Worms are considered a major security problem today, but one expert says you may be overlooking a bigger problem -- the damage a single hacker can do inside your network.
Jesper Johansson, a Microsoft security program manager, demonstrated how a hacker can easily invade and compromise a network. His standing-room-only session at the recent Microsoft Worldwide Partner Conference in Toronto focused on methods administrators can use to better secure Windows, but it drew attention to Microsoft vulnerability concerns as a whole.
"We're not perfect. We're not where we need to be," Microsoft CEO Steve Ballmer said at the conference about his company's security efforts. But he said the company is making progress based on feedback from partners and customers.
One partner attending the conference explained that his biggest Windows security concerns stem from backdoor vulnerabilities that don't appear until after a patch has been made.
"I'll often patch one vulnerability, and then a new one shows up," said Guy-Marie Joseph, president of ConnecTalk Inc., a Montreal-based IT services company. "Patches don't take into account the back door. Unless you've been hit by a hacker, you don't know what's vulnerable. If you haven't been hit, you eventually will and then you'll know."
Johansson's session addressed common administrator mistakes that open the door to hackers, including failure to harden Windows applications, allowing outbound FTP, weak passwords and login misuse -- logging onto something other than a domain server with a domain server login.
"What really worries me is somebody adding himself to my payroll. Do you know everyone on your payroll?" he asked, adding that many IT shops are unaware of a hacker's presence.
Johansson also described a scenario in which he injected a Trojan horse in a domain server during a vulnerability test at Microsoft. No one logged onto the domain servers, which he called a sign of a well-run network. However, no one noticed the file named "EvilTrojan.exe," so he finally had to inform IT managers of the Trojan's presence, something that obviously wouldn't happen in the real world.
"The moral of the story is initial entry is everything," Johansson said. "Most networks are designed like eggs shells. They're hard and crunchy on the outside, soft and chewy on the inside."
Once a hacker is in your network, you have three options, according to Johansson. You can update your resume, hope the hacker does a good job running the network or drain the network. The latter is really your only option, he said.
To establish and maintain network security, Johansson outlines what not to do. Here are his "10 easy steps to getting your network hacked."
- Don't patch anything
- Run unhardened applications
- Log on everywhere as "domain administrator"
- Open lots of holes in the firewall
- Allow unrestricted internal traffic
- Allow all outbound traffic
- Don't harden servers at all
- Use lame passwords
- Use high-level service accounts in multiple places
- Assume everything is OK
For more information
Learn the difference between hackers and crackers
Browse a list of Windows security tips
Check out the Best Web Links on intrusion detection and prevention
