A person hacking into a Web page could, for example, edit Web site parameters within a URL field and adjust a price. The problem is that once a user is assumed to be authenticated and has reached this area of a Web site, there is little that can be done to prevent him or her from doing damage. If you want the customer log or the credit card data, you're going through the application. The Computer Security Institute, of San Francisco, surveys different types of hacks and their targets. Its latest figures report that 59 percent of corporate respondents cited their Internet connection as the frequent point of attack, while 38 percent cited their internal systems.
Some executives fear application hacks originate from employees themselves.
But once you have someone inside the network, it's tough to give them enough access to do their jobs but not be able to cause trouble. A lot of these sites think that because their sites were written in Java, which is a pretty secure language, they're safe. But firewalls and intrusion detection systems aren't the right solution for application security. There is hope for Web application developers and managers who want to plug the holes before they are exposed. The company's AppScan product audits a site, checking all pages, links and scripts against a knowledge base of known vulnerabilities.