The most popular and comprehensive Open Source ECM platform
Let us know more
Security: Insecure Web Applications Plague Companies
A new study finds that a large number of web applications are not secure and companies that use those applications either aren’t aware of the problem or falsely believe they are protected. The study comes from the Ponemon Institute and was sponsored by security vendor companies Barracuda Networks and Cenzic.
Grant Murphy, vice president at Barracuda Networks, said that “There is a real disconnect between the desire and the actual implementation of security counter measures that are appropriate for Web application security.” Mandeep Khera, chief marketing officer at Cenzic, said that at many companies the budget for coffee is bigger than the budget for web application security.
The most common types of web insecurities include:
- SQL injection
- cross-site scripting
- input validation flaws
- code injection errors
The Ponemon Institute found the 41 percent of the organizations surveyed had more than 100 different web application. The following reasons were cited as to why it is important to secure web applications:
- 62 percent – Data protection
- 51 percent – Compliance
- 15 percent – Job Security
The report found that even though 51 percent said that compliance is important to them, 43 percent were not at all familiar with OWASP, the Open Web Application Security project. OWASP is a key element of the PCI standard.
- 66 percent of respondents do testing for vulnerabilities with less than 25 percent of their web applications.
40 percent test only 5 percent of their applications and 20 percent of organizations do no testing - 53 percent expect their web hosting provider to manage the security of their web applications
- 47 percent estimate that an attack on their servers could cause damages ranging from $100,000 to $500,000
- 73 percent of organizations have applications that have been hacked into at least once during the past two years
Larry Ponemon, founder of the Ponemon Institute, said that “while IT practitioners recognize the criticality of secure Web applications, their organizations do not provide adequate resources and expertise to manage the risk. Over half of the respondents we polled believe they do not have resources to detect and remediate insecure Web applications, and 64 percent said they believe that their organization have inadequate governance and usage policies.”
