The 10 most critical Web application security problems for government and the private sector were unveiled Monday by the Open Web Application Security Project (OWASP), the Washington, D.C.-based open source community project. The list of vulnerabilities was created to focus government and industry on the most serious of the problems.

According to the report, the flaws are "surprisingly common" and can be exploited by unsophisticated attackers with easily available tools. When an organization deploys a web application, OWASP says, they invite the world to send HTTP requests. Attacks buried in these requests "sail past firewalls, filters, platform hardening, SSL, and IDS without notice" because they are inside legal HTTP requests.

Therefore, the report concludes, web application code is part of the security perimeter and cannot be ignored.

"The OWASP Top Ten list shines a spotlight directly on one of the most serious and often overlooked risks facing government and commercial organizations," said Jeffrey Williams, CEO of web application security firm Aspect Security. "A stunning number of organizations spend big bucks securing the network and somehow forget about the applications."

The report also stresses that the security issues raised are not new.

"In fact, some have been well understood for decades. Yet for some reason, major software development projects are still making these mistakes and jeopardizing not only their customers' security, but also the security of the entire Internet," the OWASP Web site states.

Added Peter G. Neumann, moderator of the ACM Risks Forum, "The underlying reality is shameful: most system and Web application software is written oblivious to security principles, software engineering, operational implications, and indeed common sense."

The list includes:

LATEST NEWS

Merchants Cope With PCI Compliance
Blue Coat: We Grow One Packet at a Time
Heavies Joining Against Patent Suits?
eBay Has to Pay in Fake Goods Case
Lo-Jack For Laptops?