Infrastructure and Improper
Configuration Vulnerabilities One of the attackers
favorite ways to assault the application is by exploiting vulnerabilities within
the IT infrastructure. IT infrastructures are composed of several individual components,
which are setup as an integrated Internet environment, and it is these individual
components, which literally have thousands of known vulnerabilities. While
it is common knowledge that the individual components, which comprise IT infrastructures,
have these exposures and vulnerabilities, companies find it nearly impossible
to stop utilizing them. In this highly competitive market place companies face
substantial pressure to continually develop new and improved applications, and
as a result security, in some cases becomes an after thought. Security
managers are forced to continually try and protect their network, by installing
the latest patch or upgrade, which effectively becomes a very time consuming ineffective
task. Web hackers stay up to date with the latest vulnerabilities
and are often able to penetrate applications prior a patch or upgrade being released.
Furthermore, attackers do not need sophisticated hacking tools to attack at the
application level, in some cases a web browser and text editor are all an attacker
needs to create havoc. Back
to top Vulnerabilities
Time Line 
Vulnerabilities
are generally discovered first by the web hacker community, and can often be in
existence for several months before the general public becomes aware of them.
Once the media and general public have been alerted to the existence of these
vulnerabilities, the companies, which created the susceptible application, either
begin or intensify their efforts to create a patch or upgrade which will fix the
security flaw. Once the patch or upgrade is completed
and disseminated, the responsibility falls the individual security manager to
implement the latest upgrade and/or apply the latest patch. This entire process
can be extremely time consuming and consequently, can leave the application exposed
to attack for extremely long periods of time. Back
to top Customized Software
and Third party Vulnerabilities Many companies today
rely on customized and/or Third Party applications, which are developed to fit
their individual needs. The consequence of utilizing third party and customized
software solutions is that companies expose themselves on two fronts, the first,
include errors made by the software vendor and secondly, "holes" created
during the implementation or customization process. In
the majority of cases human error or a lack of highly specialized knowledge can
result in several different programming errors, which ultimately leave the applications,
open to attack. Even constant ongoing quality assurance and security analysis
may not prevent the application and ultimately the network from being attacked
by a malicious hacker. Back
to top Database Vulnerabilities
and Manipulation Companies generally acknowledge their
corporate database as the single most import element of the IT network or in some
cases the heart of the systems. Consequently, most companies concentrate substantial
resources to protecting and securing the database. However, with application level
threats emerging at such a rapid pace, databases are no longer as safe as they
were once perceived to be. Databases, are open to the
web applications that are using them, in most cases applications need to read
and write information to and from the database and consequently, are given permission
to interact with the database as they see fit. For example when you sign up for
a web based email account (i.e. hotmail) and you enter personal information (name,
address etc.) that information must be written to the database. Many
organizations attempt to solve security issues by carefully maintaining who is
given rights and privileges to access a certain database, while this approach
is of limited success on smaller and simpler systems it is practically impossible
with large scale complex systems. Large scales systems are generally faced with
numerous interfaces and maintenance applications all accessing the database, which
ultimately means that the creation of fail-safe system is practically impossible.
Within an advanced integrated and mobile Internet environment this is a significant
weakness. Back
to top Other common threats
include:
· Buffer overflow attacks
· Data encoding
· Protocol piggyback
· Context manipulation
·
Parameter tampering
· Cookie poisoning
· Stealth commanding
· Backdoor and debug options Back
to top Understanding the
Challenges
ProSoft Consulting Inc. offers a variety of products and
services designed to identify and protect against both known and unknown application
level threats and attacks.
Our approach is to ensure the individualized protection
of each application while tailoring a customized security policy, which will complement
your existing security infrastructure. ProSoft Consulting Inc's goal is to offer
complete, customized application level protection.
| 
You
are Here: Home: Services:
IT Security: Common Application Threats
