Security Management Strategies for the CIOWeb application attacks, such as cross-site scripting (XSS), are constantly top-of-mind for enterprise security professionals, and for good reason: They can do a great deal of damage. Cross-site scripting
Requires Free Membership to View
exploits can severely damage an
organization by hijacking a user’s browser session, taking control of a user’s account or
installing malware to steal sensitive information. Security pros need to be aware of this
threat, as well as develop security controls to detect XSS
exploits and prevent XSS
attacks.
This mini learning guide, brought to you by SearchSecurity.com, can be used as a preventative XSS cheat sheet, highlighting the threats and risks of cross-site scripting, and offering advice on enterprise XSS protection and prevention, as well as detection methods for identifying cross-site scripting exploits.
TippingPoint
Zero-Day Initiative fixes record number of vulnerabilities
Web application vulnerabilities have been, and will continue to be, the attack method of
choice for hackers and cybercriminals. And, according to HP-TippingPoint’s Zero-Day Initiative
(ZDI),Web application vulnerabilities are on the rise, making cross-site scripting (XSS) prevention
and detection just as important now as it was years ago.
How
to prevent cross-site scripting
Cross-site scripting, a common Web application attack technique, presents significant risks
to an organization considering an XSS attack is capable using malicious coding to steal a user’s
information and cookies and conduct transactions.
In this Q&A, information security threats expert Ed Skoudis explains how cross-site scripting attacks are conducted and what Web security experts and Web developers can do to protect their websites and applications against them.
Cross-site
tracing vs. Cross-site scripting
Cross-site tracing
(XST), similar to cross-site scripting, can do significant damage to Web applications, making
it imperative for security pros to understand the dangers that XST attacks can introduce, and how
they are different from cross-site scripting attacks.
In this SearchSecurity.com expert response, Ed Skoudis discusses the differences between the two attack methods, reveals how each attack is carried out, and offers advice on how to keep applications safe from both XST and XSS attacks.
What
are the risks of social networking sites?
Social networking sites can be useful in maintaining friendships and making connections in
both a personal and professional environment. However, these sites can be a security professional’s
worst nightmare. Sites like Twitter, MySpace and YouTube can be a haven for cybercriminals, giving
them a means to post and spread malware, as well as execute other malicious attacks.
In this Q&A, Ed Skoudis reveals how several attack methods, such as cross-site scripting, can be executed and spread via popular social networking mediums and how enterprises can successfully thwart these threats.
Web application attacks security guide: Preventing attacks and flaws
From cross-site scripting to SQL injection, hackers have many techniques at their disposal to attack Web applications, and new methods constantly emerge. Web applications attacks can cost organizations time and money and lead to expensive and embarrassing data security breaches, making thorough defense strategies and mechanisms imperative for every organization.
This learning guide will reveal more about Web application attacks and security, how to identity different types of attacks, including cross-site scripting, and offer advice on how to prevent and implement Web application defense strategies.
Cross-site
scripting vulnerability penetration testing
Cross-site scripting attacks usually come in the form of embedded JavaScript. However, any
embedded active content is a potential source of danger, including ActiveX, VBscript and Flash.
That’s why testing of Web applications is an essential best practice in XSS prevention.
In this expert response, Russell Dean Vines discusses how to test a Web application for cross-site scripting vulnerabilities, how to perform penetration testing for XSS and what type of code would exhibit XSS threats.
Cross-site
scripting explained: How to prevent XSS attacks
In this comprehensive tip, brought to you by SearchSecurity.co.UK, expert Michael Cobb
offers advice on everything you need to know about detecting and preventing the Web application
attack that refuses to go away: cross-site scripting.
Here, security professionals can learn how to prevent XSS attacks and protect applications that are vulnerable to cross-site scripting by using a security development lifecycle, client-side validation, automatic source code scanning tools, cross boundaries policies and security encoding libraries.
This was first published in April 2011
Join the conversationComment
Share
Comments
Results
Contribute to the conversation