Feeds

UK.biz flunks app security tests

Risky business

Internet Security Threat Report 2014

Weak encryption or cross-site scripting (XSS) vulnerabilities remain a big problem for UK firms. Tests on web application security by UK penetration testing firm NTA Monitor on its clients uncovered problems in three out of five cases.

Furthermore, more than three quarters (78 per cent) of websites tested contained one or more medium level risks that may enable external users to gain unauthorised access or disrupt service availability.

The findings form part of the latest edition of NTA’s Annual Web Application Security Report, which analysed data gathered from web application security tests performed for a wide range of industry sectors including finance, government, education, IT, law and retail.

Roy Hills, technical director at NTA Monitor, described web applications as the Achilles' heel of many organisations. "Web applications are commonly the most vulnerable part of an organisation's network, as they necessarily allow internet users to input and access data," Hills explained. "Content and design is frequently altered in order to keep up with the demand for new features and functionality, but even simple changes could produce a new vulnerability that may threaten confidential information."

Weak SSL encryption vulnerabilities may cause sessions to be compromised. Cross-site scripting allows attackers to bypass access controls, such as the same origin policy. Attacks based on the class on vulnerability typically allow malicious JavaScript from hackers, served up over the web, to execute in a computer's local zone.

NTA recommends three key procedures that organisations can follow to reduce their risk:

  • Apply a hardening and patching procedure to all Internet facing web servers.
  • Strong encryption (128 bit SSL) should be used for all sensitive details, such as credit card numbers and passwords.
  • All user-supplied data should be properly sanitised before returning it to the browser or storing it in a database.

®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.