Common and Deadly Security Mistakes Coders Make

In 2013, when Burger King’s official twitter was hacked and replaced with a bio that led to McDonald’s, the food conglomerate learned the hard way that social media is a double-edged sword.

Pranks like these make headlines.

But the focus is more on the individual responsible than on security gaps that lead to a vulnerable situation in the first place.   

The truth is, most businesses don’t think twice about application vulnerability, which is the real culprit that allows “hacktivists” to penetrate through security systems. It’s because of these subtle errors in programs that let cyber criminals slip in effortlessly between the cracks.

But programmers are also human beings. Even the most experienced coders make mistakes. But these mistakes are often costly and can lead to dangers. Here are common and deadly security mistakes to keep an eye out for:

• Trusting Third-Party Code That Can’t Be Trusted

Professional programmers do not build an app from scratch. They develop apps by imitating code from other developers. This is done through an open source or a third-part software that are used for performing important functions.

These can either be presentations with a license or graphical interference elements, or user encryption and authentication.

However, these third-party services are often full of vulnerabilities that go unnoticed by developers. And what makes the matter worse is that most businesses don’t know which third-party service they have used and whether or not they were checked for security loopholes.

So what is the solution? You can’t expect coders to write programs from scratch. The only solution is to check the guidelines by the International Education Association of Australia for working with third-parties. 

• Keeping Backdoor Accounts

Cisco Systems recently had this problem. They discovered various backdoor accounts that led to security loopholes. Sometimes coders use backdoor accounts or hard-code passwords for testing applications and then forget to take them out.

While most coders believe that nobody will find out about these accounts, the truth is that if they fall into the wrong hands, it will give hacktivists root access to affected routers.

The problem is that many organisations don’t take the initiative to be careful and the password and login for administrative rights are often written into the original frameware of running ICS devices.  

The problem is that so many organisations believe that this helps make their applications more manageable which is a big mistake. You don’t know who will become interested in your application!

• Forgetting to Secure Data

Sans Institute ranks sensitive data exposure as number 8 on its list of 25 dangerous programming mistakes.

In simpler terms, it’s not acceptable to handle sensitive data carelessly and you’re obligated to follow your country’s federal laws regarding vulnerable data. This includes usernames and passwords of employees, as well identification data and anything that can compromise an individual’s security.

Most organisations take the approach of employing encryption into their applications but this is not enough. You’re going to have to use powerful encryption tools that are immune to harmful attacks. Make sure not use reversible ‘symmetric’ algorithms to protect your passwords because this can jeopardise your identification system.

To ensure the safety of your app against loopholes and vulnerabilities, go for professional web application testing services. We offer top-notch vulnerability scanning service for web and mobile applications. Feel free to get in touch with us learn more

A Beginner’s Guide to DDoS Attack and Protection

A Beginner’s Guide to DDoS: Mechanics, Attack Types, and Protection

In the current Australian cyber threat landscape, availability is just as important as confidentiality. While data breaches make headlines, Distributed Denial of Service (DoS) attacks can silently cripple a business, costing thousands of dollars in lost revenue per minute.

For IT managers and business owners, the question isn't just "what is it?"—it is effectively asking, "how do you DDoS proof a network?" To answer that, we must first understand the mechanics of the attack itself.

What is a DDoS Attack?

A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.

Think of it like a physical shop entrance. If one person stands in the doorway (a standard DoS attack), security can easily remove them. But if a large number of people crowd the door simultaneously, blocking legitimate customers from entering, the shop effectively ceases to function.

In the digital world, the goal is to send so much "junk" traffic that the server cannot process legitimate traffic, causing the site to slow to a crawl or crash completely.

The Mechanics: How Do You DDoS a Modern Network?

When people search for "ddos attack how to" or "how to dos," they are usually trying to understand the architecture behind these massive assaults.

A standard DoS attack typically comes from a single source. However, a DDoS attack relies on a network of compromised machines, known as a botnet.

