu, 22 Jan 2009 00:01:06 +0000

Interesting stuff. No ax to grind, just two factual points that may help staighten the story further:

a) Not that beta releases should have flaws in them, but this was a Sage Live free public beta, no? Perhaps being more explicit on that point will add further clarity.

b) Did not check BEA AquaLogic stuff, but the link you provide points to the old BEA website, which talks about the website being discontinued and points to “Learn more about the role of BEA AquaLogic Products in the Oracle Fusion Middleware strategy.”.

I stand to be corrected, from what you say in the post, it’s not quite clear which AL product or products you imply Sage Live is powered by therefore what is its status in the Oracle strategy.

Admittedly, bit of nitpicking, I guess the thrust of the article is clear. Just my 2p!

By: Hazel Edmunds

Hazel Edmunds — Wed, 21 Jan 2009 23:27:57 +0000

I’d say that the answer to your final question is “zilch”, “nil”, or anything other polite way of saying “b**** r all”. But surely if you don’t know how to do something then you find out, or hire someone or does.
So what it boils down to is that someone, by the sounds of it probably lots of someones working in a committee, don’t know what they don’t know.