Cenzic

Cenzic Trend Report Reveals Recent Surge in Hacker Attacks on Web Sites as Obama Administration Prepares to Spend Millions on Cyber Security

Santa Clara, Calif. – March 18, 2009 – Cenzic Inc., the leading provider of application security vulnerability assessment and risk management solutions, today released its report revealing the most prominent types of Web application vulnerabilities for the second half of 2008. The report, which comes in the wake of highly publicized Web attacks, including Heartland, Twitter, and Facebook, as well as $355M in funding from President Obama’s stimulus package to bolster cyber security, details the newest methods that hackers are using to exploit Web technologies on a massive scale.

The recent Web attacks on prominent organizations have affected millions and drawn worldwide media attention, shedding light on how easily even sites that are believed to be secure, can be compromised. For example, earlier this month a file containing the blueprints and avionics package for Marine One was found on a computer in Iran. It appears that the files were compromised when a government contractor used an infected peer-to-peer file sharing program. In so many of these attacks common vulnerabilities including SQL injection, cross-site scripting and denial of service are easily exploited.

Findings from Cenzic’s Q3-Q4 Trends Report point out the continued growth of vulnerabilities and growth of attacks through Web applications. Most notably, the total number of reported vulnerabilities went up to 2,835, an increase of more than 10 percent from the first half, of which the percentage of vulnerabilities relating to Web applications hit a staggering 80 percent.

“As Congress and the National Security and Homeland Security Council’s acting director, Melissa Hathaway, go through a cybersecurity review, they must explore findings such as these, pointing out staggering vulnerabilities in all corners of the Web—including social networks, financial websites, and even official government websites,” said Mandeep Khera, chief marketing officer at Cenzic. “Web application vulnerabilities are gold mines for hackers as they can lead to the exposure of sensitive or confidential user information during a cyber attack. Perceived leniency from regulatory compliance bodies, coupled with lack of awareness about tools to prevent it, have allowed Web application vulnerabilities to become a blind spot for many organizations. With more than 75 percent of attacks occurring through the Web sites, and over 80 percent of Web sites still severely vulnerable, we, as a nation, have to question our cybersecurity priorities.”

Cenzic Application Security Trends Report Q3-Q4 2008

The Cenzic Application Security Trends Report emphasizes the Top 10 Web application vulnerabilities from published reports in Q3-Q4 2008, illustrating trends among thousands of corporations, financial institutions and government agencies. The top 10 vulnerabilities for the second half of 2008 included the familiar names such as Adobe, Microsoft, Mozilla, Apache, and Oracle, where most Web applications were found to have vulnerabilities related to information leaks and exposures, Cross-Site Scripting, and session management.

As part of the study, Cenzic incorporated findings from Cenzic ClickToSecure, its leading-edge managed security assessment and penetration testing service (SaaS), and research from Cenzic Intelligent Analysis (CIA) Labs. Some key findings include:

• Of Web browser vulnerabilities, Internet Explorer had the highest percentage at 43 percent followed closely by Firefox at 39 percent. As in previous reports, Safari and Opera continue to report fewer vulnerabilities at 10 and 8 percent respectively.
• Eighty percent of the total reported vulnerabilities affected Web technologies, such as Web servers, applications, Plugins and ActiveX, and Web browsers, which is a significant increase from earlier in the year.
• Adobe continued to be plagued by vulnerabilities some of which showed up in our Top 10 list. Others on this list included SAP, Microsoft, Mozilla, Sun, Apache, and Oracle.

To download a PDF version of the Q3-Q4 Trend Report, please visit http://www.cenzic.com/downloads/Cenzic_AppSecTrends_Q3-Q4-2008.pdf. In addition, for a fast and easy way to prioritize and remediate your vulnerabilities before hackers exploit them, sign up for an assessment of your Web applications from Cenzic. To learn more about Web application security issues, watch this Gartner video at http://www.cenzic.com/landing/GartnerVideo/.

About Cenzic
Cenzic is the next-generation Web application security assessment and risk management solutions leader. The Cenzic suite of application security solutions fits the need of any company from remote, Software as a Service (ClickToSecure®), for testing one or many applications, to a full enterprise-wide solution (Cenzic Hailstorm® Enterprise ARC) for effectively managing application security risks across an enterprise. Always an innovator, Cenzic has integrated Hailstorm with VMware to enable testing of production Web applications through virtualization -- making Cenzic the only company in the industry with a complete solution for assessing Web applications in all stages from development to production. In addition, Cenzic solutions, targeted at financial services, e-retail, high-tech, energy, healthcare and government sectors, are the most accurate, comprehensive and extensible in the industry, empowering organizations to stay on top of unrelenting application security threats.