Feeds

UK VPN security is outstandingly mediocre

BOFHs struggle with TLAs

Beginner's guide to SSL certificates

The security of corporate remote access setups has slipped over the last 12 months, according to security audits by penetration testing firm NTA Monitor.

NTA's VPN Security Report 2007 shows that IT organisations have a third fewer vulnerabilities per test than cropped up in the equivalent study last year. But organisations in other sectors (such as government and finance) are running even more insecure set-ups.

"Although the IT sector has clearly improved its security over the past year, that's not the case for everyone. On average, nine vulnerabilities were found per VPN test performed in last year's report; that figure has risen to 11 in this year's report," explained Roy Hills, technical director and founder of NTA Monitor. "Seventy-three per cent of tests also discovered at least one medium level flaw, indicating that external users may be able to disrupt services or potentially obtain unauthorised access."

The majority of vulnerabilities uncovered by NTA Monitor (65 per cent) in all the tests were rated as low-risk, generally involving the leakage of information that could be valuable to attackers. Medium risk flaws - more serious risks that create a potential means for external attackers to disrupt a VPN service or gain unauthorised access to corporate networks - made up 16 per cent of the flaws identified. The remaining 18 per cent of vulnerabilities uncovered were considered informational, highlighting issues such as poor housekeeping.

NTA recommends operating VPN connections through a dedicated VPN system rather than a firewall, improving encryption and authentication methods and undertaking regular independent security testing (as well it might). ®

Intelligent flash storage arrays

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.