As if we needed another one, the vulnerabilities recently found in the widely used Berkeley Internet Name Domain server (see www.cert.org/summaries/CS-2001-01.html) should serve as a fresh reminder that its an insecure e-world out there. Anyone planning to do business on the Internet needs to be well-fortified, vigilant and prepared to react rapidly to known security problems. Its to your competitive advantage to be able to remedy security threats as quickly and efficiently as possible. By far, the single most common reason that companies are subject to break-ins and Web site defacements is that they have failed to patch well-known vulnerabilities.
So why arent companies fixing well-known security problems? Its certainly not for lack of information. Most major vendors release security bulletins to customers. Carnegie Mellon Universitys CERT Coordination Center releases alerts. And BugTraq, hosted by SecurityFocus.com, is perhaps the largest and best-known of the security mailing lists. These sources are not always perfect, but theyre out there.
For most companies, the biggest roadblock to fixing known security vulnerabilities is getting information to people in the company who can actually do something with it.
If you are like my typical client, a handful of people in your organization track the various security information sources. They may not be the people directly affected, and they may not know who else might be because they may not have up-to-date configuration information. Worse, they probably dont have the authority to take key production systems offline to apply patches or upgrades.
The best way around this problem is to designate a core team of individuals to monitor security information sources and arm them with up-to-date configuration information.
Here are some other things you can do to reduce your organizations risk:
—Subscribe to mailing lists, check Web sites and be sure to get on the distribution lists of the vendors whose software your company uses.
—Once the information is received, you should have an established process for disseminating it throughout the company and for documenting and following up on responses.
Its an insecure e-world out there, but there are things you can do to respond to known problems.