1. Recruitment: Attackers infect thousands of vulnerable computers, servers, and increasingly, IoT devices (like smart cameras and routers) with malware.

2. Command and Control (C2): The attacker controls these infected devices remotely.

3. The Attack: The attacker sends a command to the botnet. Suddenly, thousands (or millions) of devices send a request to the attack targets simultaneously.

Because the traffic comes from legitimate devices distributed across the globe, distinguishing the bad traffic from the good is incredibly difficult.

Common Types of DDoS Attacks

Not all attacks are the same. Understanding the types of attack is critical for selecting the right DDoS protection. They generally fall into three categories:

1. Volumetric Attacks

These are the most common. The goal is to consume the bandwidth of the target site.

• UDP Floods: Attackers send vast amounts of UDP packets to random ports on the host. The host checks for the application listening at that port, finds none, and replies with an "ICMP Destination Unreachable" packet, exhausting its resources.

• DNS Amplification: This effectively explains "how to dos" with efficiency. The attacker sends a small request to a third-party server with a spoofed IP address (the victim's IP). The server sends a massive response to the victim, amplifying the traffic volume significantly.

2. Protocol Attacks (State-Exhaustion)

These attacks target the connection state tables in firewalls and load balancers.

• SYN Flood: The attacker sends a succession of SYN requests (the first part of a TCP handshake) in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.

3. Application Layer Attacks (Layer 7)

These are the most insidious. They don't target bandwidth; they target the web server itself.

• HTTP Floods: The attacker sends what looks like legitimate HTTP requests (e.g., "GET /index.html" or "POST /login"). Because generating the page requires processing power from the server and database, a large number of these requests can crash the database, even with low bandwidth usage.

The Motivation: Why Attackers Do It

Why would someone expend resources to crash your site?

• Extortion: This is rising in Australia. Attackers demonstrate a small attack, then demand a ransom to stop a larger one.

• Smoke-Screening: Attackers use DDoS to distract your security team while they perform a more subtle data breach or injection attack elsewhere.

• Business Competition: Unscrupulous competitors may hire "DDoS-for-hire" services to take your site offline during peak sales periods.

Protection Strategies: How to Defend Your Infrastructure

To mitigate these threats, relying on a simple firewall is no longer enough. You need a multi-layered strategy.

Rate Limiting

Rate limiting restricts the number of network traffic requests a user can make within a specific timeframe. While this helps against simple scripting attacks, it often fails against complex botnets that rotate IP addresses.

Web Application Firewalls (WAFs)

Web Application Firewalls WAFs are essential for stopping application layer attacks. A WAF sits between the internet and your server, inspecting traffic for malicious patterns (like SQL injection or known bot signatures) and blocking them before they reach your database.

Traffic Scrubbing and Cloud Mitigation

For volumetric attacks, on-premise hardware often fails because the pipe simply fills up. Cloud-based DDoS protection services act as a massive filter. They accept all traffic meant for your website, "scrub" the bad requests at their massive data centers, and send only the legitimate traffic to your server.

Understanding "how to dos" or the mechanics of a botnet isn't about learning to hack—it's about learning to survive. As IoT devices proliferate, the scale of distributed denial of service dos attacks will only grow.

Organizations must move beyond reactive measures. You need to baseline your traffic, implement robust WAFs, and regularly stress-test your environment to ensure your defenses actually work when the flood arrives.

Is your infrastructure resilient enough to withstand a DDoS attack? Don't wait for your server to crash to find out. Contact Lean Security today to discuss our stress-testing and web application security services.

Why a Network Vulnerability Assessment is good for Business

Cyber attacks have cost companies and businesses a fair bit, both in terms of money and in terms of information/intellectual property according to international statistics. Keeping your company’s digital property safe means making sure your network security is on the ball.

When it comes to advanced web security testing, penetration tests are great, but they can take a little more time and are not the same as vulnerability assessments!

