Do Web Developers Avoid Scrutiny?

Due to the nature of our business we speak to many people in various industries and something is becoming more and more clear as time goes by – website and web application developers are reluctant to have the security of their work scrutinised.

I understand their dilemma – if they have their solutions security tested it will add to their costs and increase the price of their product.  Or it may affect client beliefs that the products they deliver are already secure.  

Then there is the hosting company who provide the hardware and infrastructure which allows websites to be accessed – some of the security issues may lie there, so why would the site developer worry about security?

Indeed, I had a conversation recently with a website development company who didn’t want their product security tested because to do so may imply that they aren’t building things properly in the first place.  They went on to point out that if the client discovers a security issue in the application later, they can charge them again for fixing it!

The other problem is one of accountability.  In the recent attacks against Sony, Sega and others it is the company or organisation attacked that gets the bad press and the flak, not the company they got in to develop the website or application.

This means the website developers get off scot-free with the probably loss of just that piece of work or client.

So how do we change this?  What should companies and organisations do to ensure the work done for them is of a high enough standard?

Well here are a number of suggestions:

1.       Ask them about the security measures they build in to your solution.  If they’re vague or evasive find another supplier.  Have whatever response you get evaluated by an expert.

2.       Ask them up-front if they have the site independently security tested or whether they are happy for you to do so once the solution is complete but before you pay for it.

3.       Ask them to guarantee the site’s security, or at least provide fixes for free should security vulnerabilities be identified later.  Make sure this is in the contract.

4.       If they do security test the solution find out if it is truly independent and whether the site will receive any accreditation in the form a security seal or other certificate.

At the end of the day, if you employ a website developer to create your website it’s still your data, reputation and profit that’s at risk if your security isn’t up to scratch.  Is that a risk you’re willing to take?

For more information on website security in general and website security auditing contact Secure Thinking on 0845 071 4690 or visit www.securethinking.co.uk

A New Breed of Hacker

An interesting development seems to have taken place in the world of Internet security over the last few months.

Back in the early days of the web hackers were mainly script kiddies and other individuals or small groups out to prove a point.

The threats and the risks increased when organised crime realised there was big money in online hacking activities and brought their considerable financial and organisational skills to the arena.

We have also seen nation states allegedly taking part with coordinated attacks designed to access or infiltrate the systems of other countries, either for political or commercial reasons.

Then there was the "hacktivists" - people out to cause disruption or protest against certain companies, beliefs or activities.

But over the last few months we have seen a new form of "hacktivist". One that takes on a scary new role.

These new style groups which include Anonymous/4Chan and LulzSec have a number of similar attributes They are:

Almost anarchistic
Anti-establishment
Competitive with each other
Loosely organised
Democratic
Ego driven
Out to prove they can "do it"
Bordering on the mercenary

They are however having one positive effect - they are making the issue of web and Internet security front page news across the world.

Ultimately this could prove to be their primary motivation - only time will tell.

In the meantime, their indiscriminate attacks need to be thwarted so take a long hard look at your website and ask yourself "is my security up to scratch?"

If it isn't or you're not sure seek expert advice and get some protection before you become a target.

For more information on website security contact Secure Thinking on 0845 071 4690 or visit http://www.SecureThinking.co.uk

Simplifying the Web Site Security Issue

Web site security vulnerabilities are a common problem but few web site owners, business operators or even web designers truly understand the nature of the problem. 

I wrote some time ago about why web site security is important for everyone but it is a hard concept to communicate to people who have little or no understanding of the technology involved in hosting a web site, Internet service or e-commerce business. 

So this article is an attempt to make a non-technical comparison which can be understood by anyone. 

Imagine you own a Conference Centre (your website). This facility has lots of rooms (pages) and attracts hundreds of attendees (visitors or customers computers) every day. Some attendees will come regularly for different courses or will cover the same course over and over again. 

Other attendees may have a quick look around and decide they aren't ready to do a course just yet. But may come back later. 

Unbeknown to you, one of the training rooms has a broken lock on the fire exit (vulnerability) through which every day a hypnotist enters. 

