Top 10 reasons web sites are hacked (Hint: number 0 is lack of team work)
Found this article on Network World. I found this statement most interesting:
“When you go to your Web site design team, what you’re looking for is people who are creative and able to build these interesting Web sites…
Part of the problem as I see it (and I do this for a living if anything I am most decidedly a “web professional”) is that there are usually at least six teams on any given web project: web hosting, web development, network engineers, database administration, project management and the project sponsor (the business folks who wanted this web site in the first place). This is where the largest challenges start. It has been said that the three most important factors for any new brick and mortar business are location, location and location. Well I would put forth that the three most important factors to successful web projects are communication, communication and lots more communication! No questions are dumb (but some answers are) and knowledge assumed is dangerous. Another key factor to web project success is disclosure. Nothing is proprietary to a collaborative team! This isn’t a compartmentalized top secret mission it’s a project with a common goal in mind: success.
Master plans have two additional unhealthy characteristics. To begin with, the existence of a master plan alienates the users… After all, the very existence of a master plan means, by definition, that the members of the community can have little impact on the future shape of their community, because most of the important decisions have already been made. In a sense, under a master plan people are living with a frozen future, able to affect only relatively trivial details. When people lose the sense of responsibility for the environment they live in, and realize that they are merely cogs in someone else’s machine, how can they feel any sense of identification with the community, or any sense of purpose there? - Christopher Alexander, The Oregon Experiment
A third critical success factor to web projects is design life cycle. Not only should the entire team be engaged in the entire life cycle but is the design being revisited on a periodic basis? Is this design (now years old) still the best design? Is it still secure in light of new security practices and vulnerability knowledge? An application is a living object. It grows, improves, removes defects, improves on it’s abilities, matures and eventually dies. Is the entire life cycle being reviewed or it it simply installed and left to die a natural death of eventual abandonment or worse failure due to vulnerability exposure? There is much more at stake here than just checking off a project completion column. There is the reputation of the application, the team, the company or endeavor and yay the reputation of future projects themselves.
“It is ever so with the things that men begin: there is a frost in Spring, or a blight in Summer. and they fail of their promise.” - Gimli, The Lord of the Rings.