Feeds

‘Penetrate and patch’ e-business security is grim

@stake survey

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Application security flaws introduced early in the design life cycle are giving rise to easily exploitable defects that can readily be prevented.

That's the main conclusion of an evaluation of 45 e-business applications by security consultancy @stake.
It says the current state of application security is "grim".

@stake found that nearly half of application security defects - 47 percent - are both readily exploitable and could cause significant loss of reputation or customer revenue, but the defects were entirely preventable. The consultancy found that the best-designed e-business applications have 80 per cent fewer security defects than the worst.

A selection of wireless applications, off-the-shelf packages and Web-transactional apps supplied by @stake's clients were put through their paces during its security evaluation.

The methodology involved a code review; a look at the architecture and design of applications; and attack simulations. As security testing was carried out under non-disclosure agreements it is unclear when issues will be highlighted to the wider community.

@stake's testing reveals some worrying trends in application insecurity.

These include insufficient rigour in checking user input, a problem that can give rise to buffer overflow attacks, and a lack of secure authentication and access control features within applications. User session security proved to be the "Achilles heel" of many of the apps analysed.

Nine classes of common security flaws can make applications insecure, according to @stake's research. These are: administrative interfaces authentication/access control, configuration management, cryptographic algorithms, information gathering, input validation, parameter manipulation, sensitive data handling and session management.

Avi Corfas, vice president for @stake in EMEA, said the problems are more to do with the way applications were designed rather than the platform they run on. Somewhat controversially, he claimed 70 per cent of the problems @stake identified were in their design and only 30 percent were in implementation.

Anecdotal evidence from other security consultants suggests the vast amount of security risks is caused by incorrect implementation, for example the interaction between applications or how applications are installed. That's to say nothing of failure to apply patches, of course, which @stake points out would be far less of an issue if developers addressed security problems early in the design process.

"Many companies treat security as 'penetrate and patch' rather than employing secure software engineering practices that would have produced a safer application from the start," said Andrew Jaquith, program director, @stake.

In order to benchmark application security best practices, @stake compares and contrasts the top and bottom performers in its study as measured by business risk.

The six areas that differentiate the best from the rest are: early design focus on user authentication and authorisation; mistrust of user input; end-to-end session encryption; safe data handling; elimination of administrator backdoors; mis-configurations and default settings and security quality assurance. ®

External links

The Security of Applications: Not All Are Created Equal, study by @stake

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.