According to a survey conducted by CSI/FBI in 2006 the ubiquitous cyber crime and identity threats are increasing reducing the confidence of the online consumers across the globe. Gartner reveals that 3 out of 4 malicious attacks occur only on the application layer.
Information is indispensable for any institution. Hence,
many business organizations deploy websites to allow access to their prospective customers so that they grow gradually. IT infrastructure, therefore, has taken the centre stage is modern business process, globally. However, the security issues, hitherto, have remained a great cause concern. There is no doubt that most organizations are trying a strike an ideal balance between performance and security when it comes to deployment of web applications in their business process. Unfortunately, only a few of them have been able to safeguard their data and information from the external threat attacks.
According to a survey conducted by CSI/FBI in 2006 the ubiquitous cyber crime and identity threats are increasing reducing the confidence of the online consumers across the globe. Gartner reveals that 3 out of 4 malicious attacks occur only on the application layer.
HTTP
The rationale behind HTTP protocol is to facilitate fast and easy communication and inter-connection. It has been designed to share information without addressing on the security factors. The basic security principles in HTTP are confidentiality, availability, integrity, and auditability. Unfortunately, HTTP fares poorly on these aspects. Although it enhances the confidentiality aspects during transit, it fails to stop malicious SSL especially when the initial traffic is malicious. As a matter of fact, web protocols are not authenticate, can not fully guarantee confidentiality and integrity, and not protect against spoofing. Finally, the web protocols do not impose input validation which is the major cause for insecurity. For instance, an URL is a command line to your web server and it can generate and SQL command and activate a CGI script.
Factors Impending Secured Coding
Web protocols are not secured by default. It takes the web developers and programmers to write secured codes to prevent the security threats. However, it doesn’t look so simple; there are a few factors that actually impede the development of good coding principles such as:
Technical Factors
Since there are a number of scripts, languages, applications developed every day, it becomes complex in itself and requires profound knowledge and control over all these coding scripts.
Psychological & Human Factors
Humans, by and large, can only see errors that they are aware of. In fact, error checking is not an essential part of the programming job either. Security lapses occur often because of the hackers’ unpredictable behaviors was not considered during the software programming development.
Economic & Social Factors
Web programming is considered easier than assembler coding. For instance, writing a script or an HTML page does not call for extensive know-how or software engineering skills. Moreover, professional programmers are often evaluated how easily and quickly they can write software codes and not on their ability to develop secured codes. Even the software vendors lay more emphasis on launching a new product than launching secured software.
