I originally posted this at http://www.318.com/TechJournal
“We’re not a high profile target.†We’ve heard it countless times before, but that argument just doesn’t hold up any more. There are malicious applications out there that scan entire chunks of the internet for computers that are vulnerable to specific attacks.
Most small businesses hold the position that because they are not a “high profile targetâ€, such attacks do not represent a threat to them. In terms of modern security, the attitude of “We’re not NASA, and therefore our information is not confidential enough to protectâ€, just doesn’t hold up.
The security attacks described in this article are sometimes less about your competition covertly gaining access to your trade secrets or client/job data, and more about random entities exploiting your precious technology resources. In addition to stealing confidential data, Internet hacks can compromise the performance of your technology assets with Bots and other Spyware as well as use up most if not all of your Internet bandwidth. all of these potential symptoms cost business in lost productivity and the direct costs of having to resolve these performance issues.
No device that’s open to the web’s protocols is secure
Nearly every router and firewall, from consumer grade to professional grade has the option to create what is called a Demilitarized Zone, or a DMZ. DMZs offer the ability to quickly split an Internet connection to many computers while still moving all incoming traffic into a specific computer. Often, the standard setup is to DMZ a server in a small office that has one server. This is especially common when this server is being used for multiple purposes (such as a web server, FTP server, mail server, etc.). Each one of these services uses a specific port to differentiate incoming requests. For example, web traffic typically uses port 80. When selecting ports coming into a network, it is important to remember that the less traffic that comes into a network, the better. However, when using DMZ, all ports are open, giving attackers a virtually limitless amount of ports to scan, infiltrate, and exploit.
Selectively granting access is now a must.
Attackers are also using Google to find unsecured stations that accidentally get crawled (a book on hacking with Google was just released ). If one of your systems is compromised by a hacker and used to launch an attack on another computer, then those victims have every right to sue you for damages in court.
Another excuse that doesn’t hold up any more is, “It’s a Mac, and they’re secure.†It’s true that Mac OS X has been labeled the “most secure†OS on the market. However, the MOST secure doesn’t mean FULLY secure. Macs are going to become higher profile targets in that more and more attacks can be launched from them, even if there are still fewer people attacking them than Windows.
Since nothing that’s open to the web is secure and most every business relies on open connections to the Internet to remain competitive, Three18 recommends that our clients keep as many copies of everything important in as many locations as they can, as well as having routine security audits and port scans.
Rotating redundant offsite backup solutions are critical.
The best way to protect your data is to back it up. When evaluating the costs, ask yourself how much money one day’s data is worth to your company. A week? A month? An hour? Then, make decisions on how often to back up based on the backup cost vs. the cost to recreate the data.
Protecting your assets requires a plan for both your perimeter and your data as well as your technology assets.
Now having said all of this, the real cost of security is inconvenience. The rule of thumb is that the more security is applied to an environment, proportionally the less convenient access to that environment becomes.
More often than not, the cost of 100% security is too high for two reasons: it limits the convenient access of a company’s data both internally and remotely, which often is required to support a company’s business logic as applied to technology; and it simply costs too much money to implement.
The best analogy is that of the homeowner who chooses to get an alarm system and put high quality locks on all the doors of his/her home, but opts to leave all of the windows on the home’s first floor without bars. In this case, the home is safe from the typical entry points, but at the price of maintaining a nice view through the windows, the home is vulnerable at the same time.
Sometimes less than 100% is good enough.
Security, as with most business decisions, is a risk-based decision. Factors of costs, convenience and liability must all be considered to fully understand the implications of business security.