Misconfigured Networks Main Cause of Breaches

An anonymous reader writes "Responses to a survey from attendees of the DEFCON 18 conference revealed that 73% came across a misconfigured network more than three quarters of the time – which, according to 76% of the sample, was the easiest IT resource to exploit. Results revealed that 18% of professionals believe misconfigured networks are the result of insufficient time or money for audits. 14% felt that compliance audits that don't always capture security best practices are a factor and 11% felt that threat vectors that change faster than they can be addressed play a key role."

Comments

Check those facts & figures

[Just_Say_Duhhh]

73% came across a misconfigured network more than three quarters of the time – which, according to 76% of the sample, was the easiest IT resource to exploit.

So are we to believe that 73% is more than three quarters, or is this a case where 90% of IT is half-mental?

Re:Check those facts & figures

[Sir_Lewk]

Presumably the other 3% thought it was the easiest IT resource to exploit, but did not actually come across them more than three quarters of the time.

This summary is an absolute nightmare.

Re:Check those facts & figures

[jd]

Nonono. We had the Russian Station transmit secret numbers recently, this is clearly a response from agents in the field.

Re:Check those facts & figures

[Arthur Grumbine]

This summary is an absolute nightmare.

I just assumed it was written by the marketing team for Sex Panther.

Misconfigured networks

[Culture20]

So, that means vulnerable ports were open to "the world" on the systems, and the "network" was supposed to be doing the firewalling? Network firewalls and system firewalls should use identical policies.

Re:Misconfigured networks

[causality]

So, that means vulnerable ports were open to "the world" on the systems, and the "network" was supposed to be doing the firewalling? Network firewalls and system firewalls should use identical policies.

That's a bit general. Say you want to run a Samba fileserver to share files among Windows clients. You'd want the fileserver on your internal network to accept connections from the relevant ports. You would not want the firewall standing between your network and the Internet to also have that port open to the world.

While it's true that a conscientious admin would tighten up the Samba server's firewall by specifying both ports and IP addresses/ranges (or other credentials) that are acceptable, you still wouldn't have identical policies between the internal systems and the firewall controlling what can connect from outside.

Re:Misconfigured networks

[Culture20]

That's a bit general. Say you want to run a Samba fileserver to share files among Windows clients. You'd want the fileserver on your internal network to accept connections from the relevant ports. You would not want the firewall standing between your network and the Internet to also have that port open to the world. While it's true that a conscientious admin would tighten up the Samba server's firewall by specifying both ports and IP addresses/ranges (or other credentials) that are acceptable, you still wouldn't have identical policies between the internal systems and the firewall controlling what can connect from outside.

Good point. I should think more often before I type.

Of those 73 percent of misconfigured networks...

[GPLDAN]

Probably 95 percent of THOSE networks were defeated using Doug Song's tools.


http://monkey.org/~dugsong/dsniff/

Best security advice I ever got.....

[LibertineR]

"It aint a firewall, unless it stops shit going in BOTH DIRECTIONS."

Re:Simple fix?

[LibertineR]

....and what is your solution when I come in and tell your fat receptionist that she looks nice in that moo-mu, and that I am there to fix the phones, but maybe we can go for a drink when I am done, and can I have access to the IT closet at 5:02pm?

Re:Simple fix?

[c6gunner]

Hire lesbians.

Check your reading comprehension

[blueg3]

Imagine everyone was asked how often they came across a misconfigured network. One guy answered "about 80% of the time". Another guy answered "20% of the time." 73% of the respondents, when asked, gave an answer that was higher than "75% of the time".

Separately, respondents were asked what IT resource was easiest to exploit, and 76% of them said "network".

Shitty study

[evel aka matt]

I was at Defcon this year (like always), and the people conducting this study were essentially paid per response, which I'm sure is quite common. We were standing on the Riv steps, during one of our many cigarette breaks, and some girl came up and asked us to do her survey.

Us: "This question doesn't really make sense."
Her: "Just check any box, I need to get them all filled."

And that's basically how it went. The question/answers seemed a little silly, and there were a lot of excluded middles. The surveyors knew nothing of the questions, and were just trying to get out there of (can't blame 'em). The answer space was a checkbox, and if you saw it, you'd see how easy it'd be to just fill out the rest of the boxes with similar answers if you wanted to go home.