60% OF UK WEBSITE TESTS REVEALED INTERNET ENCRYPTION AND CROSS-SITE SCRIPTING VULNERABILITIES

Published 11th April 2008

10 April 2008: 60% of web application tests performed for UK organisations showed that their websites contain weak encryption or cross-site scripting (XSS) vulnerabilities. Furthermore, over three quarters (78%) of websites tested contained one or more medium level risk that may enable external users to gain unauthorised access or disrupt service availability.

These findings form part of NTA’s Annual Web Application Security Report 2008, which analysed data gathered from web application security tests performed for a wide range of industry sectors including finance, government, education, IT, law and retail.

Roy Hills, Technical Director at NTA Monitor, says: “Weak SSL encryption vulnerabilities may cause sessions to be compromised. All SSL should have strong encryption of at least 128 bits, which is almost impossible to crack.”

Some applications are vulnerable to cross-site scripting attacks, which enable a hostile web site to cause potentially malicious code such as JavaScript commands to misdirect or compromise an end user’s browser. This can enable an attacker to collect sensitive information such as passwords and card payment details.

Hills continues: “Web applications are the custodians of critical and confidential data, and organisations need to implement the necessary security procedures to ensure that these systems are secure from unintentional or malicious compromise. Web applications are commonly the most vulnerable part of an organisation’s network, as they necessarily allow Internet users to input and access data. Content and design is frequently altered in order to keep up with the demand for new features and functionality, but even simple changes could produce a new vulnerability that may threaten confidential information.”

NTA recommends three key procedures that organisations can follow to reduce their risk:

• Apply a hardening and patching procedure to all Internet facing web servers.
• Strong encryption (128 bit SSL) should be used for all sensitive details, such as credit card numbers and passwords.
• All user-supplied data should be properly sanitised before returning it to the browser or storing it in a database.


The full report contains further recommendations and not only looks at the different types of vulnerabilities found in organisations, but also examines how a range of industry sectors fair against the average findings. It is available from NTA by emailing marketing@nta-monitor.com

-ends-

About NTA Monitor

NTA Monitor, www.nta-monitor.com, is a market leading, innovative Internet security testing, auditing and consultancy company that helps to protect its 500+ customers from loss of revenue and reputation.

The company provides a range of security services including vulnerability testing, web application testing, wireless infrastructure testing, BlackBerry and laptop security testing, IT risk assessments, security policy and procedure reviews and network architecture auditing in order to help prevent unauthorised access to organisation’s networks and data. NTA regularly finds new vulnerabilities through its test projects and research and development programmes.

NTA is a founder member of the CESG 'CHECK' scheme and the newly-founded CREST (Council for Registered Ethical Security Testers). NTA is also an Approved Scanning Vendor (ASV) under the Payment Card Industry Data Security Standard (PCI DSS).

For further information, please contact:
Jacqui Delbaere
Delbaere Public Relations
Email: jacqui@delbaere.fsbusiness.co.uk
Tel: 0207 787 6218/ 07981 504468

Elaine Calvert
Email: elaine.calvert1@talktalk.net
Tel: 07764 614113