Current Web Security Standards Not Enough, Study Finds

Application security company Cenzic's recent report on Web security trends relayed a damning assessment of the IT security landscape that's prompting some to suggest the government should step in to give enterprises and individuals guidance on how to protect themselves.

One notable finding in Cenzic's "Web Application Security Trends Report," released Wednesday, is that the number of vulnerabilities reported in Q3 and Q4 of 2008 increased by 10 percent from the first half of the year to 2,835. Of those bugs, "a staggering 80 percent" pertain to Web applications, Cenzic said.

The report identifies 10 major vulnerabilities on the Web affecting Microsoft, Mozilla, Adobe and others, as well as the most common "vulnerability types," which include cross-site scripting holes, buffer overflows, orphan accounts, subpar session management and bad application configuration management.

Most of these vulnerabilities should be covered in the management-level mandates under Sarbanes-Oxley, HIPAA and Payment Card Industry (PCI) security standards. But each of these compliance objectives has been criticized in one form or another. PCI, for instance, came under criticism after a security attack last year at Hannaford Bros. and another one in January at Heartland Payment Systems. Both of those organizations were PCI standards-compliant -- and got hit anyway.

Mandeep Khera, chief marketing officer at Cenzic, said in an e-mail that Internet-based application weaknesses represent a virtual "gold mine" for hackers. The big problem, he contended, is the lack of centralized oversight of the national cybersecurity matrix.

"Perceived leniency from regulatory compliance bodies, coupled with lack of awareness about tools to prevent it, have allowed Web application vulnerabilities to become a blind spot for many organizations," Khera said.

Phil Lieberman, president of Los Angeles-based security vendor Lieberman Software, agreed that the current security environment warrants more unifying legislation that would allow individuals and organizations to fight back against those who attack their systems in real-time. 

"In effect, we need the creation of the concepts of self-defense, castle laws, as well as Good Samaritan laws for those that push back criminals and those that attempt to disrupt commerce and communication on the Internet," he said. "These would be laws that cover all civilian users of the Internet. As it now stands, civilians are prohibited from taking any action to stop attackers, and so are ISPs. We are all told to buy better firewalls, anti-virus, anti-malware, intrusion detection devices, and just take the punishment."

Pointing to Cenzic's findings that more than 75 percent of security attacks happen over the Web and over 80 percent of Web sites are severely vulnerable, Khera added, "We as a nation have to question our cybersecurity priorities."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • RAMBleed Side-Channel Attack Method Disclosed by Researchers

    Academic researchers this week published information about another side-channel attack method, called "RAMBleed," that can expose information from memory chips, including encryption key information.

  • Penguin

    Windows 10 Preview Build 18917 Shows Off New Linux Integration

    Microsoft's latest Windows 10 "fast-ring" preview release is showcasing a coming Delivery Optimization enhancement, along with the ability to try the newly emerged Windows Subsystem for Linux version 2.

  • Customizing Microsoft Office 365

    While the overall look and feel of Office 365 is pretty standard across organizations, there are several ways to personalize it and make it fit better with your company's specific needs.

  • Microsoft 365 Business Tenants Getting Conditional Access and Trouble-Ticket Features

    Microsoft added its conditional access security service to Microsoft 365 Business subscriptions, according to a Wednesday announcement, and it also added new trouble-ticket features for Microsoft 365 administrators.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.