8 Elements of Complete Vulnerability Management - Slide 3

Email     |     Share  
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
Next 8 Elements of Complete Vulnerability Management-3 Next

External VAs have always been considered the most critical because Internet-accessible devices such as firewalls, Web servers, e-mail servers, and so forth are most exposed to attackers. These systems also typically expose the ports and services where most vulnerabilities have been discovered, namely port 25, which e-mail runs on, and port 80, where Web sites are hosulted.

According to a University of Maryland study, systems accessible to the Internet are scanned by hackers for vulnerabilities on average every 38 seconds. Many of these scans could result in the compromise of vulnerable systems. Vulnerability scanning from hackers happens so frequently, and from so many different sources (often other compromised systems), that it is impossible to react to these attacks. Most IT administrators view this type of malicious traffic as background noise.

As companies attempt to offer their customers more services and establish partner and trade relationships, all in an effort to stay competitive, they have been forced to open more ports on their firewalls and expose access to more systems to the outside world. As a result, more chinks in the armor can be exploited.

Today’s threat landscape offers attackers a much larger selection of attack points in the form of open firewall ports for business traffic, Web or other servers behind the firewall, along with all applications running internally on the network, including PCs and servers. This gives the bad guys a wealth of attack methods to find vulnerabilities in your network. Attackers even have applications that take all the difficulty out of hacking into your network. These programs can be used to run high-speed automated attacks that were unthinkable a few years ago.

External threats are now the minority attack method. Attacks targeting internal systems are more lucrative financially and more effective than external attacks. Spam, phishing, social engineering, malware, Trojans, portable media devices, and other methods are commonly used to compromise systems while completely subverting traditional security solutions such as firewalls, intrusion detection systems, and even previous external vulnerability scans.

Bottom line: It is easy to be a hacker, and hard to stay ahead of them. One silver lining is that many of these attack methods rely on the system being vulnerable in some way. A lot of attacks are looking for weaknesses or misconfigurations in browser and Web applications. Malicious websites, whether used in conjunction with spam, phishing, search engine manipulation or any of several other attack types, often require a vulnerable system in order for the hackers to be successful. Identifying and remediating these vulnerabilities becomes one of the methods we can use to stay ahead of criminals.

Here, Perimeter Chief Architect Kevin Prince offers up eight steps you should take to protect your organization.

You can check out other slideshows from Perimeter: Data Breach Trends of 2009, Tracking Data Breaches by Incident, and Top Security Threats for 2010.

Related Topics : Cyber Crime, Fiber-to-the-Premises, Infrastructure Concerns, Service Level Agreements, Telecommuting

More Slideshows

infra12-190x128 Top Five Vulnerabilities that Enable Phone Fraud

The phone system presents a perfect storm of characteristics, both new and old, that invite malicious abuse. Here are the top five vulnerabilities. ...  More >>

mobile15-190x128 Five Tips to Keep Employees Connected During the Holidays

So how do businesses make sure their employees stay connected during this busy travel time, no matter where they are? ...  More >>

Leadership Scorecard: The Top Six Telecom Vendors

Vendors are evaluated on criteria using actual data and metrics, including direct feedback from buyers, vendor market share, share momentum, financials and solution portfolio. ...  More >>

Subscribe to our Newsletters

Sign up now and get the best business technology insights direct to your inbox.