Nine in 10 UK business websites 'insecure'

One in nine UK organisations run websites that contain one or more vulnerabilities that could enable external users to gain unauthorised access or disrupt service availability, security experts warned today.

A further 33 per cent of websites contain critical vulnerabilities that are widely known and actively exploited by hackers, according to NTA Monitor's Annual Web Application Security Report 2007.

The report analysed data gathered from web application security tests undertaken on behalf of a variety of organisations during 2006, including financial institutions, legal practices, universities and local government bodies.

Roy Hills, technical director at NTA Monitor, said: "Web applications are accessible 24/7 and control sensitive data such as customer details, credit card numbers and proprietary corporate data.

"An ever increasing number of people are using the internet for personal business such as banking, bill payments and shopping, and as a core part of their working lives in terms of remote working and resource sharing.

"It is high time that organisations took greater steps towards protecting these revenue generating and efficiency enabling systems."

As the number, size and complexity of web applications increases, so does the risk exposure, Hills warned.

The research shows that attackers focusing on web application security problems are actively developing tools and techniques to exploit the flaws.

NTA Monitor has made three key recommendations that organisations can follow to reduce their risk:

• An account lockout mechanism should be in place to lock out accounts permanently or temporarily, to help prevent attackers from being able to brute force user accounts
• Meta characters such as single quotes, double quotes and semicolons should be disallowed in order to minimise the threat of SQL injection attacks, which are a high risk vulnerability
• In order to help protect against keystroke loggers, the mouse and keyboard should both be used during log-in processes. For instance, users should be asked to use drop-down boxes or radio buttons as well as keying in details

See also:

IT directors put network security first

Hackers and viruses most feared, according to new research  21 Mar 2007

Windows StickyKeys could pose security risk

Microsoft dismisses claims of vulnerability in software component  16 Mar 2007

Second Life presents real life security risk

Sophos claims productivity and corporate data at risk as it blocks virtual game  14 Mar 2007

Testers expose Google Desktop security bug

Flaw centres on integration between Google.com and Google Desktop  22 Feb 2007

Experts call for fundamental IT security rethink

Nationwide laptop theft highlights inadequacies of traditional security  22 Feb 2007

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!