As reported by Lisa Vaas at eWEEK, “Fox News’ Web site over the weekend exposed a password that granted inappropriate access to images from its news stories and to a headline feed from its content syndication partner and eWEEK publisher, Ziff Davis Media.” Ziff Davis Media is also the publisher of Permit/Deny.
Hacker Webzine is now reporting SQL injection and ColdFusion vulnerabilities in publicly facing applications at Fox sites.
The next step for Fox and Ziff Davis is to run a vulnerability assessment battery against their externally facing IT resources.
Then the companies need to hire a different company (to avoid conflict of interest and inferior test results) to run penetration tests against the sites to ensure that as many weaknesses as possible are found.
Then a third company should be hired to help the current IT staffs at both companies remediate the remaining problems. Finally, the vulnerability assessment and penetration tests should be run again to ensure that the newly remediated Web sites and any exposed systems (such as servers sitting in a DMZ) are fully patched and ready to face the hostile world.
I think it’s important to separate vulnerability assessment, penetration testing and remediation into three distinct segments of the same overall project to ensure the best results.
If the same company performs all three operations, then Fox and Ziff Davis will likely be protected against the faults that the single vendor knows best. Dividing the tasks almost certainly adds time and complexity to the ultimate security solution. However, with three sets of independent security consultants checking on each other, the problems likely to be found by motivated hackers from the outside will greatly reduced in number. Further, the most serious and obvious problems, such as those experienced by Fox, will almost certainly be eliminated.
IT managers should use public examples to motivate plans to secure their infrastructure. The vulnerability assessment/pen testing/remediation cycle that I’ve outlined won’t be the cheapest solution for correcting security problems. However, these external tests are more effective than occasional internal audits.