Basic flaws lead to big gaps in security

Commitment to specialist training is failing to keep up with security hardware investment, leaving key devices improperly configured and enterprises open to attack.

A report from consultant NTA Monitor, collated over four years of penetration testing with blue-chip enterprise clients, showed that little progress had been made in addressing basic issues, such as router configuration, which accounted for the highest percentage of vulnerabilities.

The most common, found in 82 per cent of tests last year, was that boxes had not been configured to reject ICMP requests such as ping, which can reveal basic address details of the targeted router.

DNS vulnerabilities decreased, but were still detected in 79 per cent of tests. Block zone transfers remained common, meaning hackers could download all DNS data from a single server in one attempt.

There is a correlation between the increase in concern about securing the enterprise and the rise in vulnerabilities. While companies invest in protecting their business processes they are not allocating enough resources to address the true problems.

Much of these security problems can easily be addressed. The report showed many network managers fail to apply patches, or properly configure hardware and software. It said the sophistication of security technologies makes it difficult for network administrators to keep up to date.

A wide range of specialist courses are now available, but finding the time to send key personnel away from busy IT departments is a challenge.

Peter Bury, who teaches security and networking courses at ISS, said a lack of experienced staff in the security market means some attendees were on call during courses. "Some had to return to work during lunch to deal with IT fire-fighting."

Security devices are meaningless and dangerous without the knowledge to configure them to protect the network. Iain Rusling, security analyst at building society Nationwide, said training had filled basic gaps in his knowledge. "I learned about networks and security on the job, and the training gave a better all-round understanding of how the two are linked," said Rusling.

Comment on this story
www.NTA-Monitor.com