Find your Web app vulnerabilities...please

The CIO-level business angle on the latest tech

The busy holiday shopping season is upon us. Every day, millions of people log in to Web applications to make purchases. As long as they see the "yellow lock" icon on the bottom of the screen, they figure their transaction is safe, but that's not always the case. As the use of Web applications becomes more prominent, so, too, does the number of security incidents involving Web apps.

Web application vulnerabilities are a wide spread problem. According to WhiteHat Security, eight out of 10 Web sites have serious flaws. A January 2007 report published by WhiteHat estimated that about 71% of Web sites are vulnerable to cross-site scripting (XSS), followed by information leakage (30%), predictable resource location (28%), content spoofing (26%), insufficient authentication (21%) and SQL injection (20%).

It’s impossible to know how much the vulnerabilities cost businesses and consumers each year, but the number must easily run into the tens or hundreds of millions of dollars. For example, it was recently revealed that a business logic flaw in the QVS Web site allowed a woman to scam the company out of more than $400,000 in product. This person was caught, but it's possible that other people took advantage of the same flaw and never got caught. This incident shows it's more important than ever to thoroughly test your Web applications for vulnerabilities.

Manual testing is just too costly and time consuming, but fortunately there are numerous tools that automate vulnerability testing. Some of the most popular tools are NTOSpider from NT OBJECTives; WhiteHat Sentinel from WhiteHat Security; AppScan from WatchFire, now owned by IBM; and Web Inspect from Spi Dyanmics, now owned by HP. More tools in different testing categories are listed here.

To continue reading, register here to become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

The busy holiday shopping season is upon us. Every day, millions of people log in to Web applications to make purchases. As long as they see the "yellow lock" icon on the bottom of the screen, they figure their transaction is safe, but that's not always the case. As the use of Web applications becomes more prominent, so, too, does the number of security incidents involving Web apps.

Web application vulnerabilities are a wide spread problem. According to WhiteHat Security, eight out of 10 Web sites have serious flaws. A January 2007 report published by WhiteHat estimated that about 71% of Web sites are vulnerable to cross-site scripting (XSS), followed by information leakage (30%), predictable resource location (28%), content spoofing (26%), insufficient authentication (21%) and SQL injection (20%).

It’s impossible to know how much the vulnerabilities cost businesses and consumers each year, but the number must easily run into the tens or hundreds of millions of dollars. For example, it was recently revealed that a business logic flaw in the QVS Web site allowed a woman to scam the company out of more than $400,000 in product. This person was caught, but it's possible that other people took advantage of the same flaw and never got caught. This incident shows it's more important than ever to thoroughly test your Web applications for vulnerabilities.

Manual testing is just too costly and time consuming, but fortunately there are numerous tools that automate vulnerability testing. Some of the most popular tools are NTOSpider from NT OBJECTives; WhiteHat Sentinel from WhiteHat Security; AppScan from WatchFire, now owned by IBM; and Web Inspect from Spi Dyanmics, now owned by HP. More tools in different testing categories are listed here.

Many of the vendors in the Web app assessment space come from the network assessment market. Even though there is the common goal of looking for vulnerabilities, the business of finding flaws in web applications is vastly different from searching for vulnerabilities on a network. For instance, on a network, you can use signature-based tests. For Web apps, the vulnerabilities vary too widely, and signatures don’t work well. As a result, the Web app testing tools also vary widely in their results. This can make it hard to compare tools and figure out which one(s) will work best for your environment.

Larry Suto, an application security consultant in San Francisco, just published a report that compares three Web application scanners: NTOSpider, AppScan and WebInspect. He put them through a battery of tests to gauge their effectiveness in four areas:

* Links crawled
* Coverage of the applications tested using Fortify Tracer
* Number of verified vulnerability findings
* Number of false positives

Suto writes, “One of the most surprising results is the discrepancy in coverage and vulnerability findings between the three tools.” Read the report to see the detailed results of Suto’s tests and see what he recommends for vulnerability testing. Hint: Suto suggests that marketshare leaders aren’t always the best overall performers, so don’t overlook the lesser known tools.

Linda Musthaler is a principal analyst with Essential Solutions Corporation.