Vaadata’s Blog - Website and mobile app security

Risks June 23, 2014

What are the risks if my website gets hacked?

Web attack types

Web attacks can be divided into two basic categories

Those related to technical flaws (control weaknesses, lack of rigor in the developments, cryptographic weaknesses…)
Those related to logical flaws (weaknesses in the business logic of the web application)

There are many types of flaws and different attacks to exploit them. Attacks can also be combined.
The direct consequences of an attack generally fall into the following broad categories:

Illegal access to certain data (theft)
Loss or modification of data
Ilegal access to some functions of the web application
Execution of some actions on the website on behalf of other users
Malware installation
Web Server takeover (and more)

With some more efforts, attackers can perform some pivots and in the end gain control over the company’s internal servers, even if the website is not hosted on the internal network of the company.
The vast majority of these attacks can either be invisible or be quickly spotted, stay active or be stealthy.

The impact for the company

A web application attack can impact both the company and the website users (clients, consumers, employees).

Understanding web vulnerabilities in 5 min – Episode #6 – Sensitive Data Exposure

Still in our series of articles about web vulnerabilities, this 6th episode is about Sensitive Data Exposure.
As usual, we won’t dive into the highly technical details here (this would require several pages) and won’t therefore discuss cryptography.
This type of vulnerability is ranked number 6 on the OWASP Top 10 2013. These vulnerabilities are usually quite difficult to exploit by hackers, but the impact being really severe, it is very important to properly understand them and make appropriate choices in the application architecture.

10 ways to make your web application more secure

We assume here that your hosting environment is already secure, whether managed by yourself or by a hosting provider.
Let’s focus on the applications. What steps can you take to improve the security of a web application? How to reduce the attack surface and remove easily detectable risks? This article does not pretend to be the manual of the perfect web application defender, but recalls basic principles and presents a list of items to be considered and applied on a regular basis.