Surviving in an Insecure E-World
The vulnerabilities recently found in the widely used Berkeley Internet Name Domain server should serve as a fresh reminder that it's an insecure e-world out thereAs if we needed another one, the vulnerabilities recently found in the widely used Berkeley Internet Name Domain server (see www.cert.org/summaries/CS-2001-01.html) should serve as a fresh reminder that its an insecure e-world out there. Anyone planning to do business on the Internet needs to be well-fortified, vigilant and prepared to react rapidly to known security problems. Its to your competitive advantage to be able to remedy security threats as quickly and efficiently as possible. By far, the single most common reason that companies are subject to break-ins and Web site defacements is that they have failed to patch well-known vulnerabilities. So why arent companies fixing well-known security problems? Its certainly not for lack of information. Most major vendors release security bulletins to customers. Carnegie Mellon Universitys CERT Coordination Center releases alerts. And BugTraq, hosted by SecurityFocus.com, is perhaps the largest and best-known of the security mailing lists. These sources are not always perfect, but theyre out there.
For most companies, the biggest roadblock to fixing known security vulnerabilities is getting information to people in the company who can actually do something with it.