 |
||
Total Website Security |
||
|
||
|
|
|
|
|
Find your Web App Vulnerabilities...please Monday, November 26, 2007 | Permalink
Web application vulnerabilities are a wide spread problem. According to WhiteHat Security, eight out of 10 Web sites have serious flaws. A January 2007 report published by WhiteHat estimated that about 71% of Web sites are vulnerable to cross-site scripting (XSS), followed by information leakage (30%), predictable resource location (28%), content spoofing (26%), insufficient authentication (21%) and SQL injection (20%). It’s impossible to know how much the vulnerabilities cost businesses and consumers each year, but the number must easily run into the tens or hundreds of millions of dollars. For example, it was recently revealed that a business logic flaw in the QVS Web site allowed a woman to scam the company out of more than $400,000 in product. This person was caught, but it's possible that other people took advantage of the same flaw and never got caught. This incident shows it's more important than ever to thoroughly test your Web applications for vulnerabilities. Manual testing is just too costly and time consuming, but fortunately there are numerous tools that automate vulnerability testing. Some of the most popular tools are NTOSpider from NT OBJECTives; WhiteHat Sentinel from WhiteHat Security; AppScan from WatchFire, now owned by IBM; and Web Inspect from Spi Dyanmics, now owned by HP. More tools in different testing categories are listed here. Many of the vendors in the Web app assessment space come from the network assessment market. Even though there is the common goal of looking for vulnerabilities, the business of finding flaws in web applications is vastly different from searching for vulnerabilities on a network. For instance, on a network, you can use signature-based tests. For Web apps, the vulnerabilities vary too widely, and signatures don’t work well. As a result, the Web app testing tools also vary widely in their results. This can make it hard to compare tools and figure out which one(s) will work best for your environment. Larry Suto, an application security consultant in San Francisco, just published a report that compares three Web application scanners: NTOSpider, AppScan and WebInspect. He put them through a battery of tests to gauge their effectiveness in four areas: * Links crawled Suto writes, “One of the most surprising results is the discrepancy in coverage and vulnerability findings between the three tools.” Read the report to see the detailed results of Suto’s tests and see what he recommends for vulnerability testing. Hint: Suto suggests that marketshare leaders aren’t always the best overall performers, so don’t overlook the lesser known tools. Web application vulnerabilities are such a serious problem today that every CSO should require that a vulnerability report be run whenever an application is initially developed or anytime it is updated. A good tool can provide important feedback to different members of the team, including the application developer, the server administrator, the DBA and the CSO. Find more information about the numerous efforts underway to plug the vulnerabilities that lurk in applications: * The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. OWASP publishes its Top 10 list to educate people about the consequences of some of the most common Web application security vulnerabilities. * The Payment Cards Industry (PCI) Security Standards Council is a global forum for the ongoing development, enhancement, storage, dissemination and implementation of security standards for account data protection. The founding members of the council developed the PCI Data Security Standard (DSS), a set of comprehensive requirements for enhancing payment account data security. * The Web Application Security Consortium (WASC) offers technical information, contributed articles, security guidelines, and other useful documentation to businesses, educational institutions, governments, application developers, security professionals, and software vendors to assist with the challenges presented by Web application security. Linda Musthaler is a Principal Analyst with Essential Solutions Corporation. Contact her. Get more of Linda's views here. About Essential Solutions Corp: Essential Solutions researches the practical value of information technology, and how it can make individual workers and entire organizations more productive. Essential Solutions offers consulting services to computer industry and corporate clients to help define and fulfill the potential of IT. |
|
|
||
|
||
|
||
|
||
The busy holiday shopping season is upon us. Every day, millions of people log in to Web applications to make purchases. As long as they see the "yellow lock" icon on the bottom of the screen, they figure their transaction is safe, but that's not always the case. As the use of Web applications becomes more prominent, so, too, does the number of security incidents involving Web apps.