sb-nz logo
Story image

Study finds it’s still the basics causing critical threats for businesses

30 Aug 2017

In today’s modern age, companies are inundated with cybersecurity threats every day – but which are the most critical?

New findings recently published by Context Information Security reveal that more than 60 percent of high and critical vulnerabilities in web applications are still accounted to cross site scripting, weak authentication and TLS (transport layer security).

The research was based on 14,000 vulnerabilities identified and qualified from around 1,300 manually guided penetration tests.

Around 1,700 of these (thirteen percent) were rated as high or critical impact and likely to result in unauthorised access or a compromise of user data or application functionality that could lead to financial or legal impact.

Assurance regional lead for Scotland at Context Information Security, Andrew Scott says it’s time for businesses to wise up to these ‘old’ threats.

“These threats have been around for years, but it appears that the message is still not getting through,” says Andrew Scott, Assurance Regional Lead - Scotland at Context Information Security.

“If an organisation were to focus on educating developers and their supply chain to prevent cross site scripting and authentication problems, while creating robust deployment processes for TLS, a large proportion of these problems could be avoided.”

In addition to these findings, the study also delved into the ratio of critical or high findings to total findings for each category.

Context information Security uses the example of session management problems, of which more than 400 were identified but only 2 percent of these led to a direct route to compromise.

However, cross site scripting was found around 300 times but a whopping half of them were critical or high, which shows that interventions around addressing these areas at source can have a greater impact on the risk profile of an application or organisation. 

What is concerning is the largest number of high or critical findings were around weak authentication – covering everything from password strength, storage and reset processes through to how cookies are created and handled.

Context Information Security also fund close to 1,000 issues related to the communication channel, suggesting that use of TLS and its additional security controls are still not well understood or applied.

“TLS issues often need addressing at the infrastructure layer and may not be under the control of developers,” says Scott.

“Much like cross site scripting in the application space however, a very formulaic approach can be developed for each environment and can help address these problems.”

Story image
As digital transformation grows in A/NZ companies, misconceptions about their role in cloud security abound
While an 81% majority of A/NZ organisations are accelerating their digital transformation, a giant 99% of surveyed respondents say they believe their cloud security provider provides enough protection, according to a Trend Micro study. More
Story image
Users pay with personal data - Kaspersky on WhatsApp move to share data with Facebook
"Nothing is truly free, and, unfortunately, the current business model for free services means that, essentially, we pay with our data."More
Story image
Hornetsecurity acquires Altaro, the latest in acquisition spree
The move is a culmination of a medley of acquisitions made by Hornetsecurity recently, following the January 2019 acquisition of Spamina, a Spanish cloud email security company, as well as EveryCloud, its British market partner, in early 2020.More
Story image
Sophos unearths origin of prominent cryptominer
The cryptominer was recently discovered when attackers targeted internet-facing database servers (SQL servers), and the MrbMiner was downloaded and installed.More
Story image
Emotet remains leading malware in global threat index
The malware has impacted 7% of organisations globally, following a spam campaign which targeted more than 100,000 users per day during the holiday season.More
Story image
Sophos Rapid Response puts out the ransomware fire
“Attackers are using a range of techniques and whichever defence has a weakness is how they get in. When one technique fails they move on to the next, until they find a weak spot."More