Can you comment on the security issues related to the WebKit framework? It was exploited in a variety of attacks or proof-of-concept demonstrations in the past year, but to what extent is it a concern for enterprises in regard to Web browser attacks?
WebKit is an open source Web browser layout engine designed to enable Web browsers to render webpages, follow links, manage a back-forward list and a history of recently visited pages. WebKit is used in Google Chrome and Apple Safari, which together have more than 20% of the browser market. It is also used in the Silk browser included with Amazon’s new Kindle Fire tablet, as well as the browsers in the iOS, BlackBerry, Symbian and Android mobile operating systems. Applications on a variety of platforms use it to render email messages that include HTML such as Apple's email client Mail on the Mac and Microsoft's Entourage personal information manager.
Ubuntu recently fixed 22 vulnerabilities in the WebKit framework that's part of its operating system, while Apple has implemented new sandboxing techniques in the WebKit framework. (Sandboxing is a method of isolating a process and the resources it has access to in order to prevent any malicious or faulty code in it from interfering with other running processes and system resources.)
All browsers suffer from security vulnerabilities, and due to their complexity, this is unlikely to change anytime soon. The only difference with the security issues in WebKit is many users will be unaware they are even using a WebKit-based browser. WebKit is used in many mobile devices but this is not immediately apparent unless you do the research to fully understand how different devices provide the services they offer. Anyone responsible for running an enterprise IT infrastructure needs to be aware of which sub-components the devices they operate are running.
With any software that comes preinstalled on devices your enterprise manages, or that you subsequently install, it is imperative that you subscribe to the security alerts and updates provided by both the software and device vendors, as well as any related security forums to ensure you keep up to date with the latest vulnerabilities and patches. You can then take informed decisions and actions to keep your enterprise secure.
Dig Deeper on Web browser security
Related Q&A from Michael Cobb
Pirated software is still a major concern nowadays. Uncover how to prevent software piracy and protect your organization's intellectual property. Continue Reading
Shellcode is a set of instructions that executes a command in software to take control of or exploit a compromised machine. Read up on the malware ... Continue Reading
The popular port scan is a hacking tool that enables attackers to gather information about how corporate networks operate. Learn how to detect and ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.