Report: Online Social Networks, Education Sites Harbor Most Security Risk

  • Nov 18, 2009

WhiteHat Security, a leading provider of Web site risk management solutions, recently released the eighth installment of the WhiteHat Security Web site Security Statistics Report, a high-level perspective on major Web site security issues that continue to compromise corporate data across all industries. WhiteHat's report, assembled from real-world Web site security data, cites the Top 10 Web site vulnerabilities and provides insight into the evolving challenges facing organizations today.

WhiteHat's Statistics Report provides an opportunity for businesses to understand the most prevalent vulnerabilities so they can develop and implement an effective Web site risk management program, reduce exposure and improve their overall security posture. WhiteHat created the report to educate the business community and general public about the most prevalent vulnerabilities that can lead to Web site compromises.

Unsurprisingly, only 36 percent of Web sites in the report currently do not have any serious vulnerabilities. From a historical perspective, this percentage drops to 17. Through its research, WhiteHat found that the characteristics of Web sites currently without any serious issues were nearly identical to those with them, with the exception that they had about half as many from the start.

This proves to be significant in that no Web site can be deemed immune -- all Web sites have an opportunity to be compromised. These odds are reduced when the business decides to proactively identify and remediate their vulnerabilities.

"It is extremely interesting to see that all the Web sites that are no longer vulnerable are so similar characteristically in technology and site format to those that have vulnerabilities," said Jeremiah Grossman, founder and chief technology officer for WhiteHat Security. "The big difference right now seems to be that these organizations set an internal mandate to actively fix their flaws and reduce the potential for damage to their Web site, reputation and customers."

Recent attacks on thousands of Web properties including Twitter, Facebook and MySpace also validate WhiteHat's findings that these platforms have what hackers are eager to steal -- user supplied data. With 86 percent of these sites hosting urgent, critical or high severity vulnerabilities, social networks lead all verticals. A close second, education Web sites are also highly vulnerable, with 83 percent having at least one serious vulnerability. This is not surprising, as educational institutions have many public-facing applications and often do not have significant resources dedicated to Web site security.

WhiteHat's latest report contains data collected between January 1, 2006 and October 1, 2009, and finds that the percentage of high, critical or urgent issues continue to slowly increase. WhiteHat also finds that 83 percent of Web sites have had a high, critical or urgent issue over their lifetime and 64 percent of Web sites currently have a high, critical or urgent issue. Of the 22,000 vulnerabilities identified, almost 9,000 remain open, which means encouragingly that the majority – more than 13,000 -- have been closed.

As in previous reports, Cross-Site Scripting and SQL Injection continue to be fixtures in the Top 10 list along with many other common classes of attack. The report also shows that fix percentages are climbing for some and decreasing for others. In particular, more organizations are repairing technical issues such as SQL Injection and Cross-Site Scripting in larger volumes, an indication that awareness is building regarding the prevalence of easy exploitations of these specific vulnerabilities.

The report statistics were gathered through the deployment of WhiteHat Sentinel, a Software-as-a-Service (SaaS) based Web site risk management solution, providing the most accurate vulnerability information in the industry. WhiteHat Sentinel executes rigorous and ongoing Web site security assessments on more than 1,500 Web sites that helps companies protect their brands, comply with PCI Compliance and avoid costly and damaging breaches.

Featured

  • Security Industry Association Announces the 2026 Security Megatrends

    The Security Industry Association (SIA) has identified and forecasted the 2026 Security Megatrends, which form the basis of SIA’s signature annual Security Megatrends report defining the top 10 factors influencing both near- and long-term change in the global security industry. Read Now

  • The Future of Access Control: Cloud-Based Solutions for Safer Workplaces

    Access controls have revolutionized the way we protect our people, assets and operations. Gone are the days of cumbersome keychains and the security liabilities they introduced, but it’s a mistake to think that their evolution has reached its peak. Read Now

  • A Look at AI

    Large language models (LLMs) have taken the world by storm. Within months of OpenAI launching its AI chatbot, ChatGPT, it amassed more than 100 million users, making it the fastest-growing consumer application in history. Read Now

  • First, Do No Harm: Responsibly Applying Artificial Intelligence

    It was 2022 when early LLMs (Large Language Models) brought the term “AI” into mainstream public consciousness and since then, we’ve seen security corporations and integrators attempt to develop their solutions and sales pitches around the biggest tech boom of the 21st century. However, not all “artificial intelligence” is equally suitable for security applications, and it’s essential for end users to remain vigilant in understanding how their solutions are utilizing AI. Read Now

  • Improve Incident Response With Intelligent Cloud Video Surveillance

    Video surveillance is a vital part of business security, helping institutions protect against everyday threats for increased employee, customer, and student safety. However, many outdated surveillance solutions lack the ability to offer immediate insights into critical incidents. This slows down investigations and limits how effectively teams can respond to situations, creating greater risks for the organization. Read Now

Most   Popular

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.