Story image

Study finds it’s still the basics causing critical threats for businesses

30 Aug 17

In today’s modern age, companies are inundated with cybersecurity threats every day – but which are the most critical?

New findings recently published by Context Information Security reveal that more than 60 percent of high and critical vulnerabilities in web applications are still accounted to cross site scripting, weak authentication and TLS (transport layer security).

The research was based on 14,000 vulnerabilities identified and qualified from around 1,300 manually guided penetration tests.

Around 1,700 of these (thirteen percent) were rated as high or critical impact and likely to result in unauthorised access or a compromise of user data or application functionality that could lead to financial or legal impact.

Assurance regional lead for Scotland at Context Information Security, Andrew Scott says it’s time for businesses to wise up to these ‘old’ threats.

“These threats have been around for years, but it appears that the message is still not getting through,” says Andrew Scott, Assurance Regional Lead - Scotland at Context Information Security.

“If an organisation were to focus on educating developers and their supply chain to prevent cross site scripting and authentication problems, while creating robust deployment processes for TLS, a large proportion of these problems could be avoided.”

In addition to these findings, the study also delved into the ratio of critical or high findings to total findings for each category.

Context information Security uses the example of session management problems, of which more than 400 were identified but only 2 percent of these led to a direct route to compromise.

However, cross site scripting was found around 300 times but a whopping half of them were critical or high, which shows that interventions around addressing these areas at source can have a greater impact on the risk profile of an application or organisation. 

What is concerning is the largest number of high or critical findings were around weak authentication – covering everything from password strength, storage and reset processes through to how cookies are created and handled.

Context Information Security also fund close to 1,000 issues related to the communication channel, suggesting that use of TLS and its additional security controls are still not well understood or applied.

“TLS issues often need addressing at the infrastructure layer and may not be under the control of developers,” says Scott.

“Much like cross site scripting in the application space however, a very formulaic approach can be developed for each environment and can help address these problems.”

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.