Pen Tests

Penetration tests or more commonly called pen tests are basically you authorizing someone to attempt to hack your organizational network and access sensitive information. The idea is to find loopholes in your network security by simulating an attack. The pen test’s primary focus is how detrimental a specific attack could be as opposed to exposing numerous weaknesses like a vulnerability assessment.  

Vulnerability Assessments

A vulnerability assessment is a detailed and extensive procedure involving a series of tests in order to identify loopholes in network security. Vulnerability assessments also involve providing possible solutions and options for organizations to strengthen their security and protect their data and other digital assets.

Why Bother

As we said, no matter how seamless you think your network security is, there are those out there who can find ways to penetrate your protocols. There are a few reasons why it might be a good idea to have regular vulnerability assessments done even if you’re already getting pen tests!

Frequency

Pen tests might be slightly obstructive when it comes to regular business functions and therefore cannot be performed regularly. Vulnerability assessments can be performed more often without really interrupting your business or exposing you to risks!

Kind of like the bi-annual visit to the dentist—it does not mean you stop brushing those pearly whites.

Keeping Up

You might not be poking your system to find holes in it every day. Hackers on the other hand are on a constant lookout for weaknesses in your IT security infrastructure. Since vulnerability assessments can be performed as often as every other day without upsetting your day to day business stuff they help give hackers a hard time.

You’re always a step ahead of the hackers because if there is a kink in the system, you’ll be the first to know.

Keep the Pen Tests Light

Pen tests can be a kick in the shin when you get them done because they alert you to a whole number of little security holes. This really makes you wonder how exposed you’ve been all along!

Vulnerability assessments allow you to deal with such loopholes on a regular basis so that when you do get that pen test, the list of weaknesses is far lighter. Think of this like doing the dishes after every meal in contrast to letting them sit till the weekend when you have the time.

Uninterrupted Business

Cyber and network attacks can really throw a business off, putting you back on not just schedules but tens of thousands of dollars. Even penetration tests when conducted can trigger problems and slow things down.

Vulnerability assessments let you keep working while you keep your data safe.

Guarantees

Depending on what business you’re in or what your organization does, client guarantees tend to mean something. If you can’t guarantee safety of client data and information, that might not be the best thing.

Vulnerability assessments allow you to make your networks as seamlessly secure as possible. That way you can hold your head up, look your client in the eye and tell them that their data, records and any other information is safe with you!

Upshot

Don’t waste time thinking about it. Get your networks assessed and make sure those valuable data assets are protected! If you’re not sure where to begin, get in touch! We know web security assessments like none other and would be happy to help!

Things to Look Out for When Hiring a Managed Network Security Service

Given that cybercrime, network security breaches and organizational data penetration and theft can cost a pretty penny statistically speaking, it makes sense to stay protected.

Much to Choose From

When looking for companies that specialize in managing web security assessments and other network security needs, there might be quite a few options out there to choose from.

But how can you be sure that you hired the right managed network security service?

Points to Ponder

When looking to identify a reliable managed network security service, there are a few things to look out for. These things should help you decide whether the service in question is indeed the right one for you!

Legitimacy

The first thing you need to look into is the legitimacy of the company you’re looking to hire. Are they reliable? Are they licensed? Do they have other clients whom they serve? Are there any reviews about them online? Are the team members trained and qualified to do what they do?

Questions such as these and looking into the same should help you identify how legitimate the company you are looking into is. Trusting someone with your network and data security needs is a huge decision. You want to make sure you’re handing such a massive responsibility over to not just someone legitimate but someone capable!

 

Knowledge and Experience

Knowledge and experience are two different things. Experience would dictate their time spent doing what they’re doing. If it’s network security they manage, how long have they been providing that service? It stands to reason that a longer time in the market equals more real experience to draw on.

That being said, at times, newer companies have teams with highly qualified and skilled individuals who might even make up for a slight lack of experience with sheer technical knowhow.

Question representatives of the company you wish to hire about both their degree of experience and level of technical skill.

Working Together

Another thing you want to establish is what the work dynamic between you and the hired company will be as well as if it suits your needs.

