Defending against Internet security risks becoming more difficult
Connecting state and local government leaders
Online threats are becoming increasingly targeted and personal, creating new challenges for IT security staff, according to a new SANS Institute survey.
Online threats are becoming increasingly targeted and personal, creating new challenges for information technology security personnel, according to the latest list of top 20 Internet security risks released today by the SANS Institute.
Two major trends in this year's list are social engineering ' duping executives, IT staff and others with privileged access so that high-value computers can be compromised ' and the targeting of custom-built applications, often Web applications, that can expose data on the server side and infect additional computers on the client side. Half of the total vulnerabilities reported in 2007 have been in Web applications, said Rohit Dhamankar, senior manager of security research at TippingPoint.
The complete, updated seventh annual list is available at www.sans.org/top20.
Although the list focuses on emerging attack patterns, old vulnerabilities continue to be targeted by automated attack programs. According to the early warning SANS Internet Storm Center, an unprotected online computer can expect to survive uncompromised for only five minutes. Because several of the newer threats do not have simple technical fixes, they are harder to defend against, said Alan Paller, director of research at SANS.
'For most large and sensitive organizations, the newest risks are the ones causing the most trouble,' Paller said. 'They take a level of commitment to continuous monitoring and uncompromising adherence to policy with real penalties that only the largest banks and most sensitive military organizations have, so far, been willing to implement.'
In addition to Web application vulnerabilities, there has been a sharp jump in vulnerabilities found in Microsoft Office products, including Excel, Word and Visio. Twenty-three critical vulnerabilities have been identified in the suite so far in 2007, up from six in 2006. For compromised computers, the most common results are likely to be installation of spyware, including keystroke loggers for the theft of data, and recruitment into a botnet to become a platform for additional attacks or store and serve illicit data.
In addition to custom Web applications and privileged users, other areas of particular concern highlighted in the list include:
- Critical client-side vulnerabilities in applications such as Web browsers, Office software, e-mail clients and media players.
- Critical server-side vulnerabilities in operating environments and primary services provided to users, including Windows Services, Unix and Mac operating system services, backup software, antivirus software, management servers, database software and voice-over-IP servers.
- Policy-enforcement problems, such as excessive user rights and unencrypted laptop PCs and removable drives that can expose sensitive data.
- The ever-popular zero-day attacks for which technical fixes have not been released.
- Secure configuration.
- Automated configuration management to maintain secure configuration and ensure up-to-date patching.
- Proxy of critical client-level services.
- Encryption and classification mapped against access control to guard against data leakage.
- Education and inoculation, in which benign phishing attacks are sent to users to ensure that acceptable use policies are being followed.
- Proper DMZ segmentation with firewalls.
- Testing programmers' security skills and scanning software for security flaws.
NEXT STORY: NMCI wins highest rating to date