Attack Prevention Paper The article that was chosen for the review was Simple Cross-Site Attack Prevention by Florian Kerschbaum. This article covers what a cross-site attack is, how attackers use them and how vulnerable web applications can be. In this paper we will look at what the problem is as the original author sees it. We will also look at resolutions that could be done to prevent this kind of attacks. In this article the author explains how a simple cross-site attack can take place and goes on to explain what a solution for this problem is. This article starts out by explaining what a cross-site attack is and how they take place with some examples. According to Kerschbaum “A reflected cross-site scripting attack or cross-site request forgery attack occurs when a user follows a malicious link. This link has been tainted with some input that exploits vulnerability on the target web site, such that a script can execute in the security context of the user’s browser and the target web site” (Kerschbaum, n.d., para. 13). In this article the author clearly states the problem and the seriousness of the problem. The author covered the information from a technical perspective but was able to describe the problem in every day terms so that the end users could understand the issues and the solution to the issue that would resolve the problem. These examples are thing that we still see today from the fake e-mails that send a person out to a site for them to login. Once they login it takes them to the site that they thought they were going to but at the same time the script has sent their username and password to another site, which just gives the attacker your information to login to your account anytime they want to. One example that most people have seen or heard of is the fake emails from Ebay or Paypal that tells you that you need to login to check your account for one reason or another and gives you a link to go to the site. The only issue is the link that you see is not the site that you are going to but the web developers have coded the site in a way that the end user thinks they are on the site. Then when the end user logs in the fake site sends the end user to Ebay or Paypal and at the same time sends the username and password to another site to record the information. In the computer service field you hear about this all the time when an end user calls a help desk and tries to find out what has happened to his or her money that they had on Paypal. Most of the time Paypal cannot do anything about it except to have you change your password. Paypal also put out emails and messages on their website to let all end users know that Paypal will never send you a link to their website. If Paypal needs you to login they will just tell you to login in by going to their website this way they know that you are typing the web address into the browser to get to the site. The author gives a sound conclusion stating the problem and a description one how to resolve the issue. The author urges other companies of all sizes to use the same algorithm that his company uses to prevent these types of attacks from happening. When reading this article this author could see the relevant to today’s users and how these attacks are still happening. Everyone that reads this article should come away with knowledge of what cross-site attacks are and how to prevent them from happening. This author has since this article to a few of the end users that he knows that have be attacked by this kind of attack. One end user that this article was sent to could read the article and understand most of what the article was covering and could see where they were attacked before. This article would be a good article for any end user or company information technology department members to read.
References
Kerschbaum, F. (n.d.). Simple Cross-Site Attack Prevention. Retrieved from http://www.cs.bham.ac.uk/~tpc/cwi/Teaching/MASPPapers/XsiteAttacks.pdf