News

Current Web Security Standards Not Enough, Study Finds

Damning assessment of the IT security landscape

• By Jabulani Leffall
• 03/19/2009

Application security company Cenzic's recent report on Web security trends relayed a damning assessment of the IT security landscape that's prompting some to suggest the government should step in to give enterprises and individuals guidance on how to protect themselves.

One notable finding in Cenzic's "Web Application Security Trends Report," released Wednesday, is that the number of vulnerabilities reported in Q3 and Q4 of 2008 increased by 10 percent from the first half of the year to 2,835. Of those bugs, "a staggering 80 percent" pertain to Web applications, Cenzic said.

The report identifies 10 major vulnerabilities on the Web affecting Microsoft, Mozilla, Adobe, and others, as well as the most common "vulnerability types," which include cross-site scripting holes, buffer overflows, orphan accounts, subpar session management, and bad application configuration management.

Most of these vulnerabilities should be covered in the management-level mandates under Sarbanes-Oxley, HIPAA, and Payment Card Industry (PCI) security standards, but each of these compliance objectives has been criticized in one form or another. PCI, for instance, came under criticism after a security attack last year at Hannaford Bros, and another one in January at Heartland Payment Systems. Both of those organizations were PCI standards-compliant -- and got hit anyway.

Mandeep Khera, chief marketing officer at Cenzic, said in an e-mail that Internet-based application weaknesses represent a virtual "gold mine" for hackers. The big problem, he contended, is the lack of centralized oversight of the national cybersecurity matrix.

"Perceived leniency from regulatory compliance bodies, coupled with lack of awareness about tools to prevent it, have allowed Web application vulnerabilities to become a blind spot for many organizations," Khera said.

Phil Lieberman, president of Los Angeles-based security vendor Lieberman Software, agreed that the current security environment warrants more unifying legislation that would allow individuals and organizations to fight back against those who attack their systems in real-time.

"In effect, we need the creation of the concepts of self-defense, castle laws, as well as Good Samaritan laws for those that push back criminals and those that attempt to disrupt commerce and communication on the Internet," he said. "These would be laws that cover all civilian users of the Internet. As it now stands, civilians are prohibited from taking any action to stop attackers, and so are ISPs. We are all told to buy better firewalls, anti-virus, anti-malware, intrusion detection devices, and just take the punishment."

Pointing to Cenzic's findings that more than 75 percent of security attacks happen over the Web and over 80 percent of Web sites are severely vulnerable, Khera added, "We as a nation have to question our cybersecurity priorities."