Web sites are unfortunately prone to security risks. And so are any networks to which web servers are connected. Setting aside risks created by employee use or misuse of network resources, your web server and the site it hosts present your most serious sources of security risk.
Web servers by design open a window between your network and the world. The care taken with server maintenance, web application updates and your web site coding will define the size of that window, limit the kind of information that can pass through it and thus establish the degree of web security you will have.
Is Your Site or Network at Risk?
"Web security" is relative and has two components, one internal and one public. Your relative security is high if you have few network resources of financial value, your company and site aren't controversial in any way, your network is set up with tight permissions, your web server is patched up to date with all settings done correctly, your applications on the web server are all patched and updated, and your web site code is done to high standards.
Your web security is relatively lower if your company has financial assets like credit card or identity information, if your web site content is controversial, your servers, applications and site code are complex or old and are maintained by an underfunded or outsourced IT department. All IT departments are budget challenged and tight staffing often creates deferred maintenance issues that play into the hands of any who want to challenge your web security.
Web Security Risk - Should You Be Worried?
If you have assets of importance or if anything about your site puts you in the public spotlight then your web security will be tested. We hope that the information provided here will prevent you and your company from being embarrassed - or worse.
It's well known that poorly written software creates security issues. The number of bugs that could create web security issues is directly proportional to the size and complexity of your web applications and web server. Basically, all complex programs either have bugs or at the very, least weaknesses. On top of that, web servers are inherently complex programs. Web sites are themselves complex and intentionally invite ever greater interaction with the public. And so the opportunities for security holes are many and growing.
Technically, the very same programming that increases the value of a web site, namely interaction with visitors, also allows scripts or SQL commands to be executed on your web and database servers in response to visitor requests. Any web-based form or script installed at your site may have weaknesses or outright bugs and every such issue presents a web security risk.
Contrary to common knowledge the balance between allowing web site visitors some access to your corporate resources through a web site and keeping unwanted visitors out of your network is a delicate one. There is no one setting, no single switch to throw that sets the security hurdle at the proper level. There are dozens of settings if not hundreds in a web server alone, and then each service, application and open port on the server adds another layer of settings. And then the web site code... you get the picture.
Add to that the different permissions you will want to grant visitors, prospects, customers, partners and employees. The number of variables regarding web security rapidly escalates.
A web security issue is faced by site visitors as well. A common web site attack involves the silent and concealed installation of code that will exploit the browsers of visitors. Your site is not the end target at all in these attacks. There are, at this time, many thousands of web sites out there that have been compromised. The owners have no idea that anything has been added to their sites and that their visitors are at risk. In the meantime visitors are being subject to attack and successful attacks are installing nasty code onto the visitor's computers.
Web Server Security
The world's most secure web server is the one that is turned off. Simple, bare-bones web servers that have few open ports and few services on those ports are the next best thing. This just isn't an option for most companies. Powerful and flexible applications are required to run complex sites and these are naturally more subject to web security issues.
Any system with multiple open ports, multiple services and multiple scripting languages is vulnerable simply because it has so many points of entry to watch.
If your system has been correctly configured and your IT staff has been very punctual about applying security patches and updates your risks are mitigated. Then there is the matter of the applications you are running. These too require frequent updates. And last there is the web site code itself.
Web Site Code and Web Security
You site undoubtedly provides some means of communication with its visitors. In every place that interaction is possible you have a potential web security vulnerability. Web sites often invite visitors to:
- Load a new page containing dynamic content
- Search for a product or location
- Fill out a contact form
- Search the site content
- Use a shopping cart
- Create an account
- Logon to an account
In each case noted above your web site visitor is effectively sending a command to or through your web server - very likely to a database. In each opportunity to communicate, such as a form field, search field or blog, correctly written code will allow only a very narrow range of commands or information types to pass - in or out. This is ideal for web security. However, these limits are not automatic. It takes well trained programmers a good deal of time to write code that allows all expected data to pass and disallows all unexpected or potentially harmful data.
And there lies the problem. Code on your site has come from a variety of programmers, some of whom work for third party vendors. Some of that code is old, perhaps very old. Your site may be running software from half a dozen sources, and then your own site designer and your webmaster has each produced more code of their own, or made revisions to another's code that may have altered or eliminated previously established web security limitations.
Add to that the software that may have been purchased years ago and which is not in current use. Many servers have accumulated applications that are no longer in use and with which nobody on your current staff is familiar. This code is often not easy to find, is about as valuable as an appendix and has not been used, patched or updated for years - but it may be exactly what a hacker is looking for!
Known Web Security Vulnerabilities and Unknown Vulnerabilities
As you know there are a lot of people out there who call themselves hackers. You can also easily guess that they are not all equally skilled. As a matter of fact, the vast majority of them are simply copycats. They read about a KNOWN technique that was devised by someone else and they use it to break into a site that is interesting to them, often just to see if they can do it. Naturally once they have done that they will take advantage of the site weakness to do malicious harm, plant something or steal something.
A very small number of hackers are actually capable of discovering a new way to overcome web security obstacles. Given the work being done by tens of thousands of programmers worldwide to improve security, it is not easy to discover a brand new method of attack. Hundreds, sometimes thousands of man-hours might be put into developing a new exploit. This is sometimes done by individuals, but just as often is done by teams supported by organized crime. In either case they want to maximize their return on this investment in time and energy and so they will very quietly focus on relatively few, very valuable corporate or governmental assets. Until their new technique is actually discovered, it is considered UNKNOWN.
Countering and attempting to eliminate any return on this hacking investment you have hundreds if not thousands of web security entities. These public and private groups watch for and share information about newly discovered exploits so that an alarm can be raised and defense against unknown exploits can be put in place quickly. The broad announcement of a new exploit makes it a KNOWN exploit.
The outcome of this contest of wills, so to speak, is that exploits become known and widely documented very soon after they are first used and discovered. So at any one time there are thousands (perhaps tens of thousands) of known vulnerabilities and only a very, very few unknown. And those few unknown exploits are very tightly focused onto just a very few highly valuable targets so as to reap the greatest return before discovery. Because once known the best defended sites immediately take action to correct their flaws and erect better defenses.
Your Greatest Web Security Risks: Known or Unknown?
Your site is 1,000 times more likely to be attacked with a known exploit than an unknown one. And the reason behind this is simple: There are so many known exploits and the complexity of web servers and web sites is so great that the chances are good that one of the known vulnerabilities will be present and allow an attacker access to your site.
The number of sites worldwide is so great and the number of new, as of yet undocumented and thus unknown exploits so small that your chances of being attacked with one is nearly zero - unless you have network assets of truly great value.
If you don't attract the attention of a very dedicated, well financed attack, then your primary concern should be to eliminate your known vulnerabilities so that a quick look would reveal no easy entry using known vulnerabilities.
This article came from Beyond security
More to come
Joe Rossini
