Click here to receive your FREE subscription to Campus Technology
News
Web 2.0 Entails 'Sleeping Giant' Security Risk
10/30/2007
As increasing numbers of enterprises climb aboard the Web 2.0 bandwagon, it's more important than ever for software developers to keep security in mind during the development process. So says Danny Allan, director of security research at Watchfire, the Waltham, MA-based Web-app security company acquired by IBM in July. Allan was in Santa Clara, CA to speak at this year's AjaxWorld show, and he took a few minutes to talk with me before his presentation.
The two top vulnerabilities affecting Web 2.0 applications today, Allan said, are cross-site scripting (CSS) and cross-site request forgery (CSRF).
"CSS is nothing new," he said, "but the attack vectors and the way in which it is used in Web 2.0 applications is very different and much more dangerous. And CSRF is the sleeping giant. It hasn't been exploited much to date, but it's looming large on the horizon."
CSRF is a malicious Web site exploit in which an attacker fakes a request to a site. CSRF is similar to CSS, but where CSS requires crackers and malicious hackers to inject unauthorized code into a Web site, CSRF simply transmits unauthorized commands seemingly from a user the Web site trusts.
"In a cross-site attack, a malicious individual attacks a victim," Allan explains. "Say you're on your banking Web site, and I get control of your browser. I can essentially force you to log into your banking application and transfer funds to my account. Request forgery provides the site with a legitimate request; it exploits the way the Web works, which performs actions based on input from trusted and authenticated users without requiring the user to authorize a specific action. The challenge for organizations is, they don't know when the request is legitimate or it has been forced upon them."
Web 2.0 makes all of this a bit worse, Allan said, because every interaction isn't initiated by the user. The AJAX framework underneath makes many of these requests, so it becomes more and more difficult to tell whether the request came from the user.
The attacks are new, but the causes haven't changed.
"I think one of the problems is that we focus too much on the latest Web 2.0 attacks, and not on why that attack worked," Allan said. "The 'why' hasn't changed. If we build security into the software development lifecycle and consider things like input validation stringently and output encoding--all these things we've all been talking about for 15 years--we'll solve these problems."
One of the best things the industry has done to improve application security, Allan says, is implementing mature frameworks, like Java EE, .NET, and Struts. One of the challenges in the Web 2.0 world is that the frameworks for that environment have yet to achieve that same level of maturity.
Allan advises Web 2.0 developers to shift their approach to security essentially in the same way that many have shifted their approach in the overall development process: from a traditional waterfall approach to what amounts to an agile or lightweight approach. And his advice for app-dev managers who want to get their developers to be more security minded: Don't try to "boil the ocean" and test for everything. Pick the top couple of security risks--say, CSS and CSRF--and do an incremental rollout.
"You don't want to fire hose the developers with too many security tests," he said. "It becomes overwhelming and they end up not doing anything. If we do incremental and ongoing iterative testing, it's manageable."
Read More:
John K. Waters is a freelance journalist and author based in Palo Alto, CA.
Cite this Site
copy text (above) for proper citation
Recommended Reading
- Sun, Stanford Working To Archive History
In May in San Francisco, experts from leading universities, libraries, and research institutions around the world met as part of an ongoing effort to address a pressing issue: archiving the world's history, right up to today.
- The Quilt Coalition Rolls Out XO Communications for High-Capacity Network Services
The Quilt, a coalition of 28 regional network organizations, has added XO Communications Services to its authorized vendor list. The Quilt represents 200 universities and thousands of other educational institutions across the United States. With this new relationship, Quilt members can purchase XO's high-speed IP transit and network transport services at competitive rates.
- Wimba Classroom 5.2 Expands Classroom Capture Support, Adds MP3 Downloads
At the NECC 2008 conference in Texas this week, Wimba launched a new version of Wimba Classroom, the virtual classroom component of the company's Collaboration Suite. The new 5.2 release expands options for classroom capture and adds a variety of other functional and ease of use features.
- Automation Chimera: Education Is Not Management
The lure of automating workflow online so human intervention is minimized is continually reinforced in the minds of higher education administrators by examples of automated campus systems such as financials, student information systems, and other enterprise systems. But what's good for management is not always good for learning.
- Cognos Releases BI Software for Linux-based IBM System z Mainframe
Cognos, which IBM acquired in January, has released an update to its business intelligence software that will run on the Linux operating system on IBM System z mainframes. IBM Cognos 8 BI was being developed by the two companies prior to the acquisition, but assimilation of Cognos into IBM accelerated development.
- Facebook and Collegiality: A Serendipitous Social Niche
Facebook is a way to greet a colleague as if she or he is on your own campus: a wave at a distance, a hello at the corner burrito place, a honk as you both leave the campus parking lot. Informal collegiality has been extended over the miles.
