Feeds

UK plc neglects basic VPN security

Royaume-Uni - nul point

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

Corporate UK is failing to configure and manage its firewalls and VPN services properly. Just like more publicised Web server vulnerabilities, issues with security software are frequently left unaddressed - months after a problem comes to light.

The Fifth Annual NTA Monitor Security Audit found that risks present on corporate firewalls tested by NTA have risen by almost a fifth (or 17 per cent) since 2000. The report was published last month but a breakdown looking specifically at firewall/VPN problems, published today, sheds fresh light on an important - but neglected - area of security.

Almost a third (31 per cent) of companies tested by NTA Monitor as part of its Regular Monitor security testing service during 2002 left their networks wide open to attack by either installing firewall VPNs in their default configuration or by failing to follow best practice security principles.

NTA Monitor found that the most common errors related to basic mistakes in firewall management and the configuration of VPN services, the permitted VPNs to be located and profiled.

"It is a key security principle to keep your firewall and remote connections hidden from unauthorised users - if a firewall can't be detected then it can't be hacked," said Roy Hills, technical director, NTA Monitor.

By polling the services offered on standard proprietary ports an attacker can identify the type of firewall VPN installed and occasionally the version number. Having identified the firewall, a cracker can target it for known exploits or maintain a record of its profile to run against new threats.

NTA Monitor advises corporates, where possible, to prevent unauthorised access by keeping firewalls and remote connections hidden to all but authorised IP addresses. It also recommends that corporates avoid allowing access to sequential IP (predictable) address ranges.

Last September, NTA Monitor discovered a flaw in CheckPoint's VPN implementation of IKE aggressive mode, enabling unlimited password attempts against accounts for remote VPN clients.

In tests performed on corporate sites between the start of February and May 20, NTA Monitor found the vuln present in 58 per cent of sites using this software - more than six months after the flaw was widely reported.

"This underlines the fact that corporates are failing to make best practice configuration changes or to apply relevant security patches," Hills concludes.

NTA Monitor has issued a Good Practice Guide to securing a firewall/VPN which can be found here. ®

Related Stories

UK.biz getting on top of serious security risks
UK e-commerce sites: Top 10 flaws
Password guessing games with Check Point firewall

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.