Rise of the web as a vector of attack

The past few years has seen a shift in the security landscape. While headlines have previously been dominated by lost laptops and USB sticks, today’s media focus has shifted to stories about poor website and web application security. Indeed, high profile cases – like those of Nasdaq and eHarmony – have seen the web used as the chosen vector of attack to gain access to sensitive and confidential information.

The potential implications of such breaches of security are huge – and throw into jeopardy an organisation’s reputation, its brand identity as well as its financial status. Given the multitude of global brands that are falling victim to such attacks, you have to question how prepared other organisations are to meet this growing threat.

The threat itself

The rise of the web as a major vector of attack should come as no surprise. Organisations’ growing reliance on the web, not just to provide a store front, but also to develop enterprise applications, means hackers have the widest possible choice of potential victims to target. Furthermore, while the open nature of the web makes it relatively easy to develop new applications, it also means that these programmes are comparatively simple to exploit.

Additionally, hackers have a relatively open goal with web vulnerabilities as companies continue to weigh their security investments in favour of reactive security measures, for example intrusion detection, anti-virus software and encryption. While it’s indisputable that these products are absolutely fundamental to enterprise security strategies, they fail to proactively address the new wave of web vulnerabilities affecting systems today. In contrast, web security receives a relatively small proportion of IT security budgets, even though the web is emerging as a key vector for attack.

To improve their defences, it is clear that organisations need to redress the imbalance between the risks posed by poor web application security and the resources spent proactively spotting and remediating these vulnerabilities.

The solution – consultancy and technology must go hand in hand

The big question is how organisations should look to address this problem – and herein lies the opportunity for the channel. It is quite clear that organisations need to be educated on the extent of the problem and the implications for their brand. Guidance is also required on the tools and tactics employed within an organisation to meet the evolving security landscape.  To that end, channel partners must work hand in hand with customers to adapt existing security strategies to meet present and future threats.

In addressing the problem, some key steps for the channel to take are as follows:

Proactively assess the problem – after all, there’s no point locking the gate after the horse has bolted. By monitoring an organisation’s IT infrastructure, a channel partner has the potential to add value by making sure that the organisation is aware of the latest threats, such as web vulnerabilities, and can advise and deploy the appropriate solutions to defend systems.

Select future-proofed systems – ultimately, the right tool must be selected for the job at hand. Cloud-based web application scanners have a crucial part to play in minimising the risk posed by web server flaws as well as the more high risk and complex threats found within web applications. Designed to test for vulnerabilities in web application software, such products mimic the role of a malicious hacker, looking to exploit weaknesses in system architectures. Reports are generated detailing any flaws found in the system, and what can be done to remedy them.  Referring to a database of known vulnerabilities that is constantly updated, web application scanners provide a much needed additional layer of security for companies looking to protect themselves from all types of vulnerabilities.

Manage the offering – in order to make the most of an investment, it is necessary for organisations to regularly monitor and assess their solution.  Given how stretched IT departments are, it is likely that organisations may look to a Managed Service Provider to provide this service.

Security threats are ever-changing, and a business that does not ensure that is has 360 degree protection will leave itself highly vulnerable. For many years the biggest threat facing an organsiation was an insecure web server or remote access system, but now the greatest threat is not so much the infrastructure itself, but the applications that run on it. To overlook this vital part of a company’s security infrastructure is potentially leaving the door wide open to attack– an issue companies would be wise to avoid.

Image: Shutterstock