Insecure software an open door to hackers

Companies are putting themselves increasingly at risk by letting hackers in via poorly designed software, according to security experts.

Applications which are accessed over the internet can be at risk from a variety of attacks such as cookie poisoning, database sabotage and protocol piggybacking. These attacks are designed to take advantage of the built-in weaknesses some applications have.

Gunter Ollman, principal consultant at Internet Security Systems (ISS), claimed most UK companies are not aware of the threats.

He said: "Most companies are aware of the traditional hacker threats and have firewalls in place. But they have forgotten to secure the applications themselves. A haphazardly designed database can easily give the hacker a way in via the company's website for instance."

Tal Gilat, CEO of Israeli firm Kavado, which specialises in application level security, said companies have an outdated view of security.

"Most IT managers still endorse the traditional network security approach to protecting their applications. But security solutions such as VPNs, firewalls and intrusion detection systems do not protect the applications. No two applications are implemented the same way across businesses. Each application is always unique which makes them vulnerable," he said.

Ollman said there are no short-term solutions to the problem. "The only way to secure applications is to design the software with security in mind," he said.