SNMP Hit; What Will Be The Next Victim?

On Feb. 12, the SANS Institute warned thousands of security professionals around the globe that a major SNMP vulnerability had been discovered. Five months ago, SANS reissued a warning related to SNMP, and the vulnerability that was uncovered wound up being even worse than expected.

For those of you who havent done this already, its time to crack open SANS list of top 20 vulnerabilities and see how your network stacks up. (Go to www.eweek.com/links to find the list.)

The first two vulnerabilities listed are default operating system/application installations and blank/weak passwords.

Although these vulnerabilities might seem like fairly obvious items to check for, they also seem to exist somewhere in virtually every IT organization. For this reason, strong procedures, more than improved technology, are the best defense for networked environments.

Unpatched application and Web servers are just as vulnerable as default installs, and once the word gets out about a vulnerability, its a race between IT managers and script kiddies.

According to the SANS Institute, two proactive things that IT managers can do to protect their networks are 1) verifying that all backups are completed and 2) shutting down all open ports.

Although a backup is generally seen in the scope of information protection and disaster recovery, a bulletproof and timely backup program is an administrators best friend in the event that a system is corrupted or compromised.

With a speedy backup/recovery solution in place, an IT manager can easily restore a server to a steady state and apply security patches before reintroducing it to the network.

Future Threats

Unsecured wireless LANs are my top pick for the future vulnerability to watch out for. The easy availability of this technology (a result of its relatively painless installation and low cost) makes wireless LANs easy prey for intruders, since rogue employees often set them up.

No matter how many firewalls and IDSes you set up, an unsecured wireless LAN access point will give intruders a way to infiltrate your network.

Senior Analyst Henry Baltazar can be contacted at henry_baltazar@ziffdavis.com.