Stay Ahead With Linux Security News

application securityinternet threatsrisk assessment

Evaluating Internet-Connected Custom Web Applications' Risks

This article is the fourth in a series that is designed to help readers to assess the risk that their Internet-connected systems are exposed to. In the first installment, we established the reasons for doing a technical risk assessment. In the . . . . This article is the fourth in a series that is designed to help readers to assess the risk that their Internet-connected systems are exposed to. In the first installment, we established the reasons for doing a technical risk assessment. In the second article, we started to discuss the methodology that we follow in performing this kind of assessment. The third part discussed methodology in more detail, focussing on visibility and vulnerability scanning. This installment will discuss a relatively unexplored aspect of Internet security, custom Web applications. Of all the possible services on the Internet DNS, e-mail and the World Wide Web are by far the most pervasive. (In fact, in July 2002, the monthly Netcraft Web site survey reported that 37,235,470 active Web servers were connected to the Internet.) Of these, Web services are the most complex and the most frequently abused. Originally a simple text-based information service, the Web has developed into a highly functional interactive application development platform that is being used for almost every possible application on both the Internet and Intranet. Major vendors have recognized the power of the Web and have made significant investments in Web development platforms. These include Sun (Java), Microsoft (Active Server Pages, Site Server and Commerce Server), the open source community (PHP) and others (ColdFusion). Such platforms make it very easy for standard administrators to develop complex applications. A simple wave of the Web development wand and suddenly everybody's a programmer, even me! Web applications are often developed by under-qualified, inexperienced developers. Unknowingly many programmers make errors that provide potential intruders with precisely the vector they need to penetrate theprivate network. As these applications are built on standard platforms, they tend to look similar, and tend to have similar security weaknesses. The link for this article located at SecurityFocus is no longer available. . This article is the fourth in a series that is designed to help readers to assess the risk that thei. article, fourth, series, designed, readers, assess. . Anthony Pell

Oct 04, 2002 • Anthony Pell Network Security