Hackers to target users and custom apps

gallery

Cyber criminals have shifted their target focus to users and custom-built applications, according to new research into the top twenty internet security risks of 2007.

Independent security, training and research body, the SANS Institute has found that attackers have been forced to look for alternative ways to evade firewalls, antivirus and intrusion detection tools.

As these security defences have developed and become stronger, the new top two security threats prey on unsecured, web-based applications and unwary or easily-duped users whose PCs are not securely configured before they are connected to the internet.

Alan Paller, director of research at SANS, said web application insecurity is particularly troublesome because so many developers are writing and deploying web applications without ever demonstrating that they can be secured.

While the rest of the top twenty is made up of more familiar hacking tactics like targeting critical software vulnerabilities - where research contributed by security firm, Qualys has shown a huge jump in Microsoft office product vulnerabilities - or system vulnerabilities to create botnets or install key-logging spyware, SANS said the targeting of web applications would likely continue until security training is given to web developers.

"Until colleges that teach programmers and companies that employ programmers ensure that developers learn secure coding, and until those employers ensure that they work in an effective secure development life cycle, we will continue to see major vulnerabilities in nearly half of all web applications," said Paller.

He also said that large organisations using web applications to provide access to back-end databases handling sensitive information were likely to be most at risk and that work was needed to ensure defences would hold against such attacks.

"The new risks are much harder to defend; they take a level of commitment to continuous monitoring and uncompromising adherence to policy with real penalties, that only the largest banks and most sensitive military organisations have, so far, been willing to implement."

Earlier this month, the Secure Programming Council released the first standard of due care for the security knowledge and skills that web programmers should be able to demonstrate.

Email to a friend

Print this page