"Securing Web applications needs to be a key element of every company's overall IT security plan. Application-specific firewalls will become increasingly important for enterprises, especially as they start exposing critical business processes with Web services." John Pescatore Vice President of Research, Information Security at Gartner Group

E-business has enabled new and exciting uses of the Web, from online customer self-service applications that save money and promote customer intimacy to B2B transaction software that streamlines relationships with suppliers and partners. However, every application that links corporate information to the Web gives hackers a new potential entry-point into the organization. In the race to develop online services, Web applications have been developed and deployed with minimal attention to security risks. The result has been that most corporate sites are surprisingly vulnerable to hacking or industrial espionage.

According to a survey published in April 2002 by San Francisco�s Computer Security Institute and the FBI, 90% of the 503 security professionals surveyed--most of whom work for large corporations and government agencies--use firewalls and anti-virus solutions at their companies, and 60% use intrusion detection systems. Yet 90% still suffered in 2001 from security breaches including virus infections, Web site vandalism, credit card fraud and theft of company secrets. The most expensive breaches were cases of financial fraud, causing an average loss of $4.6 million. 85% were attacked by Internet worms like Code Red and Nimda, causing an average financial loss of $283,000 from a single worm attack. Finally, a staggering 97% of web applications audited by Sanctum Inc. were found vulnerable to application-level attacks.

Web applications today house the most valuable assets a company has, namely their digital information and data. Current approaches to web application protection address security issues at the last and most expensive stage of the application lifecycle - deployment. With the amount of new code being added or changed every day, it has become impossible to keep up with all the necessary manual patching or fixing. The only way to beat the hackers at their own game is to think about security from the earliest stage of Web application development, and then fight automation with automation at each stage of the application lifecycle.