While companies have focused on securing their network perimeters, Web applications remain vulnerable to attack. Cybercriminals are growing more and more adept at exploiting their interactive nature to bypass traditional perimeter security defenses. By moving up the network protocol stack and communicating at layer 7, attackers can interface directly with an application's processes, and pass data designed to masquerade as legitimate application requests or commands through normal request channels such as scripts, URLs and form data. This can easily lead intruders to a wealth of valuable data without them having to break into any servers.
Enterprises have a wide range of Web application attacks to worry about. Some of the more common ones include buffer overflows, SQL injection and denial of service (DoS) attacks, while a lesser-known type of threat is email injection. Intruders also use a technique called fingerprinting
to zero in on their targets. The tactics are different, but the results can be equally devastating--from theft of confidential data and complete system compromise to business disruption.
By waking up to these threats and implementing methods and strategies to deflect them, enterprises can protect their most precious assets.
