Malware threats are on the rise, while phishing scams remain persistent — and effective — ways for cybercriminals to hack corporate systems. But the biggest risk to your organization? Applications.
Consider that more than 111 billion lines of new software code will be written this year, much of it used by Web-facing mobile and desktop apps. The result? A rapidly increasing attack surface that regularly produces new vulnerabilities. Add threats from existing, open-source code — a recent flaw in the Apache Struts 2 framework put companies around the world at risk of Java injection attacks — and it’s no wonder that 42 percent of mature DevOps organizations now perform app security analysis at every stage of the software cycle.
What does this mean for your company? With Web- and cloud-based apps quickly becoming the foundation of IT, it’s worth understanding the top applications security threats and learning how to counter them.
Test Case
While threats from outside actors make for sensational news stores and often top the list of corporate worry, app risks actually start closer to home. Why? Because many companies hold back when it comes to testing. Instead of giving dev teams time to fully break, fix and break apps again, software is rushed into production, putting it at risk of compromise. Bottom line? Hackers attack whatever, wherever, whenever. Timid testing isn’t enough.
Down and Out
Your apps are also at risk of DDoS and SQL injection attacks. When it comes to SQL, the problem stems from permissible commands: While the “SELECT” query is commonly used to make password and username database requests, many companies forget to block access to other SQL commands. The result? Sixty percent of Web apps are vulnerable. Lock down code and restrict permissions to reduce your risk.
DDoS, meanwhile, often feels like an attack that can’t be stopped, especially since attackers can now leverage IoT devices to deliver terabytes of traffic and quickly debilitate apps. It’s not hopeless, however — new tools can detect sudden access request spikes, shut down IP addresses and notify admins ASAP.
Scripts, Stocks and Sessions
Also on the top app threats radar are cross-site scripting (XSS) worries, stock API permissions and session hijacking. To cut off XSS, limit the type of Web scripts that can be loaded by specific apps. To combat stock APIs, use extra encryption and build in code delays to reduce the efficacy of automated hacking tools. Limiting session hijacking, meanwhile, demands the use of random session IDs that are always encrypted.
Last but not least are zero-day attacks. Limit your risk by leveraging more in-house code, building in extra security and, if necessary, pulling the app to fix critical issues.
App threats are on the rise. Reduce your risk by learning more about the top threats to your Web- and cloud-based applications, and taking steps to safeguard critical data.
———————————–
Author bio: Nori De Jesus is Global Director of Marketing at Column Information Security. De Jesus brings more than 20 years of experience as an advent marketer and business strategist working with software manufacturers and launching proprietary software solutions into the market. With expertise in BPM and case management B2B marketing, she focuses on innovation and making a difference by maintaining agility as the technology climate continues to shift. De Jesus is an evangelist in educating buyers through their technology-purchasing journey via content and research.
