Click here to receive your FREE subscription to Campus Technology
News
Web Developers Left Holding the Bag on SQL Injection Attacks
5/1/2008
Developers need to understand that it's a brave new world, according to Andrew Storms, director of security operations at nCircle Inc. in San Francisco.
"The early days of writing Web applications, what we called CGIs back in the early 90s, we always lived by a single simple truth -- never trust user input," Storms said. "It seems now that Web application developers have forgotten this golden rule and have been lazy, allowing sanity and security checking to be performed by some other library or module. Combine this with fancy Web applications and Web services and the result is what we see today."
For this reason, Storms and others argue, there are loads of Web sites vulnerable to any number of Web-based attacks, such as SQL injection, cross-site scripting and cross-site request forgery.
The variety of potential problems adds to the mystery.
"At this point we really don't know exactly if the problem at hand [this week] is due to a Microsoft bug or poorly written application code," Storms said. "The more likely answer is that the attack vector of these Web sites varies just enough from each site that it's making things difficult to pinpoint a single root cause."
IT pros may need to ramp up IT risk management and application-level access controls, experts say. Such a process involves continuous vulnerability assessment, as well as Web application risk profiling. It's best to start such a process from the beginning of code development all the way into preproduction, scanning Web applications for potential risks.
The amount of at-risk Web sites cited this week -- somewhere between 200,000 and 500,000 Web sites -- is an "egregious number," according to Storms. Such figures are not as imposing as numbers "like one million to ten million storm worm bots back in 2007," Storms said, adding that "these SQL incursions are an entirely different breed."
The attacks are sobering news, he added.
"The reason for such controversy here is that this instance is a difficult fact to swallow," he said. "To the average unsuspecting Web surfer, the risk that they could be hit by some drive-by malware has now increased significantly. We used to tell our older relatives to only surf trusted Web sites and don't click on e-mail links, but that kind of advice is becoming less and less foolproof."
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others. You can contact Jabulani at editor@entmag.com.
Cite this Site
copy text (above) for proper citation
Recommended Reading
- Sun, Stanford Working To Archive History
In May in San Francisco, experts from leading universities, libraries, and research institutions around the world met as part of an ongoing effort to address a pressing issue: archiving the world's history, right up to today.
- The Quilt Coalition Rolls Out XO Communications for High-Capacity Network Services
The Quilt, a coalition of 28 regional network organizations, has added XO Communications Services to its authorized vendor list. The Quilt represents 200 universities and thousands of other educational institutions across the United States. With this new relationship, Quilt members can purchase XO's high-speed IP transit and network transport services at competitive rates.
- Wimba Classroom 5.2 Expands Classroom Capture Support, Adds MP3 Downloads
At the NECC 2008 conference in Texas this week, Wimba launched a new version of Wimba Classroom, the virtual classroom component of the company's Collaboration Suite. The new 5.2 release expands options for classroom capture and adds a variety of other functional and ease of use features.
- Automation Chimera: Education Is Not Management
The lure of automating workflow online so human intervention is minimized is continually reinforced in the minds of higher education administrators by examples of automated campus systems such as financials, student information systems, and other enterprise systems. But what's good for management is not always good for learning.
- Cognos Releases BI Software for Linux-based IBM System z Mainframe
Cognos, which IBM acquired in January, has released an update to its business intelligence software that will run on the Linux operating system on IBM System z mainframes. IBM Cognos 8 BI was being developed by the two companies prior to the acquisition, but assimilation of Cognos into IBM accelerated development.
- Facebook and Collegiality: A Serendipitous Social Niche
Facebook is a way to greet a colleague as if she or he is on your own campus: a wave at a distance, a hello at the corner burrito place, a honk as you both leave the campus parking lot. Informal collegiality has been extended over the miles.
