Story image

Study finds it’s still the basics causing critical threats for businesses

30 Aug 2017

In today’s modern age, companies are inundated with cybersecurity threats every day – but which are the most critical?

New findings recently published by Context Information Security reveal that more than 60 percent of high and critical vulnerabilities in web applications are still accounted to cross site scripting, weak authentication and TLS (transport layer security).

The research was based on 14,000 vulnerabilities identified and qualified from around 1,300 manually guided penetration tests.

Around 1,700 of these (thirteen percent) were rated as high or critical impact and likely to result in unauthorised access or a compromise of user data or application functionality that could lead to financial or legal impact.

Assurance regional lead for Scotland at Context Information Security, Andrew Scott says it’s time for businesses to wise up to these ‘old’ threats.

“These threats have been around for years, but it appears that the message is still not getting through,” says Andrew Scott, Assurance Regional Lead - Scotland at Context Information Security.

“If an organisation were to focus on educating developers and their supply chain to prevent cross site scripting and authentication problems, while creating robust deployment processes for TLS, a large proportion of these problems could be avoided.”

In addition to these findings, the study also delved into the ratio of critical or high findings to total findings for each category.

Context information Security uses the example of session management problems, of which more than 400 were identified but only 2 percent of these led to a direct route to compromise.

However, cross site scripting was found around 300 times but a whopping half of them were critical or high, which shows that interventions around addressing these areas at source can have a greater impact on the risk profile of an application or organisation. 

What is concerning is the largest number of high or critical findings were around weak authentication – covering everything from password strength, storage and reset processes through to how cookies are created and handled.

Context Information Security also fund close to 1,000 issues related to the communication channel, suggesting that use of TLS and its additional security controls are still not well understood or applied.

“TLS issues often need addressing at the infrastructure layer and may not be under the control of developers,” says Scott.

“Much like cross site scripting in the application space however, a very formulaic approach can be developed for each environment and can help address these problems.”

Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.