Risk: Informational
60% of web application tests performed for UK organisations showed that their websites contain weak encryption or cross-site scripting (XSS) vulnerabilities.
These findings form part of NTA's Annual Web Application Security Report 2008, which analysed data gathered from web application security tests performed for a wide range of industry sectors including finance, government, education, IT, law and retail.
Some applications are vulnerable to cross-site scripting attacks, which enable a hostile web site to cause potentially malicious code such as JavaScript commands to misdirect or compromise an end user's browser. This can enable an attacker to collect sensitive information such as passwords and card payment details.
NTA recommends three key procedures that organisations can follow to reduce their risk.