95% of attacks target web servers and applications through SQL injection and other injection attacks, which were used to install malware over 60% of the time. Solutions include secure coding training, code reviews, log monitoring, and awareness of new attacks.

1. Web Application SecurityFirewalls will not be able to protect youAkashMahajan – Chapter Lead for null Bangalore

2. What should keep you up at night95% of attacks are against “Web Servers and Web Applications” aka WebsitesThe top 3 verticals compromised were Financial Services, Hospitality and Retail. More than 60% of attacks were caused by external agents.Primary attack vector was SQL Injection and was used to install customized malware.Injection Attacks are #1 critical flaw in applicationsSources Verizon DBIR 2010, Whitehat Sec Statistics, OWASP Top 10 2010

3. Web App AttacksSQL Injection AttacksNumber plate to foil an automatic license plate scanner!An attack which allows SQL to be executed as part of the input.

4. Web App AttacksBobby Tables!

5. Web App AttacksXSS was used to get root on a apache.org server in April 2010A popular shopping website used to sell only books and now sell other stuff as well.That inner window is an iframe injected in a simple search request. Picture courtesy null Keeda Vulnerability Database

6. Other Critical Flaws/AttacksCross Site Request ForgeryAttacks the user of the applicationClickjackingFacebook Like attackSecurityMis-configurationsDefault passwords in DSL routersInsecure Cryptographic StorageApache AttackTiny URLsEmployees trust and click on anything!

7. Solutions/MitigationsTraining inSecure Coding for DevelopersCode Reviews by competent security folksRegular mining of web server logsApplication Security PracticeAwareness about new attacksSetup a red team in the company

8. About nullNull – Indian Open Security Community null.co.inRegistered non-profit society5 active chapters in IndiaWe conduct monthly meetings, regular awareness camps and trainings.More than 1000+ security professionals and enthusiasts in the group.Null Keeda Vulnerability Database http://keeda.nullcon.net

9. AkashMahajanChapter Lead of null BangaloreWeb Security ConsultantI hack, test, secure web apps and serversHelp companies become secure on AWS cloudWebsite: akashm.comEmail: akashmahajan@gmail.com / aka@null.co.inTwitter: @makashLinkedin: www.linkedin.com/in/akashm