Thursday, February 12, 2009

WAS 2.0 - Are you ready?

Web 2.0 technologies are gaining more and more attention as each day passes. It is all over the Internet and even beginning to enter the Government space. How does it affect us?

Well, Web 2.0 offers a more enjoyable Web experience through enhanced collaboration, information sharing, and user functionality. This comes with a cost and additional security risks to the organization and end users. Securing Web 2.0 is usually an afterthought; mainly because security impedes the focus of being user-friendly and innovative. Currently, Web 2.0 security is not nearly as strong as Web 1.0. We are just getting up to speed on implementing Web 1.0 security controls. Introducing a new set of variables will increase the complexity of Web Applications. We're not ready!

Web Application Security 2.0 (WAS 2.0) will be more common in the upcoming year as the focus will shift more in the direction of Web 2.0. You may have already heard the term "Government 2.0". GSA has already launched new Web 2.0 tools for USA.gov with many Departments/Agencies following in their footsteps. President Obama has embraced Web 2.0 during his campaign and will continue to do so throughout his administration. The "Change" that is about to come will be a drastic overhaul of legacy Government systems, but does cyber security play as big of a role as President Obama originally pitched?

Here are just a few basic Web 2.0 security risks among the many possibilities and examples of Government 2.0 Security Incidents/Vulnerabilities ...
Top 10 Web 2.0 Attack Vectors
President Obama's Campaign w/ a Trojan Horse
Government and Twitter + Twitter Hacked
Congressman uses Twitter and Reveals "Secret" Location

1 comments:

  1. Jason: As always, well said on a great topic. Another concern we have is the risk and attack factors associate with Web 2.0. Most of Web app security problems are instigated by user inputs. And the focus on RIA/Web 2.0 is all about user generated content, which broadens the attack surfaces. Also in some cases, a same existing attack can cause bigger impact on Web 2.0 environment than 1.0. For example, clickjacking is not that big of a deal in Web 1.0.
    ReplyDelete