60% of UK website tests revealed Internet encryption and cross-site scripting vulnerabilities
60% of web application tests performed for UK organisations showed that their websites contain weak encryption or cross-site scripting (XSS) vulnerabilities. Furthermore, over three quarters (78%) of websites tested contained one or more medium level risk that may enable external users to gain unauthorised access or disrupt service availability.
These findings form part of NTA's Annual Web Application Security Report 2008, which analysed data gathered from web application security tests performed for a wide range of industry sectors including finance, government, education, IT, law and retail.
Roy Hills, Technical Director at NTA Monitor, says: "Weak SSL encryption vulnerabilities may cause sessions to be compromised. All SSL should have strong encryption of at least 128 bits, which is almost impossible to crack."
Some applications are vulnerable to cross-site scripting attacks, which enable a hostile web site to cause potentially malicious code such as JavaScript commands to misdirect or compromise an end user's browser. This can enable an attacker to collect sensitive information such as passwords and card payment details.
Hills continues: "Web applications are the custodians of critical and confidential data, and organisations need to implement the necessary security procedures to ensure that these systems are secure from unintentional or malicious compromise. Web applications are commonly the most vulnerable part of an organisation's network, as they necessarily allow Internet users to input and access data. Content and design is frequently altered in order to keep up with the demand for new features and functionality, but even simple changes could produce a new vulnerability that may threaten confidential information."
NTA recommends three key procedures that organisations can follow to reduce their risk:
- Apply a hardening and patching procedure to all Internet facing web servers.
- Strong encryption (128 bit SSL) should be used for all sensitive details, such as credit card numbers and passwords.
- All user-supplied data should be properly sanitised before returning it to the browser or storing it in a database.
The full report contains further recommendations and not only looks at the different types of vulnerabilities found in organisations, but also examines how a range of industry sectors fair against the average findings. It is available from NTA by emailing marketing@nta-monitor.com
This article was first released on: 10th April 2008