Blog

Online payment skimming operations run by Magecart criminals continue to intensify and develop, reportedly compromising more than 2 million websites with the most infamous attack involving the breach of British Airways in 2018. Where credit card data of nearly 400,000 BA customers were compromised and resulted in a hefty fine of $230million and the moment the world stood up to take note of this new and dominant threat.

Increasingly, boardrooms are starting to recognize a simple fact: Being hacked is a question of if, not when. It’s no secret that most companies have experienced some type of data breach, often without their own knowledge. This all adds up to estimates that a cyber-attack occurs every 39 seconds, if you believe such statistics. That puts huge pressure on organizations to decrease the likelihood of not only adding to this statistic, but also fulfilling their data privacy duty they have towards their users, employees and customers.

Looking back over the years and what we see happening now is the same attack vectors being used that have led to breaches. Web applications and the human element of security remain the cornerstones when it comes to protecting your organization against any weak spots. Your organization’s ever-expanding digital footprint and supply chains are also factors adding to this risk, which cyber criminals are aware of and willing to exploit.

Davey Winder, our guest blogger and an award-winning security journalist, explains the role of Shifting Left for Secure Application Development

Local File Inclusion - aka LFI - is one of the most common Web Application vulnerabilities. If conducted successfully, It might allow attackers to read sensitive information, access configuration files or even execute system commands remotely.

Today, companies are the primary target for hackers because of the sensitive data they hold. Cloud and Big Data technologies are fantastic tools to analyze and manage a large amount of data, but they are often not as secure as they should be. So while companies are benefiting from the availability of such applications to improve their productivity, IT security teams are hit with a wealth of security issues - they've never experienced such lousy visibility for key assets and data, it is hence more important than ever to strengthen the need for web applications testing.

With digital transformation, a lot of companies invest and add layers of technology to their business using DevOps, Cloud and web applications for example. And with the DevOps approach always pushing to improve apps, security remain one of the companies' biggest challenge.  

Application security is evolving but it has yet to catch up with the abundance of risks that web applications now present. Threats to web apps are becoming an even greater challenge for DevOps on a near daily basis and many businesses are still using risk management plans that simply do not cut it.

Web application vulnerabilities are some of the most common flaws leading to modern data breaches. SQL injection (SQLi) and Local File Inclusion (LFI) attacks represented for 85% of Web Application attacks, XSS counted for only 9%.

Local File Inclusion - aka LFI - is one of the most common Web Application vulnerabilities. If conducted successfully, It might allow attackers to read sensitive information, access configuration files or even execute system commands remotely.