Protecting systems from hacker attacks is a complex problem that involves a "combination of people, technology, training and awareness," according to Mark Danton, partner for Information Systems Audit at Ernst and Young.
Speaking at an e-security forum in Johannesburg last night, Danton said that although the majority of attacks are "shotgun" approach attacks, often involving less experienced crackers, there has been a significant increase in targeted attacks over the past year.
He said a recent study by Riptech found that "more than 40% of attacks were targeted at specific organisations," and the size, and particularly ownership, of the organisation was found to be a big part of the attraction to hackers.
Danton said that while "we are putting in perimeter protection well," the security weakness in most companies is the result of constantly changing policies and faulty implementation. "Policies are changing constantly because the landscape is changing."
Trent Rossini, head of DiscoveryWorld at Discovery Health, noted that while there are many challenges to corporations in securing their business, "security needs to be reflected against the business benefit offered". He added that while it is important to establish the strictest security possible, the implementation of security should not hinder the benefits of better business processes. Although no system is 100% secure, he said, it is important to ensure that corporate processes are "secure to an acceptable point".
Rossini agreed with Danton that the weak link in the security chain is the human element. "Security systems degrade over time... and it is guaranteed that people will make mistakes that weaken the system when changes are made. Unfortunately, there is no silver bullet in security," but the monitoring of systems is critical to security, as are dedicated and skilled staff.
While the theft of information and unauthorised access are a constant threat to businesses, performance-related risks, such as denial of service attacks, and reputational attacks including Web site defacements, are an equally damaging threat to business, said Rossini.
Stieler van Eeden, of the Attack and Penetration eSecurity team at Ernst and Young, said that while some companies are starting to take security seriously, there are still gaping holes in many businesses. Van Eeden said that typical failures in infrastructure include failing to locate publicly-accessible servers in de-militarised zones, as well as making unprotected mail servers accessible to remote access.
Van Eeden said the ease with which relatively unskilled hackers can penetrate systems by using canned scripts easily available on the Internet is a significant threat to corporations. He noted that over the next couple of years there will be more than 20 million Internet users who will have the ability to launch attacks on systems over the Internet.
Share
