6th European Conference - Academic Conferences

Security Analysis of Webservers of Prominent
Organizations of Pakistan
Muhammad Naveed
Free Lance Research, Pakistan
mnaveed29@gmail.com
Abstract: Insecure webservers are a serious threat to the organization’s repute and resources. Successful attack
on webservers can destroy the trust of customers or people getting services from the organization. Webservers
were selected for this study because they provide easily accessible entrance to the network from the Internet and
security of webservers should be considered as an index to assess the organization’s overall information security.
This study analyzes the webservers of prominent organizations of Pakistan to assess their level of security.
Webservers of different types of organizations were selected to provide a general view of security of Pakistani
webservers. The selected webservers were of the organizations who should be first to secure their webservers as
they are the leaders in their respective fields in the country. So, all the smaller organizations can be assumed to
have much lesser concern for security. Benchmark for every type of organization was first established to compare
the results of the analysis with it. Nmap scanner was used to scan the webservers for security threats. The results
reveal that the webservers in Pakistan are not secure and there is extreme need of awareness about information
security in the country. The lack of importance given to information security can lead to cyber terrorism and might
create lot of troubles for the country.
Keywords: information security, analysis, security threats, Webserver, Pakistan, Nmap
1. Introduction and background
Security is one of the fundamental requirements for each and every network, just like it is the
requirement for each and every human. Without proper security, a network is just like a house without
doors and windows. In case the network has a lot of valuable information and resources, it’s like a
bank full of money without any guards and security cameras. Just like the bank in the example will be
a serious place for potential theft or robbery, same is the case with the insecure networks. But, there
is much difference in human perceptions about the unsafe bank and insecure networks. People don’t
understand the ultimate results of insecure networks and in Pakistan the situation is worst.
Businesses and individuals don’t even consider it to be an element that needs consideration.
Negligence in information security can have terrible consequences. It is not difficult to imagine the
chaos created if an ill-intentioned person gains access to the country’s most trusted news channel’s
website. Let’s suppose he just adds one single headline that a bomb has been placed at a specified
place in the city or on some road side, what would be the troubles faced by the people? Let’s take
another example, if he just adds one line that prime minister has said that we are going to attack our
neighbor soon, which may end up in bloody feud between the two countries or at least create
misunderstandings between the countries and can seriously damage the relationships between the
countries. Trend Micro Data–stealing malware focus report of June 2009 says, “In March 2008, data
from 4.2 million credit card numbers were stolen in transmission as a result of malware installed on all
of Hannaford Brothers’ servers in 300 stores”. (Trend Micro 2009) There are hundreds of other
examples of attacks performed to achieve malicious objectives.
The study analyzes the webservers of famous and most reputable organizations of the country. Three
types of organizations were considered for the study: Education and Research, Commercial
Organizations and News channels. Benchmark is first set by analyzing the world’s respectable
organizations and whose analysis shows their webservers to be almost completely secure.
Benchmark is set, so that the results can be compared with them. Exactly similar Pakistani
organizations’ webservers as the organizations used to set benchmarks were analyzed to give an
insight about the information security awareness in the country. Organizations selected for analysis
should be first to implement security on the basis of their status and business capacity. Webservers
were selected because they can be easily analyzed from Internet and analysis of webservers
provides insight for the complete network security of the organization. Nmap scanner was used to get
the results. The identity of the Pakistani organizations analyzed is kept secret because of the possible
damage to the repute of the organization. But, it is simple to use Nmap scanner to analyze any
organization’s web server and getting almost the similar results for many organizations of the similar
type. So, the results are basically an indicator of the security awareness on a large scale.
188