While SSL is a great technology to ensure that consumers’ browsers are communicating to the businesses’ servers in an encrypted manner, and ensuring that these are legitimate businesses, it doesn’t prevent from the hacking the websites through vulnerabilities in Web applications.

Enterprises need to shift the focus of their security operations from a small group of individuals with a set of tactical objectives, to a virtual organization that provides strategic value and has the ability to improve outcomes for the organization, its customers and employees.

Most people will focus on perimeter security and think that they have it all covered. Unfortunately, network security is never enough. Just as we cant control what's on television, who is in Internet chat rooms or who is on the other end of the phone, we can't control the browsers that are interacting with your web applications.

I’ve approached design and development companies with the thought of pre-launch web application security scans, done on a staging server. More times than I can count, these conversations end up in an agreement that web security is essential but there is no desire to find out how really secure the target site really is.