Slashdot Mirror
How Cyber Spies Infiltrate Business Systems
snydeq writes "InfoWorld's Bob Violino reports on the quiet threat to today's business: cyber spies on network systems. According to observers, 75 percent of companies have been infected with undetected, targeted attacks — ones that typically exploit multiple weaknesses with the ultimate goal of compromising a specific account. Such attacks often begin by correlating publicly available information to access a single system. From there, the entire environment can be gradually traversed enabling attackers to place monitoring software in out-of-the-way systems, such as log servers, where IT often doesn't look for intrusions. 'They collect the data and send it out, such as via FTP, in small amounts over time, so they don't rise over the noise of normal traffic and call attention to themselves,' Violino writes. 'There's probably no way you can completely protect your organization against the increasingly sophisticated attacks by foreign and domestic spies. That's especially true if the attacks are coming from foreign governments, because nations have resources that most companies do not possess.'"
These days I work for a network security monitoring company. We have only fortune 500 customers and a number of large state organizations.
All I can say is ROFL. That made my day, really, it did it made my day.
State is even worse than corporate and corporate is bad enough. They have so many ridiculous security policies mandated while leaving gaping holes the size of Texas open. It's all about keeping the illusion of security really.
We have live security staff monitoring their systems and we do it. We monitor and in some cases manage firewalls and have IDS/IDP systems in place and we monitor those as well. Additionally, we sell security and some enterprise grade network gear.
So here is how it goes. An IDS at undisclosed location flags a SQL attack sequence in the form on a major website. We get the alert, determine a complex SQL sequence in network traffic is pretty distinct and not usually a false positive.
So I put down my putting iron and run to the phone to notify the customer during the 15 minute SLA.
Joe "This is Joe, help desk, may I have your name?"
Me "Hey Joe, this is lord vader at company x. We have detected an attack in your network stream. Our automated systems detected and blocked this attack but we highly recommend having the appropriate admins check your web/SQL servers and firewall logs for any suspicious activity."
Joe "I'm not really sure what all that means but I'll submit a ticket."
24 hours later I get a notification that Joe closed his ticket, there are no updates from any admins.
It's a joke, most companies think that having 'enterprise' AV means they don't have viruses/malware and having IDS means they are safe from network attack. They think having overzealous security policy means they are secure.
The reality is no automated system replaces attentive personal and any security policy that interferes with day to day business will be bypassed in some fashion or worked around at any opportunity.
Another example from back when I did service work. We had a bank call us. They were just inspected and the security inspector told them they had to have a firewall with intrusion detection. They called us because they had to be in compliance. They basically had NO security and no a single firewall in the shop. They even had remote access setup on systems with modems on the banking network!
So we prepare a proposal that would get them a solid firewall and an intrusion detection system and lock down the glaring security holes.
They turn us down. Instead they bought one copy of Norton Internet Security and installed it on a system. Technically, they had a firewall that lists intrusion detection as a feature now and this brought them into compliance.