Old security flaws still a major cause of breaches, says report
Companies are overlooking obvious threats in the rush to tackle new ones, says TrustWave
Computerworld - An overemphasis on tackling new and emerging security threats may be causing companies to overlook older but far more frequently exploited vulnerabilities, according to a recent report.
The report, from Trustwave, is based on an analysis of data gathered from more than 1,900 penetration tests and over 200 data breach investigations conducted on behalf of clients such as American Express, MasterCard, Discover, Visa and several large retailers.
The analysis shows that major global companies are employing "vulnerability chasers" and searching out the latest vulnerabilities and zero-day threats while overlooking the most common ones, the report said.
As a result, companies continue to be felled by old and supposedly well-understood vulnerabilities rather than by newfangled attack tools and methods.
For instance, the top three ways hackers gained initial access to corporate networks in 2009 were via remote access applications, trusted internal network connections and SQL injection attacks, Trustwave found.
All three attacks points have been well researched for several years. SQL injection vulnerabilities, for instance, have been known about for at least 10 years but still continue to be widely prevalent in Web-based, database-driven applications, Trustwave said.
The most common vulnerability that Trustwave discovered during its external network penetration tests involved the management interfaces for Web application engines such as WebSphere and ColdFusion. In many cases, the management interfaces were accessible directly from the Internet and had little or no password protection, potentially allowing attackers to deploy their own malicious applications on the Web server.
Similarly unprotected network infrastructure components such as routers, switches and VPN concentrators represented the second most common vulnerability unearthed by Trustwave. The tendency by many companies to host internal applications on the same server that also hosts external content was another common vulnerability, as were misconfigured firewall rules, default or easy-to-guess passwords, and DNS cache poisoning.
Meanwhile, Trustwave's wireless penetration tests unearthed common weaknesses such as the continued use of WEP encryption, legacy 802.11 networks with minimal to no security controls, and wireless clients using public "guest" networks instead of secured private networks.
In almost all of the cases, the most common vulnerabilities unearthed by Trustwave were common, well-understood issues that should have been addressed a long time ago, said Nicholas Percoco, senior vice president at Trustwave's SpiderLabs research unit.
"There are basically two themes," Percoco said. "Through our study in 2009 we found some very old vulnerabilities present within enterprises, some as old as 20 to 30 years." The second theme is that attackers are targeting those old flaws to break into enterprises and then using increasingly sophisticated tools to harvest data from companies, he said.
- Fight Malware, Malfeasance and Malingering Every year brings more extreme sets of threats than the last. The good news is that there are a range of mitigation options....
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Malware and Vulnerabilities White Papers | Webcasts