wonderfully unique software solutions

Few follow best security practice on web apps for file uploading, says Opswat

A survey by Opswat has found low levels of best practice around web application security — despite concerns about the rise in malware attacks in the past year.

According to the zero-trust focused security vendor, this means that critical infrastructure industries are vulnerable.

“Eighty-two percent of organisations with web applications that accept file uploads have increased concerns about malware attacks in the last year, but only eight percent implement security best practices,” Opswat said.

The company said that its poll suggested that about a third of organisations that have taken advantage of the convenience of web applications for file uploads do not also scan all file uploads to detect malicious files.

Also, the majority do not “sanitise” file uploads with content disarm reconstruction (CDR) to prevent unknown malware and zero-day attacks, it said, despite rising risk in the hybrid workplace.

Opswat notes that the Open Web Application Security Project (OWASP) nonprofit, which tracks the most common risks for web application security and provides best practices for their mitigation, has identified unrestricted file uploads” as presenting risk.

Files can hide malware that can give attackers direct access to organisational IT, systems, information and data, it points out.

Other findings from Opswat’s survey include that 49% of critical infrastructure industries were extremely concerned about the risks of file uploading, compared to 36% of other industries.

“Loss of revenue and reputational damage are top concerns in the event of an attack. Two-thirds of organisations [that we surveyed] with a web application for file uploads are concerned about reputational damage or a loss in business or revenue related to unsecure file uploads,” the company said.

“Organisations aren’t following best practices, they aren’t using comprehensive anti-virus technology effectively, and most are not using CDR technology to prevent known and unknown attacks.”

( Photo by Mick Haupt on Unsplash )

Recent Articles

Agreement management vendor DocuSign to add AI with Lexion buy

Cloud documentation management software company DocuSign has agreed to acquire Lexion, rolling the latter's AI capabilities into its DocuSign Intelligent Agreement Management...

LastPass urges SMBs to tackle human cyber vulnerabilities

SMBs are more proactive yet still aren't patching cybersecurity gaps caused by the "human factor" -- that is, based on human psychology...

Four core GFI business manager applications add AI co-pilot

GFI Software has integrated AI co-pilot capabilities into four of its key business-focused applications with a view to optimised network performance and...

Extended detection and response (XDR) has become vital, says Stormshield

Extended detection and response technologies (XDR) have become a vitally important shield for all companies, according to sovereignty focused data, network and...

Is OSCP or CEH the best security certification for staff? CBT Nuggets explains

Deciding between Offensive Security Certified Professional (OSCP) and Certified Ethical Hacker (CEH) cybersecurity skills certifications can be "make or break" for staff,...

Related Stories

Leave A Reply

Please enter your comment!
Please enter your name here

Weirdware monthly - Get the latest news in your inbox