* Buffer overflows and error handling are top vulnerabilities in Web apps
Are your e-comm applications secure enough? This is the question that the Open Web Application Security Project – OWASP – is posing to e-tailers and other companies doing business on the ‘Net. And for many, the answer is no.
The group was formed to help people shore up their Web applications and conduct business across the Web safely. On the group’s Web site at https://www.owasp.org/, Web developers can learn about common security problems, efforts to develop a standard security framework, and work being done to prevent malicious attacks on Web applications. There are also case studies that help Web developers test the security of their applications.
Recently, OWASP created a list of the top 10 vulnerabilities in Web applications – these are the vulnerabilities that can jeopardize corporate and customer data. The list includes problems with buffer overflows and error handling. Both can allow data to be compromised quite easily.
Also making the list is the insecure use of cryptography. The OWASP warns that “[cryptographic functions] and the code to integrate them have proven difficult to code properly, frequently resulting in weak protection.” These functions are what Web sites use to protect customer information and credentials.
There are some basic issues that made the list, as well, including server configuration. One of the easiest problems to encounter is a server that has not had its security turned on. While some products offer out-of-the-box security, others require administrators to manually configure their options.
Another common mistake is to misconfigure remote administration functions, according to the OWASP. Allowing administrators to access the site remotely via a Web interface can pose security risks, especially if that access has not been properly managed.
For the complete list of Web application snafus, check out https://www.owasp.org/. You’ll also find other helpful information here that will help you keep the information traveling across your network secure.
