Alertra SecureSite™
Security Vulnerability Assessment (Part 1 of 3)
Prev | 1 | 2 | 3 | Next
What if trouble comes looking for you?
You probably have a pretty good handle on the things that might go wrong with your network that are within your control. For instance, what happens when a hard drive dies? Or if your network provider loses connectivity? These are all things you've planned for and are directly within your control. They are accidental, infrequent, and largely random. But what if trouble comes looking for you?
DShield, the Distributed Intrusion Detection System, recorded 187,571,368 attacks against Internet connected devices last week (as of May 4th, 2005). They reported that the average time between attacks for an average network is 54 minutes. These are mostly automated worms scanning large blocks of the Internet for vulnerable machines. But some are invariably targeted attacks by malicious hackers seeking entry into systems for their own purposes. Once a worm or hacker compromises your system or network, it is no longer yours; they own it.
Who does what to your network from the outside is largely out of your control. Alertra's SecureSite™ service is designed to scan your systems looking for the same vulnerabilities that malicious hackers and worms are looking for. However, we report those vulnerabilities to you so that you can take proactive measures against potential problems. In essence, vulnerability scanning puts your security exposure back in your hands and out of those who want to do you harm.
Is patching enough?
Most major system vendors like Microsoft, Sun, and open source operating systems such as Linux and BSD have set up automated methods of patching and updating their software. Is keeping up the patches on software enough to secure your systems from attacks? No, for 3 major reasons.
1. Patches do not come out quickly enough. Even after a vulnerability is reported to a vendor, it takes additional time for them to release a patch. They must devise a fix, test it, and then release. For Microsoft this generally only happens once per month. Other vendors may release patches more or less often. But the clock on your risk to any vulnerability starts when the vulnerability is discovered, not when the patch is released.
2. You may not be able to install every patch when it comes out. How often are you willing to update mission critical software? Every time you install updates you risk the update breaking the software it is intended to patch and possibly related applications as well. You'll need time to test and apply updates. SecureSite™ gives you not only information on vulnerabilities, but quite often gives you workarounds to the problem. Sometimes workarounds might even be preferred; see this diary entry at SANS.
3. Patches do not address configuration problems. Finally, Alertra's vulnerability scanner will alert you to configuration problems. These problems are not properly classified as bugs or holes in the software (and therefore won't be patched), but can nevertheless facilitate attacks on your server.
Excerpt from Part 2:
"... downloading, installing,
running, and maintaining your own vulnerability scanner will be a big hassle at best, and most likely completely ineffective."
Continue to Part 2...
Prev | 1 | 2 | 3 | Next
Not logged in.
