Comments on: Why You Need to Run a Vulnerability Assessment

By: Emmanuel Carabott

Emmanuel Carabott — Thu, 14 Jul 2011 11:05:23 +0000

Hi Artie,

When you need to give remote access to remote workers, depending on the circumstances you have a number of options:

If the employees can be provided with a static IP then connections can be limited to that IP alone.

VPN can help reduce the surface area, especially together with a staging area. For example, if you want to give employees access to a web server and an SQL server it would be better if employees logged into a staging area thats only accepting VPN connections and then connect to those services from there. In such a scenario, only the staging area would be reachable from the outside.

Ensure stronger authentication when connecting from the outside by using a two factor authentication system.

If your employees will be connecting from public places again ensure there is a VPN and I would suggest the use of one time passwords.

By: Artie

Artie — Sun, 10 Jul 2011 18:16:45 +0000

You should also check legit remote access and the potential ways to abuse it. If you have remote workers, then you have no choice but to give them remote access and this can turn into a huge backdoor.

By: Emmanuel Carabott

Emmanuel Carabott — Tue, 28 Jun 2011 08:39:42 +0000

I agree with Rita,

Its always important to keep in mind that all a hacker needs is to find one weakness to compromise a system. As such it is all about you finding that vulnerability before an attacker does. At the end of the day it is that simple.

By: Rita

Rita — Mon, 27 Jun 2011 09:19:54 +0000

Securing a network is an endless battle – one little distraction, and all your security is blown to pieces. I agree that vulnerability assessments, or even better – a self-hack test at the end is just the top of the iceberg. These tasks take so much time but without them a network is exposed to all kinds of dangers.

By: GeoMechs

GeoMechs — Tue, 14 Jun 2011 07:15:08 +0000

Vulnerability assessment is as important as the main protection itself. Just like doctors said “prevention is better than cure”. And in a corporate setting vulnerability assessment can make or break a company’s overall performance.

I agree with Luke’s statement. All organizations should have some kind of vulnerability assessment in place especially these days where malwares are spreading and wrecking havoc everywhere. No one is excused.

By: Emmanuel Carabott

Emmanuel Carabott — Wed, 08 Jun 2011 09:13:48 +0000

@James

I agree that many admins set servers up and then forget about them, however I believe this is mainly because of lack of faith in themselves rather than any other reason. Some admins are afraid of touching a working system because they fear any changes might cause downtime and subsequently get them into trouble.

What they don’t realize is that by leaving such systems unattended and not installing any security fixes issued since release they are equally risking downtime or even worse consequences in the event of an intrusion!

By: Luke Ian

Luke Ian — Mon, 06 Jun 2011 02:15:45 +0000

With so many malwares, viruses, spywares, and scarewares running around the Internet these days (even Mac PCs are targeted and infiltrated), it’s not only a must to run a vulnerability assessment, it’s also a corporate responsibility (a big hint to Sony PlayStation and Sony Pictures).

In the past, having a vulnerability assessment in place is required only to big multi-national corporations. Today, even small and medium size businesses are following suit. This just proves that when it comes to IT security, size does not matter.

By: James

James — Sat, 04 Jun 2011 04:35:21 +0000

One of the more irritating things that novice sysadmins do is the whole “set it and forget it” method of administration…they think they can just set up a server and it’ll manage itself, and that it just needs to be secured while it’s being set up. It’s important to realize that vulnerability assessments need to be done on a regular basis.

By: Emmanuel Carabott

Emmanuel Carabott — Thu, 02 Jun 2011 07:40:13 +0000

Hi Tom,

You’re right, its always important to keep in mind that a hacker doesn’t need to get through ALL of your security but only the WEAKEST part. This makes it essential to cover all bases security wise or at least as much as possible depending on your cost, benefit ratio.

By: Tom Callahan

Tom Callahan — Wed, 01 Jun 2011 15:22:32 +0000

All of these back doors into a “secure” system really make you realize just how many moving parts there are in every network. If you don’t have total security, you may very well not have any in the hands of those who have the skills and know-how to get in. Especially with all these high profile hacks being perpetrated by “LulzSec,” now is probably the best time to re-evaluate your entire network security setup.