[ insider_reports_insider ]
Old Mistakes Cause New Security Problems
David Utter
Staff Writer
2008-04-14
 Insider Reports RSS Feed
The more things change, the more developers keep making the same mistakes, leading to exploits and other problems for visitors.
 | | Old Mistakes Cause New Security Problems |  |
Online security suffers from the continued race by criminals to gain at other's expense. Staying ahead of the bad guys became a cottage industry, one that continues to escalate today because of the mistakes of yesterday.
The BBC cited security vendor Symantec about the continuing problem of web application security. In some cases, coding issues existing for a decade persist to today.
Cross-site scripting problems crop up often enough to merit media attention. As noted in the report, it isn't enough to stay away from obviously dodgy sites catering to porn or gambling audiences.
Failing to control login data at one site allows a malicious site to make a play for it. Successful cross-site scripting attacks on an otherwise non-sensitive website could yield a login that works on more lucrative targets, like a person's bank account online.
We have seen other technology companies try to address the problem by providing secure services for logging into critical financial or banking sites. Authentium offers its SafeCentral hybrid of desktop client and online portal to lock out security threats, while TrustDefender cites cross-site scripting protection as one of its many features.
The era of single factor authentication as an effectively secure means of online access died years ago. Not nearly enough financial institutions have implemented a second factor of security in recent years, though E-Trade did after a phishing scheme cost it $18 million.
We have to wonder how many times incidents like E-Trade's or TD Ameritrade's multi-million dollar losses due to stolen single factor accounts have to happen for other financial firms to move away from that archaic model. One more time is too much.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