Will they spend a lot of time in your office space or operate remotely with frequent visits. Do they get along with your in-house IT department? How are they with feedback, communication and follow ups?

When outsourcing network security management, it is important to remember that you will have a day to day relationship with them. Understanding what that dynamic will look like and whether it suits you and your team will help ensure that you hire a service provider who can work well with you.

Info Sharing

Just as your company will need to give the hired security management company access to data and other information, how much access to security protocols will your company receive in return? Establishing this is important and transparency when it comes to data security is crucial.

Bad Days

Another thing to establish is how the chosen company might address attacks. Can they ensure that some of your servers will continue to run while work is being done on others?

Miscellaneous

Apart from the big ones mentioned above, there are other things to look into. These include:

· The security company’s relationship with its vendors?

· How and where they plan to store your data?

· What technologies they apply?

· Are they up to date and do they partake in continued professional development?

Upshot

Though deciding which network security company to hire is a tricky decision it is an important one. The right company could ensure the success of your business and protection of sensitive data. The wrong company or non-existence of network security could…you know. Let’s just not go there!

If you’re trying to figure out where to start, our Aussie company isn’t just warm and friendly, we’re reliable too! We offer advanced web security testing among other things. Come on over and check out what we can do for you!

Web Application Firewalls: Essentials and Basics

Since their initial appearance around the end of the 80’s, firewalls have really helped numerous organizations, businesses and individuals in the area of security. That being said, like about everything else, tech and otherwise, firewalls too have made progress.

Web Application Firewalls

Web application vulnerability has been a concern for many business owners and other professionals—exactly what firewalls address. But what exactly are firewalls?

Is there any difference between a WAF (web application firewall) and a regular firewall? Let’s find out!

Evolution

WAFs were developed and evolved starting around the early 90s. These were developed to address threats and risks that managed to evade regular firewalls.

 

What Threats?

To be specific, threats that gained access through trusted protocols (like HTTP), to piggyback and then access other related secure (or meant to be secure) applications. Once this is done, everything from data to system operating may be compromised.

In response, various WAFs were developed each boasting separate specifications.

Getting Down to It

To make things simple, we could divide WAFs into three general categories. We’re going to skim over these and a little about how they function.

Network Based

Network based web application firewalls are the primary category of WAFs to be developed. These are highly effective and hardware based. They are good at countering negative performance. Another thing they are good against is latency. That being said, these are costly both to install or procure as well as to apply.

Application Based

Application based firewalls operate in close quarters to the application being protected. At times, they and the mentioned application code can even be intertwined. This allows for higher performance and well as further flexibility with regard to customization.

Last but not least, the low cost of this form of WAF makes it an attractive network security prospect for many! On the downside, application based WAFs can sometimes be inadequate for macro establishments and organizations.

Cloud Hosted

Cloud hosted web application firewalls are effective guard dogs for those who need a prompt solution. What they lack in versatility and customizability, they make up for in sheer convenience.

They are easily deployed and make traffic redirecting rather simple. They can be subscribed to temporarily and work well as a go between before shifting to supplementary or more permanent solutions.  

The WAF Edge

The good thing about WAFs is they are geared to protect you from both threats; known and unknown. WAF protocols are geared to detect and address threats combination methods which may include validation of input as well as security and threat removal on a data base level.

Will My Company Benefit?

Anyone who performs online transactions can benefit from a web application firewall. That being said, businesses which involve a lot of online transacting such as banks or online stores should most definitely be investing in WAFs if they aren’t already!

Conclusion

Given that many today still need to get their head around web application firewalls and how they work. There is always more information out there however we can tell you this, whether you know it already or not, network security, WAFs included in this day and age are a needed investment!

If you’re looking for security testing services and Cloud WAF service to see where you stand by way of network security, check out your options or give us a shout! Maybe we can help!

Just remember, when it comes to keeping the data of yourself and your clients secure, it is always better to be safe than sorry!