4

I read this article about the 10 year old Finnish boy collecting a $10,000 bug bounty from Instagram with interest. According to the article (and I hope someone can shed more light on the exact details of the bug bounty), this boy was able to pick up information from Youtube and other online resources to figure out the security loophole.

What I am wondering about is whether there are standardized tools or plug-ins that programmers use to conduct automated security audit of their code, and if there are standardized tools that penetration testers use to do an automated security testing of the site. And if there are, then what is the likelihood of events such as the one described in the article occurring and what can the companies do to minimize the risk of these events?

Improve this question
3

There are many tools, and a few standards, but no standardized tools and a lot of the tools are expensive.

To minimize risk you basically have to teach your team how to code and deploy securely, conduct security tests frequently, and frequently update your security infrastructure at a very fast cyclical pace.

This can get expensive to do (time or money-wise) so lots of people simply don't do it or they only do a little bit.

The constant "rush to market" isn't helping matters. The current business trend is on speed to deliver an incomplete product rather than building for long-term quality. So inevitably cuts are made and some of the cuts are in security. This is unfortunate because in most cases the cost to re-engineer a product so it has security is MUCH more than it would have been to design security into it from the beginning.

Improve this answer
2
  • 1
    So given that there aren't standardized tools around, does it surprise you that there are loopholes that can be exploited by someone with what we would assume to be little or no knowledge about security (I did read that this Finnish kid has been playing around with this stuff since he was 8 years old or something).
    – Michael Lai
    May 12 '16 at 0:52
  • 1
    Not at all. I see really scary stuff every day. Specifically I'll point out that there are a lot of projects which scan the entire internet for vulnerabilities these have results that would probably blow most peoples minds.
    – Trey Blalock
    May 12 '16 at 0:53
1

Owasp is one of the most respected authorities on information security. Here is their list of testing tools. https://www.owasp.org/index.php/Appendix_A:_Testing_Tools

In regard to minimising the risk:

  1. Organisations should ensure their solution architecture takes into account the importance of information security.

  2. organisations should commission regular penetration tests by external companies who specialise in information security and fix any vulnerabilities that are detected.

  3. Organisations should keep their software and network infrastructure as current as possible.

  4. Organisations should have dedicated information security experts who keep on top of the emergence of new threats and apply patches in a timely manner.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.