Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Find your Web app vulnerabilities...please

Tools that automate vulnerability testing
Technology Executive Alert By Linda Musthaler , Network World , 11/26/2007
Musthaler
Sign up for this newsletter now!

Linda Musthaler's CIO-level look at the latest networking technologies and their benefits and pitfalls.

  • Share/Email
  • Comment
  • Print

The busy holiday shopping season is upon us. Every day, millions of people log in to Web applications to make purchases. As long as they see the "yellow lock" icon on the bottom of the screen, they figure their transaction is safe, but that's not always the case. As the use of Web applications becomes more prominent, so, too, does the number of security incidents involving Web apps.

Web application vulnerabilities are a wide spread problem. According to WhiteHat Security, eight out of 10 Web sites have serious flaws. A January 2007 report published by WhiteHat estimated that about 71% of Web sites are vulnerable to cross-site scripting (XSS), followed by information leakage (30%), predictable resource location (28%), content spoofing (26%), insufficient authentication (21%) and SQL injection (20%).

It’s impossible to know how much the vulnerabilities cost businesses and consumers each year, but the number must easily run into the tens or hundreds of millions of dollars. For example, it was recently revealed that a business logic flaw in the QVS Web site allowed a woman to scam the company out of more than $400,000 in product. This person was caught, but it's possible that other people took advantage of the same flaw and never got caught. This incident shows it's more important than ever to thoroughly test your Web applications for vulnerabilities.

Manual testing is just too costly and time consuming, but fortunately there are numerous tools that automate vulnerability testing. Some of the most popular tools are NTOSpider from NT OBJECTives; WhiteHat Sentinel from WhiteHat Security; AppScan from WatchFire, now owned by IBM; and Web Inspect from Spi Dyanmics, now owned by HP. More tools in different testing categories are listed here.

Many of the vendors in the Web app assessment space come from the network assessment market. Even though there is the common goal of looking for vulnerabilities, the business of finding flaws in web applications is vastly different from searching for vulnerabilities on a network. For instance, on a network, you can use signature-based tests. For Web apps, the vulnerabilities vary too widely, and signatures don’t work well. As a result, the Web app testing tools also vary widely in their results. This can make it hard to compare tools and figure out which one(s) will work best for your environment.

Linda Musthaler is a principal analyst with Essential Solutions Corporation.

  • Share/Email
  • Comment
  • Print
Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.

Download the white paper.

Applications: taking back control

Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.

Learn more today.

Comments (1)
Login
Forgot your account info?

RE: Find your Web app vulnerabilities...pleaseBy Linda Musthaler on November 30, 2007, 2:15 pmFrom Linda Musthaler In this article, I twice cited a report that I've heard some readers can't get to. To help you find the report that provides detailed comparisons...

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed

Whitepapers

Windows Vista: Necessity and Opportunity

The Vista era of Windows is here. Yet most organizations will retain Windows XP alongside new Vista...

Vulnerability Management For Dummies

Download this concise book "Vulnerability Management for Dummies," to learn about the simple steps...

Security Considerations When Deploying Remote Access Solutions

Effective network security is most successful when you use a layered approach, with multiple...

Webcasts

Migrating to Windows Vista: Necessity and Opportunity

The Vista era of Windows is here. Yet most organizations will retain Windows XP alongside new Vista...

Turning information into a Competitive Advantage

Companies today are realizing that competitive advantage is harder to sustain when based solely on...

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Special Reports

Unified Threat Management from CheckPoint

Discover why Unified Threat Management Firewalls are ready for the enterprise today. High...

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...

Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.
Network World,to go. Wherever you are. Breaking news delivered to your mobile device. Select the hottest topics in networking and start receiving Network World on your mobile device today.