An Introduction to the Murky Science of Web Application Security
Where white hats and black boxes help CISOs assess just how sieve-like their web-based systems are.
At another company—a financial institution—WhiteHat discovered an easily exploited vulnerability that would have let customers steal money. WhiteHat called up the company and the problem was hot-fixed within 24 hours. But a few months later, the vulnerability came back.
“The developers were working on the next release, set to come out in two to three months. Some developer did not back-port the hot-fix from the production server to the development server. So when the push occurred three months later, they pushed the vulnerability again.” Ugh!
I’ve never been a big fan of penetration testing, but the two hours that I spent talking with Grossman convinced me that it’s a necessary part of today’s e-commerce websites. Yes, it would be nice to eliminate these well-known bugs with better coding practices. But we live in the real world. It’s better to look for the bugs and fix them than to simply cross your fingers and hope that they aren’t there.
Simson Garfinkel, CISSP, is researching computer forensics and human cognition at Harvard University.
web security
Receive the latest security news as it breaks.
