Feeds

Gummint security is utterly hopeless

Auditor strolls through West Oz networks

3 Big data security analytics techniques

In the kind of report that really spoils your day, Western Australia’s Auditor-General has presented the findings of a study into that state’s government network security. The finding? Fourteen out of the 15 agencies subjected to “hostile scans” of their networks failed to notice anything amiss.

The Auditor-General also went further, penetration-testing three agency networks using known vulnerabilities. All three failed to detect the intrusion, the report says.

And when the agency left USB keys lying around in department offices, curiousity beat caution most of the time. “Eight agencies plugged in and activated [the] USBs,” the report said, which “sent information back to us via the Internet”.

The report also questions the value of consultants’ penetration testing. Nearly all agencies had conducted recent penetration tests, with some scheduling repeat tests four times a year, yet the Auditor-General’s office was able to use known vulnerabilities to attack or penetrate their networks.

In a curious snippet, the report also highlights the value of price-benchmarking for external services: some agencies could get their useless pen-tests for as little as A$9,000, while for others, the price tag was A$75,000.

The Auditor-General, Colin Murphy, said: “The failure of most agencies to detect our attacks was a particular concern given that the tools and methods we used in our tests were not sophisticated.”

The report also identified inadequate risk assessment in agencies. As a result, 12 out of the 15 agencies had not recognized threats either from the Internet or from social engineering; nine agencies had conducted no risk assessment; and seven agencies had neither a response plan nor “procedures for managing cyber threats”.

The penetration tests were conducted by researchers from Edith Cowan University, who were not briefed on the networks they were attacking before-hand. In the two-stage pen-tests, an initial scan identified vulnerabilities, and only those vulnerabilities revealed by the scan could be used to launch an attack.

In one case, the report notes, the test included a brute-force attack on a Web server that generated several million attempts to gain access, and degraded the server’s performance – without being noticed by the server’s owner.

“All of the agency Web servers allowed technical information to be collected, and poorly configured firewalls and IDPs failed to prevent this information being returned to the source of our scan,” the report notes. “This information included operating system and version, the type of firewall in use, and what software was running.”

Meanwhile, in the three agencies for which the testers were given permission to launch a full intrusion, attackers were able to obtain administrative usernames and passwords and copy files.

The full report is available here. ®

3 Big data security analytics techniques

More from The Register

next story
Virgin Media so, so SORRY for turning spam fire-hose on its punters
Hundreds of emails flood inboxes thanks to gaffe
A black box for your SUITCASE: Now your lost luggage can phone home – quite literally
Breakfast in London, lunch in NYC, and your clothes in Peru
AT&T dangles gigabit broadband plans over 100 US cities
So soon after a mulled Google Fiber expansion, fancy that
AT&T threatens to pull out of FCC wireless auctions over purchase limits
Company wants ability to buy more spectrum space in auction
Google looks to LTE and Wi-Fi to help it lube YouTube tubes
Bandwidth hogger needs tube embiggenment if it's to succeed
Turnbull gave NBN Co NO RULES to plan blackspot upgrades
NBN Co faces huge future Telstra bills and reduces fibre footprint
NBN Co plans fibre-to-the-basement blitz to beat cherry-pickers
Heading off at the pass operation given same priority as blackspot fixing
NBN Co in 'broadband kit we tested worked' STUNNER
Announcement of VDSL trial is not proof of concept for fibre-to-the-node
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.