Discussion on:

Rethink Web-site security management: Cybercriminals already have

Michael..

Great post!

As your web designer friend alluded to, this is a widespread problem that needs adressing. Its not just with the application providers, it is with the hosters, designers, developers, commercial and open source providers, etc.

The list is long and varied. Each party has a different feeling about responsibility levels of course, with most saying 'not my problem'.

The issue is primarily that with the conglomeration of tools (widgets, blogs, etc.) the attack surface gets larger, more widespread, and...open.

As part of our studies we've found gaping holes in the 'process'. When someone gets hacked, what happens? Where does the website owner to go? How to do they get fixed? more importantly, how to ensure it doesn't happen again?

We've asked these questions of 100's of website owners and the results were quite shocking. While we're not quite ready to post the results yet, we've found these tidbits:

1) 42% of infected sites, get re-infected again
2) 85% of the time, the web hosting provider didn't help, or provide assistance
3) 100% of the time, the website owner found out from their customers, or friends about the hack
4) 100% of the time, it took them at LEAST 4 days to get off of the malware lists. In some cases, it took over 6 weeks to be removed
5) 100% of the time, business operations were impacted, customer safety was at risk, and there was support issues

We'll be publishing the results shortly, with these and more questions proffered to the industry.

As a whole, its disappointing frankly. As an industry, we've let everyone down, and lax laws with international ISPs that can't do anything to shut down these operations, its really a free for all out there.

It always comes down to the website owner specifically to take charge of the situation, and invest in simple things like regular scanning for vulnerabilities and malware to ensure that THEY know, before hackers, before google, and namely, before their customers.

Jason Remillard
Managing Director & Founder
54F3.Com Security Solutions, Inc.

as usual, Michael!

For what it is worth, often I read posts to the Sunbelt Software blog (http://sunbeltblog.blogspot.com/ or use http://feeds.feedburner.com/SunbeltBlog for a Firefox Live Bookmark). Among other things, they report web sites from which malware is being installed on visitor's computers. Most are "malicious web sites" that have been set-up by the criminals, but some are not.

The number of compromised web sites that belong to businesses, governments and other organizations is increasing because the utility of a "malicious web site" that is created by the criminals has become relatively short-lived. Although they might keep a malicious web site online for an indefinite amount of time, they also register a new domain name and use it for a new site about once every 72 hours, according to a recent Sunbelt blog post.

So, although a malicious web site can be, and is, a worthwhile means for installing malware, obviously, using a well-known web site for the same purpose is, if they can compromise it, even better.

anonymous browsing is disabled on Yoaba

Nice Reading. Thanks.
LRQA helps bring integrity, independence and world-renowned recognition to your assurance claims.

Quality-ISO 9001 Training
Environmental-ISO 14001 Training
Information Security Management Training
Food & Beverage Industry Management Training
Occupational Health And Safety Management Training