Intranet security gaps are most commonly a result of a combination of firewall and IDS limitations, poor application development and deployment practices, and widespread accessibility. Network devices such as firewalls and IDSes offer little or no protection at the application layer. They are unable to verify requests made through ports 80 or 443, which are kept open for HTML and HTTP communications.

More critical, however, is the lack of management oversight and safeguards. In many cases, intranet applications are developed by outsourced contractors (or even employees). While they may know HTML well, they are likely to have minimal knowledge of corporate security practices. This lack of knowledge is compounded by a lack of information about web security imperatives. As a result, developers will often trust users interacting with the application, fail to religiously validate input streams, encrypt passwords, enforce user access rights or control database access and retrieval.

[ Read more ]