Website Security Whitepaper
Top 5 Myths of Website Security
Hackers behave like water, taking the path of least resistance. Today this path leads over SSL, and past the firewall, where nothing exists between them, the website, and the information it holds. This is how a Web hacker views the world. Using a browser and a few simple tricks, hackers can penetrate a website, access the credit card database, and make off with critical data, customer databases or even intranet information, unseen.
With network firewalls and patch management now standard practice, the network perimeter has become increasingly secure. Determined to stay a step ahead, hackers have moved up the software stack, focusing on the website itself. Gartner Group has stated that over 70% of cyber attacks occur at the application layer. Even more alarming, WhiteHat Security has found that 8 in 10 websites currently have serious vulnerabilities.
These website vulnerabilities may have familiar names like SQL Injection and Cross-Site Scripting, or less common monikers like Insufficient Authorization or Predictable Resource Location. When securing our networks, we are conditioned to immediately think of firewalls, SSL, Intrusion Detection, and Anti-Virus as components of a complete solution. While they improve certain aspects of security, their impact on protecting the website is marginal. New vulnerabilities require new solutions. Contrary to popular belief, deploying a network firewall will not prevent a hacker from penetrating a gaping hole in your website. To improve the security of the Web, we must dispel this and other widely held misconceptions including:
“A website that uses SSL is secure.”
“A firewall protects the website, so it’s safe from hackers.”
“The vulnerability scanner did not report any website security issues, so it’s secure.”
“Website security is a developer problem.”
“We conduct annual security assessments on our website, so it’s secure.”
Let’s examine these myths and find the truth behind them.
Myth #1: Secure Socket Layer (SSL) Will Secure My Website
SSL does NOT make a website secure. The tiny SSL lock symbol located at the bottom of a Web browser indicates that the information sent to and from a website is encrypted. Nothing more. SSL has no ability to protect the information stored on the website once it arrives.
Websites using strong 128-bit SSL have been hacked with the same frequency as those that do not. WhiteHat has found that the use of SSL has virtually no impact on the difficulty of breaking into a website and pillaging its confidential information.
It’s important to understand what the lock symbol represents in the security landscape. Secure Socket Layer (SSL) is an encryption protocol that enables a website to prove to a user that it is what it claims to be, and not an imposter eavesdropping on the conversation. SSL also ensures that if someone intercepts the conversation between the user and the website, the exchange cannot be read. SSL has absolutely no impact on website security or the manner in which a user’s private information is safeguarded. When private data is stored on the website, the risk is at the server level, not in the connection.
“Using encryption on the Internet is the equivalent of arranging
an armored car to deliver credit card information from
someone living in a cardboard box to someone living on a park bench.”
– Gene Spafford Ph.D.
Professor of Computer Sciences, Purdue University
Read More...Download Whitepaper (registration required) ›››
|
 About the Author ::
Jeremiah Grossman is the founder and CTO of WhiteHat Security. Mr. Grossman is a world-renowned expert in Web security, co-founder of the Web Application Security Consortium, and recently named to InfoWorld's Top 25 CTOs for 2007. He has authored dozens of articles and white papers, is credited with the discovery of many cutting-edge attack and defensive techniques, and co-author of the recently published book, Cross-Site Scripting Attacks. Mr. Grossman is frequently quoted in business and technology publications such as InfoWorld, USA Today, PC World, Dark Reading, SC Magazine, SecurityFocus, C-Net, CSO Magazine, and InformationWeek.
|
