Why Web Vulnerabilities Aren't Going Away Anytime Soon



As buzz mounts over the newly discovered and yet-to be disclosed high severity OpenSSL vulnerability, many may be wondering when the seemingly endless stream of web vulnerabilities will end. Unfortunately, that time likely won’t come soon.

Despite advances in web application security, websites and web applications remain highly vulnerable. The reason for the plethora of website vulnerabilities is largely due to web developers not going through the proper security configuration process when websites are created. This is because websites are normally created with speed in mind – not security – which results in common misconfigurations such as running outdated plug-ins or software.

In many cases, validation and vulnerability scanning don't occur during web development. Without proper vulnerability testing it becomes altogether too easy to miss common vulnerabilities such as SQL injection flaws or cross-site scripting, which can be identified and prevented with the right configurations and implementation.

Rather than sacrificing security for development deadlines or convenience, enterprises need to have their web-dev team committed to testing for vulnerabilities and going through the proper validation steps to identify any issues. From there, development teams must make a concerted effort to continue to check sites for possible vulnerabilities while regularly installing patches for servers or software as soon as they're issued.

There are still many companies and web developers that produce websites that are far less vulnerable than the norm. These are businesses that are committed to making security a top priority in their website development process while taking the time to ensure sites are properly maintained and configured.

A business’ ability to produce more secure websites depends on the company's resources and its processes for developing and maintaining websites, but there are a few best practices that companies should adopt for secure development. If you rely on third party developers to create your sites, you should ensure proper budget is allocated to a full testing and validation process. It’s also important to ensure that your IT team continually installs security updates as they're issued. If possible, invest in automated vulnerability scanners which can secure and maintain sites on an on-going basis.

Greg Funaro
Related Articles
Staying Secure While Staying Connected

With users reportedly spending an average of 162 minutes on their mobile device every day, the amount of personal information communicated can be a treasure to a hacker. Read on to learn how to use mobile devices and the web securely and privately.

Managing Cyber Risks in an Interconnected World

PwC Cyber Expert Looks at the Key Findings of the 2015 Global State of Information Security Survey

The Cost of a Data Breach? $88 Million

There’s a lot of debate about how much data breaches and hacks cost companies – except when there’s not, as with the hack of UK firm TalkTalk, which put the cost at around $88 million.

Greg Funaro

Greg Funaro is the Director of Corporate Communications at Digital Guardian.

Please post your comments here