By default, Joomla will emulate "register_globals = on", to not break backwards compatibility with older components, modules or plugins. This will cause the same security issues as using normal "register_globals on". You can turn this off however:

Open globals.php (located in the root of your Joomla installation).

Search for:

define( 'RG_EMULATION', 1 );

and change it to:

define( 'RG_EMULATION', 0 );

That should keep you a bit safer against attacks.