Why Corporate Networks Are Vulnerable.<br>The Results of Kaspersky Lab’s Study on Common IT Security Policy Mistakes
Kaspersky Lab, a leading developer of secure content and threat management solutions, presents the results of a study conducted by its Global Emergency Response Team – a consulting service for the company’s corporate users. The data that was garnered while serving corporate customers highlights the main IT security policy mistakes that can put an organization at risk.
Commenting on the study, Alexey Polyakov, head of the Global Emergency Response Team at Kaspersky Lab, said: “In the past, our corporate support team received complaints unrelated to product functionality. For example, some customers complained that our products could not remove all the viruses from a network. After some quick analysis we discovered that the products did in fact successfully detect and remove malware, but this malware kept coming back – over and over again. So over the last 12 months, by actively engaging with our corporate users we have noticed that the majority of virus-related incidents occur due to underestimated design issues or unnoticed weaknesses in corporate security policies.”
Why Your Corporate Network May Be Vulnerable
The biggest mistake is to ignore network share access rights – responsible for 35% of incidents. In such a case there might be open sharing with access rights configured as “full access” to everyone on an internal file server or end-user work desktop, e.g., a shared public document workspace where all documents are stored. Sooner or later this can become a prominent source of malware redistribution throughout the organization.
Modern malware takes advantage of existing vulnerabilities. A network with just a single missing patch can be put at serious risk. And this is a common issue seen mostly in small to medium organizations with end-users numbering less than 500. These organizations either do not have enough expertise or ignore patching completely. This mistake is responsible for 25% of incidents.
Use of multiple vendor antimalware solutions (15% of incidents) may lead to a situation where it is hard to mitigate malware attacks. This may occur if one of the vendors does not respond fast enough to attacks. Delays in responses may run to days, weeks or even months. During this time the solution of another vendor would detect and remove malware, but only in its part of the network – and malware would attack it from the unprotected side. Alexey Polyakov concluded: “From our experience we see that security admin spends a lot of time working with multiple vendors’ support services in finding and fixing a problem.”
A partially protected environment (15% of incidents) is where an antimalware solution is installed on part of the network, leaving other resources unprotected.
Firmware vulnerability (5% of incidents) may be exploited by attackers if security admin forgets to monitor hardware devices, such as routers, firewalls and other network appliances, to see if they need patching.
And another relatively infrequent mistake (also 5% of incidents) is to believe that software downloaded from the Web is always perfectly sound software.
How to deal with these mistakes and what to remember when designing a corporate IT security policy you can find out about in Alexey Polyakov’s presentation entitled “Corporate Incidents: Lessons Learned. Common and Avoidable Security Policy Mistakes for IT Management”. He gave the presentation in June at the Kaspersky Lab International Technology Press Tour in Malaga, Spain. It can be viewed here in PDF format.
About the Global Emergency Response Team (GERT)
GERT is a new consulting service for Kaspersky Lab’s corporate users. The objective of the service is to help corporate customers identify and mitigate security policy mistakes and malware related outbreaks, perform forensic analysis, and provide security policy consulting. GERT is a globally distributed team. There are two major locations: Moscow, Russian Federation, and Seattle, USA.
