Web 2.0 opens companies up to hackers
By Rene Millman,
Companies looking to embrace web 2.0 technologies could open themselves up to new forms of attack by hackers, according to security experts.
Speaking at a round table event, ThreatLab manager at content security company Clearswift Pete Simpson said that the fact that these technologies introduce both JavaScript and XML onto the desktop to mediate between the browser and the web server, it makes the work of the developer more difficult to design and test the security of these new applications. In turn this allows hackers to combine techniques to infiltrate and subvert systems.
"It combines both the weaknesses of the web page attack and the back-end application attack, both are compounded on the desktop level," said Simpson. "It gives the attacker a lot more ways and opportunities to get at the back-end."
He said a hacker could probe weaknesses at the back-end more successfully and allow them to inject code into web pages. "It is bringing two modes of attack to a single location," he said.
Analysts said that in order to protect an organisation from attacks through web 2.0 applications, a change of mindset is needed to overcome the problem of hackers using multiple attack vectors to access systems. Clive Longbottom, service director at analyst firm Quocirca, said that with web 2.0, it is the content that needs to be focused on for protection rather than the underlying infrastructure.
"If content is sent to a supplier, what is it within that content that they have to be able to see, what can they change, what actions can they take upon it," said Longbottom.
"It becomes far easier to say the technology is far less important, it is the content. You need to be able to tag it and secure it. Not many companies are near to that."
Does web 2.0 lead to hack 2.0? Discuss this now on our forums.
You may also like...
Sponsored Links
advertisement
You may also like...
Latest Security Analysis & Insight
Who to trust after the VeriSign hack?
Davey Winder questions what data was stolen from VeriSign and wonders why the company hasn't been more forthcoming.
- Striving to solve the security skills crisis
- Would you employ a hacker or malware writer?
- Q&A: Raj Samani, CTO McAfee
- Erase and rewind: the EU and privacy
- My email address is [CENSORED]
- Is there such a thing as a secure tablet?
- 2011: The year in news
- BYOD: Old or new, good or bad?
- Are the cookie laws crumbling already?
Latest Security Reviews
Check Point 2210 Appliance review
Rating: ![]()
advertisement
Most popular
- Google releases Chrome for Android beta
- Will someone rid me of these troublesome Macs?
- OneNote hits Google?s Android
- BlackBerry Bold 9790 review
- Google sends in Bouncer to sort out malicious apps
- Ubuntu vs. Windows 7 on the business desktop
- Who to trust after the VeriSign hack?
- Head to Head: Mac OS X 10.7 Lion vs Windows 7
- ACTA: the basics, the controversies, and the future
- BT considering Ofcom price cap appeal
Latest News Videos in Security
IT PRO Podcast: Are UK data protection laws flawed?
We bring in two experts to talk about the problems with UK data protection law and the way it is managed.
Register for IT PRO
You'll get exclusive member benefits including free whitepapers, downloads, Webinars and weekly newsletters full of the latest IT PRO news, reviews, insight and expertise.





