Study finds it’s still the basics causing critical threats for businesses

In today's modern age, companies are inundated with cybersecurity threats every day – but which are the most critical?

New findings recently published by Context Information Security reveal that more than 60 percent of high and critical vulnerabilities in web applications are still accounted to cross site scripting, weak authentication and TLS (transport layer security).

The research was based on 14,000 vulnerabilities identified and qualified from around 1,300 manually guided penetration tests.

Around 1,700 of these (thirteen percent) were rated as high or critical impact and likely to result in unauthorised access or a compromise of user data or application functionality that could lead to financial or legal impact.

Assurance regional lead for Scotland at Context Information Security, Andrew Scott says it's time for businesses to wise up to these 'old' threats.

"These threats have been around for years, but it appears that the message is still not getting through," says Andrew Scott, Assurance Regional Lead - Scotland at Context Information Security.

"If an organisation were to focus on educating developers and their supply chain to prevent cross site scripting and authentication problems, while creating robust deployment processes for TLS, a large proportion of these problems could be avoided.

In addition to these findings, the study also delved into the ratio of critical or high findings to total findings for each category.

Context information Security uses the example of session management problems, of which more than 400 were identified but only 2 percent of these led to a direct route to compromise.

However, cross site scripting was found around 300 times but a whopping half of them were critical or high, which shows that interventions around addressing these areas at source can have a greater impact on the risk profile of an application or organisation.

What is concerning is the largest number of high or critical findings were around weak authentication – covering everything from password strength, storage and reset processes through to how cookies are created and handled.

Context Information Security also fund close to 1,000 issues related to the communication channel, suggesting that use of TLS and its additional security controls are still not well understood or applied.

"TLS issues often need addressing at the infrastructure layer and may not be under the control of developers," says Scott.

"Much like cross site scripting in the application space however, a very formulaic approach can be developed for each environment and can help address these problems.