How secure is your company’s information? In this age of distributed computing and of client-server and Internet-enabled information access, computer security consistently rises to the top of most “important issues” lists.

To answer this question with certainty is difficult. There are no absolutes with security. An important first step for most corporations is a security policy that establishes acceptable behavior. The next, and more critical step, is to enforce that security policy and measure its effectiveness. A security policy is in tension with user convenience, creating forces that move security practices away from security policy. Additionally when new machines or applications are configured the security related issues are often overlooked. Therefore the gap between central policy and decentralized practice can be immense. These are significant tasks, as are identifying problems and taking corrective action on a constantly changing network. Many enterprises typically fall back on blind faith rather than wrestle with the fear of the unknown.

In order to assess your true security profile, you must first understand the sources of risk. The most infamous risk is embodied by the external hacker accessing a corporate information systems via the Internet. Traditionally these hackers view breaking into a system as mountain climbers view scaling a cliff, for them its the next great challenge. However, as ever increasing numbers of corporations interconnect their information systems successful break-ins become commercially rewarding. Practitioners of industrial espionage now view the computers on the Internet as valuable potential sources of information. Often these “professionals” masquerade as the traditional hacker to disguise their true purposes.

Although the threats from external attacks are real, they are not the principle source of risk. FBI statistics show that more than 60% of computer crimes originate inside the enterprise. These risks can take multiple forms. Unscrupulous employees may be searching for organizational advantages. A disgruntled employee may be co-opted by an industrial espionage agent. Increasingly corporations are turning to contractors for specialized skills or to absorb temporary increases in work-load. These contractors are often given access to the corporate information system and thus they can also present a risk to corporate information.

Many enterprises erect a firewall as the first and often only line of defense for their information systems. A firewall is a device that controls the flow of communication between internal networks and external networks, such as the Internet. Many corporations assume that, once they have installed a firewall, they have reduced all their network security risks.

A firewall must be configured to allow or deny appropriate traffic. The configuration process can be highly susceptible to human error. In a dynamically changing environment, system managers routinely reconfigure firewalls without regard to security implications. Access control lists on a firewall can be numerous and confusing. You must be sure that the firewall has been set up correctly and that it is performing well.

Even when properly configured the firewall can only repel connection attempts that come through the firewall itself. This represents the logical equivalent of the Maginot line that defended France’s border with Germany before World War II. The forts and defenses of the Maginot line were impenetrable; however, an attack around the line through other neighboring countries completely circumvented the line. The attackers were able to easily move through the rest of the country because the French defense efforts had been focused on the Maginot line. A information attack can be mounted via modem on the internal network. If all of the enterprise’s defenses are focused on the firewall then an attack that circumvents firewall though a modem or an internally based attack will have free reign over the information systems.

Thus the security features of the internal computers must also be employed. The important balance between convenience for the users and security concerns must be considered. That is the computer systems must be allowed to be collaborative in nature with appropriate access to information and functions across systems. At the same time this access provides a wide open avenue for the industrial espionage attack.

Often the elements of the enterprise’s computer system must be updated to eliminate security risks introduced by bugs in operating systems and network service programs. If a bug creates a performance related problem then it is a “squeaky wheel” that will drive the upgrade. A functioning version of a program or service with the security bugs can be easily overlooked as an important item for upgrades. By the time a security related bug becomes the proverbial “squeaky wheel” - its too late.

Security must be assessed from multiple viewpoints for the best over all picture. These perspectives range from the physical security of the machines to the configuration of the firewalls to the trustworthiness of workers. The history of industrial espionage has been in the physical world and thus numerous practices have been developed to handle the this portion of security assessment. The age of network based industrial espionage has a brief history and thus less developed security assessment practices.

The security profile of a network of machines can be assess from three principle vantage points.

The ideal assessment strategy begins with the individual machines before they are ever inter-connected. Each machine’s vulnerabilities are corrected, putting the network of machines off to a reasonable start. Next the network of computers are probed for security vulnerabilities. Typically the move from individual machines to an internetwork of interdependent machines creates a significant number of exploitable holes. Thus the network of computers is examined for security vulnerabilities. Finally the external network defenses, the firewall, are verified. In this final stage the last layer of defense - the first layer encountered by an information adversary - can be thoroughly checked. Problems are more easily isolated to the configurations and performance of the firewall connections themselves.

In real life the machines, the internetwork of computers and often the external connections to the Internet already exist. Additionally a significant number of vulnerabilities exist at each level of the enterprise’s information systems. Often the number of known vulnerabilities exceeds an organization’s capacity to implement corrective action. This imbalance between known vulnerabilities and corrective capacity is a chief contributor to the gap between an enterprise’s security policy and security practice. An enterprise in this position often does not care to learn of more security vulnerabilities, following a “what I don’t know won’t hurt me” philosophy.

The real danger in this situation is that the scarce resources available to implement corrective security policies are squandered on the most well know vulnerabilities instead of being allocated to the vulnerabilities with the greatest risk to the enterprise. Firms in this position should invest in knowledge so that their limited resources are optimally deployed. The first step in a resource investment decision to is fully understand the range of options available and then pick the portfolio of investments that presents the highest aggregate return. In security assessment the firms must first evaluate all the vulnerabilities from all perspectives: system, internal and external. Aggregating and prioritizing the list of vulnerabilities will then provide a guideline for investing in corrective action to improve the match between security practice and security policy.

As individual vulnerabilities are corrected under any security improvement process these vulnerabilities should stay fixed. Thus the corrections must always to monitored. By monitoring these changes over time the firm can look for the root causes of frequently occurring vulnerabilities. Then the enterprise can move on to lower priority vulnerabilities.

By undertaking a strategy of consistently fixing vulnerabilities, monitoring them to make sure they stay fixed and analyzing the causes of recurring vulnerabilities the enterprise enters the mode of continuous security improvement. The feedback loop of a security assessment provides the information flow necessary to improve the security of the enterprise's information systems

To be the successful the security audit must be thorough, it can not leave out possible vulnerabilities. It must also be repeatable to provide a consistent perspective on the firm's security practice. By its very nature a security assessment will initially increase the workload for an MIS department. These seemingly conflicting goals can be met through the use of a security audit tools that can provide thorough and repeatable process with an effective means of implementing corrective actions.

SAFEsuite(TM) - the comprehensive family of network security assessment tools designed to audit, monitor and respond to all aspects of your enterprise network security. Specifically designed to assess a variety of network devices, SAFEsuite tests for security vulnerabilities found and exploited in web sites, firewalls, operating systems and networked UNIX(R) and Windows NT(TM) hosts and workstations. It scans for the most comprehensive set of security vulnerabilities and provides you with the power and flexibility to assess all aspects of your network security policy. SAFEsuite also provides your system administrator with the added ability to monitor your networks in real time. With RealSecure, you can detect, alert and stop all unauthorized activity on your network.

Web Security Scanner tests the configuration of the Web server, evaluates the security of the underlying file system, searches for CGI scripts with known vulnerabilities and attempts to exploit custom CGI scripts.

Web Security Scanner traverses the HTML directory structure scanning for HTML links, Java, Java scripts and CGI links. Each link is followed in the HTML directory structure and any new links are added to the cached file. If the local link cannot be resolved it is noted for the user. Each subdirectory is checked to see if a GET request returns an index as expected or returns an entire directory listing. If the directory listing is returned, it is flagged as a vulnerability.

Web Security Scanner examines CGI scripts for the existence of the following potentially vulnerable executables: