How Secure R your Systems?

December 4, 2008

I was asked the other day by a multinational business man whether or not the typical business is “secure.”  It really is an interesting question.  And as CEO of a leading IT security assessment and penetration testing company, my perspective is probably relevant to the question.

I started out by stating that most companies have implemented the most fundamental security provisions and therefore have a “sense of security.”  But continued to tell him that implementing provisions is very different from effectively implementing IT security provisions.  Allow me to clarify this position.

Statistically, most companies that “connect” have a firewall in place to protect their network and have installed anti-malware (anti-virus) software on many systems.  Despite these controls, we can hack into and gain access to nearly 100% of the companies we are hired to evaluate.  How?

Let’s put small companies aside for a moment; their SOHO firewalls are pretty easy to breach as implemented.  Most larger and even mid-size companies will put better products in place but rarely do they managed these products to ensure they are effectively configured and maintained.

For example, we routinely come across firewalls and network routers that have default “public” access enabled.  This access gives us useful information that we can use to escalate our privileges.  These same firewalls and routers are infrequently updated with the most current version of the software/firmware that operates the device.  We routinely exploit known vulnerabilities that could have been remediated with regular software updates.

Another example, many companies deploy systems with anti-malware software but do not ensure that virus definitions are kept current and deployed to 100% of their systems.  In our penetration testing we often gain access to only a few systems, but then use these systems to obtain far-reaching access to all systems on the company network.

So what is my advice to my multinational business man colleague?  Simple – “Deploy effectively and test the effectiveness of your security on a regular basis.”

– TrustCC


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: