Although dynamic pages produced using the "get" method can be locally cached, and therefore faster for the viewer to revisit, this method typically reveals parameters and values that are passed to your CGI scripts as part of the viewable URL. Such information may be all a hacker needs to start prodding at your CGI scripts.

The Internet makes digital trespassing incredibly convenient. Figure that a car thief in a crowded parking lot at a large mall, working alone, wandering around in search of weak targets, can cover only so much ground per hour--and, at best, get away with only one or two cars. But in that same hour, a single Pentium computer in a garage can sniff out thousands of servers, creating an inventory of weak targets for its owner to pursue at leisure.

The lesson here is that all servers on the Internet are poked and prodded for holes. One of the first steps to take in improving the security of your machines is to poke and prod them yourself and tighten up your bottom tier, the operating system. A number of software packages on the market can help you.

For Unix systems, some popular general-purpose security scanning tools are Satan and its newer sibling, Saint, as well as the ever-popular Nessus. These "scanners"--as they are known--are especially well-suited to finding known configuration holes in your operating system. In Unix environments, many of these suites are expanding to probe for holes in the application-tier layer as well.

The Windows market is awash in commercial security enhancements, with niche focuses from authentication and access logging to hostile code and intrusion detection. Some of these products address weaknesses in Windows operating systems, while most target vulnerabilities at the application development level. With so many products on the market, it's impossible to endorse any particular one, since installed systems vary so widely from one organization to another. However, consider spending a great deal of time shopping around at SecurityFocus. com's Web site, especially the well-organized vendor products area.

Ultimately, security can never be guaranteed. This is no excuse not to use the weapons you have--attention and know-how.

return to page 1, 2

Illustration by Ken Orvidas