Do you know your website is secure?

Recently, Hong Kong had multiple websites were successive successful intruded by hackers. Besides of upload the stolen information on the Internet, they also listed in detail throughout the intrusion process. From these incidents, we found that the hacker's attack technique was very systematic and skillful. They can identified the vulnerabilities of website and conducted an intrusion in a short period of time. These intrusion incidents aroused the public attention on the shortfall of website security.

Web Application Security

Although many companies deployed firewall and anti-malware software to protect computers within their network, it is not enough to secure their website. You have to pay attention to maintaining the software version and security patch level of the operating system and web applications. If the web application is in-house developed, you also have to conduct an application security test.

For web application security, there is an authoritative global security organization, OWASP (The Open Source Web Application Security Project) which focused on improving web application security research. They announced “The Ten Most Critical Web Application Security Risks 2013 (OWASP Top 10 - 2013)” report on Jun 2013.

The Ten Most Critical Web Application Security Risks 2013:

• A1 Injection
• A2 Broken Authentication and Session Management
• A3 Cross-Site Scripting (XSS)
• A4 Insecure Direct Object References
• A5 Security Misconfiguration
• A6 Sensitive Data Exposure
• A7 Missing Function Level Access Control
• A8 Cross-Site Request Forgery(CSRF)
• A9 UsingComponents with Known Vulnerabilities
• A10 Unvalidated Redirects and Forwards

The ranking no.1 is injection attack, an attacker exploits the input validation vulnerability and could execute unauthorized commands or queries. The common attack vector is SQL injection which allows to read or modify the database contents of website.

Assess Web Application Security

Due to the lack of resources, the general individual or SME websites do not have dedicated staff to maintain the security update of websites properly, and become prey of hacker. In view of this, we introduce the following free tools to help you to conduct an initial assessment of your website security level.

Note: All security scan must obtain an authorization from the site owner in advance.