Regulatory ‘compliance’ – it’s a dirty word in business today. Perhaps that’s because we’re being force-fed more and more rules that various governing bodies believe are the best ways for us to run our businesses. Regardless of what side of the government growth – and…
Protecting Your Brand with a Secure Website
These days, everyone and their grandmother has a website or blog. It’s becoming more and more common for the average person to have a website, whether it’s for informational purposes or as a way to promote a product or service. Either way, there is a…
MySQL.com Victim of SQL Injection Attack
Introduction On 27th March 2011 a message was posted on the popular Full Disclosure mailing list exposing a recent hack against the website mysql.com. This vulnerability was apparently also reported by a hacker called TinKode, who also claims to have found a cross site scripting…
Don’t Overlook the Importance of Authenticated Testing
Would you want to rely a home inspector’s analysis of just the outside of a new home you’re considering for purchase? What about a lab tech only running a partial CT scan or the radiologist analyzing only part of your MRI when your health is…
Cross Site Scripting Attacks
Hackers are constantly experimenting with a wide repertoire of hacking techniques to compromise websites and web applications and make off with a treasure trove of sensitive data including credit card numbers, social security numbers and even medical records. Cross Site Scripting (also known as XSS…
You can’t change what you tolerate
Attending a recent meeting I heard one of the speakers say “You can’t change what you tolerate.” Apparently it’s a quote from Cesar Millan (the dog whisperer) but it really struck a chord in me regarding web application security and overall information risk management. How…
How to Avoid the Google Blacklist
In the ‘old days’ – around 4 to 6 years ago, when the Google Blacklist was less of a news item – hackers were primarily interested in stealing customer data from websites. They would cause absolute havoc after breaking in, stealing anything from customer credit card…
Testing for weak passwords: a common oversight without a great solution
Typically when we think of Web security testing vulnerabilities such as SQL injection, cross-site scripting and so on come to mind. Rightly so, the flaws resulting from poor input validation alone are still a large part of the problem. But there’s another Web security vulnerability…
General Facts and Figures on Web Hacking
Facts about Web Hacking Verizon Business conducted a 2009 study of 90 Web data breaches. The results of this study were presented in The Data Breach Investigative Report (DBIR) and included the following facts and figures: 285 million data records were exposed in the 90…