May 12th, 2007 Drazen Drazic
A poorly developed web application can potentially open up an organisation to business-threatening problems. Exaggeration……no way? I know, because we see it everyday.
A friend, CEO of a good sized company (offices in Australia, Asia and London) recently decided to make a serious move into eCommerce B2B and B2C.
Security-Assessment.com did not need to be involved with the project because the third-party developer was reputable and had good reference sites I was told at a BBQ by CEO over a few beers. (CEO’s not an IT guy – he’s a successful businessman). After sharing a few generic war stories with him (incriminating no one as per our policy), I suggested I get a couple of the boys to have a look at the new site anyway - given the potential new exposures he’s opened his business up to now…..which he previously did not have to concern himself with.
In a nutshell, his business went from being a strong and secure bricks and mortar organisation to one that now bled customer and competitive information to anyone who wanted to see it on the Internet! How’s open access to back-end customer database and real-time access to orders as they came in hit you?……amongst many other things! In addition, some other nice touches included; the complete site code zipped up for anyone to download and also, get this, developer had a beautiful photo of his wife and new baby in a bath tub on the site for the world to find.
Anyway, we deliver the report with recommendations and CEO and his GM strip out the major issues to confront the developer directly. Now here’s where it gets good and keep in mind, CEO and GM are not IT guys..so the developer thinks he’s going to put it over them. Here’s the main gist of the developer’s response:
- “No, we don’t follow OWASP. The standards that we follow are W3C web standards for front end/interfaces”.
- “In regards of the back end coding, this depends on the environment and we implement the best practice. However, since the website has payment gateway, it uses SSL Certificate (128 bit encryption) to make sure no personal Credit Cards details are exposed to the net”.
- “Just so you are aware that for any big corporate website eg. [DD: Aussie Bank name removed] website we do follow security standard which is ‘Application Security Guidelines’ from [DD: company name and website link removed.. but it was a small IT security consulting business / SA competitor], basically this is a security bank standards. In order to for us to implement this standard, we need to be notified in advance if this is necessary since implementing this incur additional charges which is not small”.
Can you believe this? Lets look at this more:
(1) The first statement said nothing more than they develop websites. For a laugh, we ran a W3C validation report and guess what, they failed. Not a big deal as such but if you state this, at least be able to back it up.
(2) Well duh! But we’ll get that information (and more) from other places……as we did. 
(3) So, just because CEO’s company was not a “big corporate”, what, he doesn’t warrant getting a secure site built?! AND, if he wants a secure site, this will cost extra! WTF? What year are we in?? In addition, developer discusses some standard we could not find on the site he noted. In addition, we’d never heard of it and were unaware of this unheard of standard being the “security bank standard”. On contacting our competitor (who was quoted) to confirm, they stressed that in their work, they refer to OWASP to their clients and didn’t really know why their name was used or what this guy was talking about!
Sadly, we see this all the time. It is good though to see organisations are getting more aware of web application risks and are doing something about it, but it’s a long way from us being able to say this is not something we see everyday.
A few tips for anyone developing a new website and web applications – whether being done in-house or getting third-parties in:
- Aside from ensuring all the functional requirements are there, ask about how the application is going to be secured.
- Ask whether security is a strong focus in the SDLC.
- Ask how security is tested.
- Ask whether OWASP guidelines are followed. (If they’ve never heard of OWASP, I suggest you run!).
- Get a reputable security company to test the application’s security prior to release.
The risks of not doing this are potentially business threatening.
Posted in Bad Developers, Dumb Security, Web Application Security | 2 Comments »
