Securing Web 2.0: Are your web applications vulnerable?

When Web 2.0 applications push functionality and code to users, they provide hackers with information that can be used for formulating attacks. Often, old attacks such as cross-site scripting become more dangerous when used against Web 2.0 applications. This white paper defines some of the common technological components of Web 2.0 applications and discusses ways of securing them against exploitation.

Web 2.0 uses the web for delivering information that is often created through community contribution. Wikis and blogs are good examples of these types of applications. The main attribute of a Web 2.0 application is interactivity.

In Web 2.0 applications, data can be exchanged between applications in a variety of methods, including XML, JSON and proprietary structures. Often, this data is transmitted in clear text, making it easy for attackers to collect. The increase in functionality and interactivity has increased the ways in which an application can be attacked successfully. Even old attack methods have gained new strength when attacking Web 2.0 applications.

Until security is part of the complete software development lifecycle, Web 2.0 applications will remain insecure and can increase the potential for harm.