Network Application Security Test

Like other business analyses, the Security Test of network applications has three possible results: your test results, your vulnerability assessment, and the truth.

No matter whether you use a commercial or free scanner, you can collect a lot of information to discover vulnerabilities in these network applications. The problem is that many of these vulnerabilities are not very serious. Regardless of the marketing solution or precanned security policy and report, when you need to clear the true threat vulnerabilities from the test results, you should all from the company's network, consider the business needs and the potential risks.

Network security application testing tools are extremely intelligent. It takes several hours, months, or more to discover the best hackers in the world within minutes. When you get the test results, you need to decide what is crucial. Some inexperienced network application security consultants, security management service providers, and auditors who directly deliver the results to customers after conducting vulnerability assessment and scanning, and claimed that the customer's system had a lot of vulnerabilities to fix. Similarly, some network administrators are shocked to see a lot of vulnerabilities found by the test tool. They will think the problem is very serious and immediately rush to apply for more budgets to purchase more technologies to solve the problem.

Even if you want people to pay attention to your test results, you do not need to express them in this way, especially when you are a manager or developer. You have to take a step back and analyze the evaluation results from a global perspective based on the company's actual situation. That is to say, you have to change the angle (for example, from the inside of the firewall rather than from the outside) to view online (or through vulnerability connection) or manual attacks.

Unless your test tool does attack a vulnerability and presents the result to you, you must thoroughly study the vulnerability assessment results and determine what actually constitutes a threat.

The following are examples of network application security vulnerabilities. You can call these situations false positive, inaccurate, hypothetical, or otherwise-in the final analysis, they all seem very serious on the surface, but they do not actually constitute a threat.

Vulnerability assessment: 1. the SQL injection vulnerability is found, which may allow hackers to access the database.

Result: After an appropriate user input is verified, no data is stolen.

Vulnerability assessment 2: because ssl (secure connection) is not performed on the login page, the session id and login information are sent in text form, which may be intercepted by hackers.

Result: The network management still does not use a digital signature on the server.

Vulnerability assessment 3: hackers may exploit the cache overflow vulnerability of network server software to remotely Run command lines on the server.

Result: After a reliable firewall and intrusion detection system are used, the server can be enabled for all transmission without worrying about any threats.

Vulnerability assessment 4: Microsoft frontpage virtual directory, ftp directory, and so on.

Result: The actual access can be blocked by setting appropriate directory permissions.

Vulnerability assessment 5: A backup file with the. old extension is found, which may cause source code leakage and attacks.

Result: these are the previous executable files. The documents also contain the home page, which has nothing to do with security threats.

Vulnerability assessment 6: An expired apache network server is installed, which may result in a series of vulnerabilities and unauthorized access to the system.

Result: apache cannot be found in the system.

Vulnerability Assessment 7: files, links, and email addresses found in google's hackers' database (ghdb) can leak sensitive information.

Result: These file files, links, and email addresses are required by network applications for operations.

Vulnerability assessment found 8: people can execute arbitrary SQL queries by accessing the macromedia dreamweaver remote database script.

Result: only when a user logs in as a manager or network administrator can the user access these files.

Some vulnerabilities seem benign, but people may make a big mistake without considering the background. For example, the security of the same vulnerability in a relatively secure network application is totally different from that in a network application that is not properly monitored. The latter may cause unnecessary conflicts, this results in a waste of time, energy, and money.

When you consider testing and improving the security of network applications, you should focus on the most urgent and important issues. You need to find the vulnerabilities that attackers can exploit in typical business scenarios of your company. What problems do you need to solve before next week? Which problems can be solved after one month or longer? Which problems do not need to be solved at all? You need to consider these issues based on your company's actual situation. It's not to say that we want you to ignore other problems. We just think that you have to grasp the main contradiction, rather than targeting vulnerabilities that may never be exploited by hackers or have no value for attacks.

No matter how secure your network applications are, some people may find ways to attack these applications. Therefore, you have to use a lot of security control measures, such as firewall, ips, input verification, strict authentication requirements, minimum access control, solid network servers, operating systems, and system monitoring. In this way, even if a certain type of Defense fails, you still have half a dozen other protection measures to deal with it.

Thoroughly analyze the vulnerability assessment, instead of accepting all the results without thinking, so that your network application security test will enter a higher level. Let the management know that you can not only balance the relationship between application security and reality from a business perspective, but also reduce the workload of yourself, your team, and developers, therefore, everyone can focus on the truly important aspects.