The Enemy Within The Firewall


I’ve seen similar figures from other organisations and countries, so the stats don’t surprise me.

My peers and I have always called this Armadillo security, hard on the outside, soft on the inside.

Firewall, IDS, etc…all protecting the exterior of the network, only edge devices, nothing inside, not much policies, not much privilege segregation, anyone inside can wreak havoc.

Employees are now regarded as a greater danger to workplace cyber security than the gangs of hackers and virus writers launching targeted attacks from outside the firewall.

That is the perception of 75 per cent of Australian information technology managers who took part in an international IBM security survey.

Also e-mail and instant messaging is becoming increasingly pervasive, with the advent of things like Google Talk capabilities in the GMail interface, sending information outside the protective layer of the company is getting easier and easier.

From my professional experience, I do know some companies have extremely strict standards which are audited regularly (these include rules about removable media, BIOS passwords and OS hardening standards).

While 32 per cent of survey respondents were intent on upgrading firewalls, only 15 per cent planned to invest in awareness and education training for employees and only 10 per cent restricted the use of mobile devices such as wireless handheld computers not specifically sanctioned by the IT staff.

“Organisations need to understand what are the key pieces of information that need to be protected and be able to track who has had access to them,” she said.

Sounds normal, good intent, but no action. Time for companies to sort themselves out I think.

A recent security report from antivirus company Symantec said cybercrime represented today’s greatest threat to consumers’ digital lifestyle and to online businesses in general.

“While past attacks were designed to destroy data, today’s attacks are increasingly designed to silently steal data for profit without doing noticeable damage that would alert a user to its presence,” the company said.

Source: The Age

Posted in: Social Engineering

, , ,


Latest Posts:


GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.
Fuzzilli - JavaScript Engine Fuzzing Library Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.


Comments are closed.