This hypnotist is a nasty person (malware) and he quickly hypnotises (infects) everyone in the room. He tells them to gather as much information on the financial transactions of those around them as they can. Then, when they hear the keyword "download", they will divulge all the information they have gathered and forget what they have done. 

So the attendees go off about their day-to-day activities and, without realising what they're doing, quietly gather the information. 

They collect the bank statements and account details of their family and loved ones, they watch as people enter PIN numbers at the checkout and they copy down and skim credit card details. 

They also collect security codes, PIN numbers and password used for non-financial purposes because they know people reuse them frequently and they may be useful. 

Then, a few days later a phone call arrives and the keyword is mentioned. The attendee passes everything they have gathered to the hypnotist. 

Days, weeks or months pass before anyone starts noticing. First it's a card transaction declined. Then it's bailiffs calling round and before long the reason is understood - the family and friends of the attendee have been the victims of identity theft and fraud, and have lost thousands. 

Tens, hundreds or even thousands of people have been robbed of thousands or even millions of pounds. 

Eventually, the auhorities trace the cause of the problem back to the Conference Centre but there's no sign of the hypnotist. 

All that happens now is the attendees lose confidence in the Conference Centre and stop coming. Very quickly the centre goes out of business. 

And all because the owner of the conference centre didn't make sure the facility was secure. 

Secure Thinking When Online

If you run a small business or you manage the HR department of a large organisations you may well be aware of some of the issues surrounding staff use of social networking sites.

Social networking sites such as Facebook, professional networking sites like LinkedIn, and the various personal and professional blogging facilities, not to mention the micro-blogging sites like Twitter provide everyone with an opportunity to communicate with others with whom they have an affinity, voice their grievances and raise awareness of issues.

The problem for businesses and employers is when employees over-step the professional/social boundary.

If employees use social networking to make comments about the company, fellow employees, management or customers it can have a dire effect on business, perceptions and relationships both inside and external to the organisation.

Whilst many companies are aware of this and take some steps to mitigate the risk, it is often only done using a stick.  The general approach appears to be to discipline anyone who oversteps the mark - even when those marks aren't clearly defined.  This leads to further frustration and ultimately a breakdown in relations between employer and employee.

At Secure Thinking, we believe that this approach is wrong and have now decided to do something about it.  We are therefore offering a new awareness service - Secure Thinking When Online - where we will come on site at your company, or other location, and present to your staff about the risks of online behaviour, why the rules exist and how to protect themselves in their everyday internet based activities.

Why Website Security is Important for Everyone

Most websites, whether owned by an individual, an organisation or a business, are never security tested. Many see it as an irrelevant or unjustified expense, citing the fact that it’s mainly static content, there’s no sensitive information held on the site, it doesn’t accept financial transactions, etc., so there’s no point in potentially expensive web security testing, as the business or organisation can’t be affected by insecurities.

Well, to put it simply, this is not true!

Whilst your website might not contain sensitive information, might not accept any financial or personal transactions, and may be purely static content, you are still putting your clients and website visitors at risk.

Cyber criminals, of which there are many, are not necessarily interested in gaining access to your business and its information – although you are always a likely target – but they ARE after your customers. They want access to their computers and their details and they can use the vulnerabilities in your website to get that access.

More and more often, we are seeing ordinary websites used to load malicious software onto the computers of unsuspecting victims. Cyber criminals are scanning the internet, looking for any websites which are insecure and are loading them with malicious software (called ‘malware’). This in turn is then passed on to the computers of every visitor to your site in what is known as a “drive by attack”, exposing them to all kinds of issues such as identity theft, bank account skimming and credit card fraud.

So whilst your organisation may not be affected directly by your website security problems, there is a huge amount of damage that can be inflicted on your customers and passing visitors, for which you are at least partly to blame.

This has now reached a point in the US where victims of such incidents are taking the website owners to court for compensation. And whilst this may not be likely to happen in the UK or elsewhere, there is certainly the potential for it, particularly where an incident can be traced back to a specific website.

If every person who merely looked at your premises was in danger of some injury, you would rightly take steps to prevent it. So why wouldn’t you take such a course of action in the virtual world of the internet, where such damage can be just as serious?