April 04, 2005

7 Myths about Network Security

So this evening I was doing the dew and catching up on some reading when I came across an interesting article on Security Pipeline about the "7 Myths of Network Security". It is well worth the read. In summary, the article breaks down the 7 Myths as:

  1. Myth: Encryption guarantees protection
  2. Myth: Firewalls will make you bulletproof
  3. Myth: Hackers ignore old software
  4. Myth: Macs Are safe
  5. Myth: Security tools and software patches make everybody safer
  6. Myth: As long as your corporate network is unbreached, hackers can't hurt you
  7. Myth: If you work for a security enterprise, your data is safe.
So, as you can imagine, the article discusses how the opposite of the myths are true. Notice #4? I talked about that a bit last week. These are good points that I see on a regular basis. Please spread the word to others, and bust these myths.

Happy reading.

Posted by SilverStr at April 4, 2005 10:32 PM | TrackBack
Comments

#5 is (perhaps purposely?) written in a somewhat misleading way.

On re-reading #5 and the underlying assumptions given at (http://www.networkmagazine.com/shared/article/showArticle.jhtml?articleId=18201800), one can see how the wording is misleading. What they really meant to say is that by releasing a patch, vendors make it easier to reverse engineer the original vulnerability into an exploit. In other words, if you /don't/ apply a released patch, you're probably /more/ vulnerable than you were before the patch was released.

Moral of #5: patch as soon as you can, and you'll be safer.

Moral of all the myths: there's no silver bullet. Everyone, no matter how diligent, has a level of vulnerability. It's possible to be 'more secure', but never possible to be 'completely secure'. Of course no professional is surprised by this.

Posted by: Bryan at April 5, 2005 07:29 AM

Bryan,

Completely agree with you. Good points. As attackers get more lazy, they continue to rely on these patch cycles to find what has been broken. The sad state of affairs is that on a lot of recent attacks, they were in RESPONSE to a patch that wasn't widely applied.

Patch management is still a weak piece of the puzzle. I think Debian Linux has the right idea with apt. I only hope things like WUS get this good to include 3rd party packages.

Posted by: SilverStr at April 5, 2005 07:56 AM