by Eric Chabrow
Excerpt:
But Tom Kellermann, who chaired the threats working group of the highly touted Commission on Cybersecurity for the 44th Presidency, sounded alarmed about the website breaches, and believes hackers can penetrate websites to gain access to databases. Unlike in years past, hackers employing an SQL injection or cross-site scripting attack can push their way through the web applications and into the databases housed on back-end servers, and then into the network layer itself, he says. "That's a fact of life now because of Web 2.0," says Kellermann, vice president of security awareness at Core Security Technologies, a provider of IT security testing software. "And that's the real worrisome phenomenon here."
Kellermann suggests the website assaults may have served as camouflage to a more hideous attack that penetrated into the back-end server databases and networks. "Just because they burned your house down didn't mean they didn't infiltrate beforehand," he says. "The enemy could have very well infiltrated these systems beforehand, and then launched the denial of service to basically cloud it with a fog of war and cover their tracks for what had been done on front end."
Source: GovInfoSecurity
