NTA Monitor

Latest News

Will IE6 be the next NT4?

1st October 2009 All penetration testers will remember the long tail of Windows NT 4.0, and how this operating system continued to be used long past the point when security updates stopped at the end of 2004. For many years the presence of an unpatchable NT4 server was a common issue in a penetration test report, and it is only now, almost five years after security support ended, that finding an NT4 system on a network is becoming a rare event. Read More

One in four web applications susceptible to high risk security flaws

7th September 2009 NTA Monitor has reported a 10% increase in the total number of web applications found to have at least one high-risk security issue... Read More

Organisations facing a changing threat landscape

20th July 2009 According to NTA Monitor's 2009 Annual Security Report, the average number of Internet security vulnerabilities is on the rise... Read More

The Return of the Insider Threat

1st July 2009 When NTA started security testing twelve years ago, the main focus was on the insider threat. There were many reports with statistics showing that most security breaches were due to insiders. By contrast there was very little focus on the external threat via Internet and third-party network links. Back then many companies did not even have a firewall. Read More

60% of UK website tests revealed Internet encryption and cross-site scripting vulnerabilities

60% of web application tests performed for UK organisations showed that their websites contain weak encryption or cross-site scripting (XSS) vulnerabilities. Furthermore, over three quarters (78%) of websites tested contained one or more medium level risk that may enable external users to gain unauthorised access or disrupt service availability.

These findings form part of NTA's Annual Web Application Security Report 2008, which analysed data gathered from web application security tests performed for a wide range of industry sectors including finance, government, education, IT, law and retail.

Roy Hills, Technical Director at NTA Monitor, says: "Weak SSL encryption vulnerabilities may cause sessions to be compromised. All SSL should have strong encryption of at least 128 bits, which is almost impossible to crack."

Some applications are vulnerable to cross-site scripting attacks, which enable a hostile web site to cause potentially malicious code such as JavaScript commands to misdirect or compromise an end user's browser. This can enable an attacker to collect sensitive information such as passwords and card payment details.

Hills continues: "Web applications are the custodians of critical and confidential data, and organisations need to implement the necessary security procedures to ensure that these systems are secure from unintentional or malicious compromise. Web applications are commonly the most vulnerable part of an organisation's network, as they necessarily allow Internet users to input and access data. Content and design is frequently altered in order to keep up with the demand for new features and functionality, but even simple changes could produce a new vulnerability that may threaten confidential information."

NTA recommends three key procedures that organisations can follow to reduce their risk:

The full report contains further recommendations and not only looks at the different types of vulnerabilities found in organisations, but also examines how a range of industry sectors fair against the average findings. It is available from NTA by emailing marketing@nta-monitor.com

This article was first released on: 10th April 2008