Invitation To Hackers

With all the different security products, secure code reviews, defense in depth, and penetration testing requirements, how are we still seeing massive security breaches happening to major corporations and governments? Are all the safeguards we are putting in place working?

Invitation To Hackers

Today, the World Wide Web is almost unrecognizable from its earlier form. The majority of sites on the web are in fact applications. They are highly functional and rely on two-way flow of information between the server and browser. They support registration and login, financial transactions, search, and the authoring of content by users. The content presented to users is generated dynamically on the fly and is often tailored to each specific user. Much of the information processed is private and highly sensitive. Security, therefore, is a big issue.

"No one wants to use a web application if they believes their information will be disclosed to unauthorized parties."

Web applications bring with them new and significant security threats. Each application is different and may contain unique vulnerabilities. Most applications are developed in-house — many by developers who have only a partial understanding of the security problems that may arise in the code they are producing. To deliver their core functionality, web applications normally require connectivity to internal computer systems that contain highly sensitive data and that can perform powerful business functions. Fifteen years ago, if you wanted to make a funds transfer, you visited your bank, and the teller performed the transfer for you; today, you can visit a web application and perform the transfer yourself. An attacker who compromises a web application may be able to steal personal information, carry out financial fraud, and perform malicious actions against other users.

Pictured - a man at a computer disguised as an anonymous hacker wearing a Guy Fawkes mask.
Cybersecurity is one of the biggest concern of web users.

Protecting Your Organization.

Applications that are accessed using a computer browser increasingly overlap with mobile applications that are accessed using a smartphone or tablet. Most mobile applications employ either a browser or a customized client that uses HTTP-based APIs to communicate with the server. Application functions and data typically are shared between the various interfaces that the application exposes to different user platforms. In addition to the public Internet, web applications have been widely adopted inside organizations to support key business functions. Many of these provide access to highly sensitive data and functionality.

Traditional desktop office applications such as word processors and spreadsheets have been migrated to web applications through services such as Google Apps and Microsoft Office Live. In all these examples, what are perceived as "internal" applications are increasingly being hosted externally as organizations move to outside service providers to cut costs. In these so-called cloud solutions, business critical functionality and data are opened to a wider range of potential attackers, and organizations are increasingly reliant on the integrity of security defenses that are outside of their control.

Cloud based development is seen as the future of web technologies.

The most serious attacks against web applications are those that expose sensitive data or gain unrestricted access to the back-end systems on which the application is running. High-profile compromises of this kind continue to occur frequently. For many organizations, however, any attack that causes system downtime is a critical event. Application-level denial-of-service attacks can be used to achieve the same results as traditional resource exhausting attacks against infrastructure. However, they are often used with more subtle techniques and objectives. They may be used to disrupt a particular user or service to gain a competitive edge against peers in the realms of financial trading, gaming, online bidding, and ticket reservations.

This Site Is Secured

There is a widespread awareness that security is an issue for web applications. Consult the FAQ page of a typical application, and you will be reassured by them that it is in fact secure. Phrases such as "We take security very seriously. Our web site is scanned daily to ensure that we remain PCI compliant and safe from hackers," are commonly displayed. In fact, the majority of web applications are insecure, despite the widespread usage of SSL technology and the adoption of regular PCI scanning. A recent test carried out by Dafydd Stuttdard and Marcus Pinto on hundreds of web applications shows that there are still major flaws in web security. The test shows vulnerability in a lot of areas such as:

1.) Broken authentication (62%)

2.) Broken access control (71%)

3.) SQL Injection (32%)

4) Cross site scripting (94%)

5) Information leakage (78%)

Cyber security image
There are still a lot of vulnerability in most web applications.

What Can We Do?

Although awareness of web application security issues has grown in recent years, it remains less well-developed than in longer-established areas such as networks and operating systems. Although most people working in IT security have a reasonable grasp of the essentials of securing networks and hardening hosts, widespread confusion and misconception still exist about many of the core concepts involved in web application security.

A web application developer's work increasingly involves weaving together tens, or even hundreds, of third-party packages, all designed to abstract the developer away from the underlying technologies. It is common to meet experienced web application developers who make major assumptions about the security provided by their programming framework and to whom an explanation of many basic types of flaws comes as a revelation. Most web applications are developed in-house by an organization's own staff or third-party contractors.

Brainstorming over paper
Keeping up with latest technologies is a must for any web developer.

Even where an application employs well established components, these are typically customized or bolted together using new code. In this situation, every application is different and may contain its own unique defects. This stands in contrast to a typical infrastructure deployment, in which an organization can purchase a best-of breed product and install it in line with industry-standard guidelines.

Even though old and well-understood vulnerabilities such as SQL injection continue to appear, their prevalence is gradually diminishing. Furthermore, the instances that remain are becoming more difficult to find and exploit. New research in these areas is generally focused on developing advanced techniques for attacking more subtle manifestations of vulnerabilities that a few years ago could be easily detected and exploited using only a browser. As awareness of security threats matures, flaws in the server side are the first to be well understood and addressed, leaving the client side as a key battleground as the learning process continues. That is way security concern should be one of the biggest concern for an organization when developing their web technologies.

We at Magnus Code understand the importance of having a cybersecure web technology. That is why we pride ourselves in providing you with reliable, secure and technologically advance web solution. By constantly adopting latest technologies, we can integrate web technologies faster with less risk and enables your organization to have security and peace of mind. With a highly professional team, we can provide a secure customizable solution for your web needs.

Talk to our team of experts and get your very own secure and reliable web technology.