Hackers target unsecured apps

Security experts at Networks telecom 2001 in Birmingham have warned network managers that hackers are focusing their attacks on unsecured applications rather than exploiting flaws in operating systems.

Simon Edwards, a security analyst at Internet Security Systems, said that hackers were more likely to target applications like databases, particularly when it comes to attacking web servers.

"You find a lot of administrators who know how to secure operating systems and even web servers," he said. "But few know how to secure databases. Hardening a database can be a real black art."

According to Edwards, operating systems such as Windows 2000 and Solaris 8 have been made harder to hack, but "if you get into a SQL database you've got full control of the server".

Part of this reason, he explained, is that vendors typically release more security patches for operating systems than they do for applications.

"Securing web servers today can really come down to how secure your databases are," said Edwards. "To hackers, operating systems have become so passé."