News
US Department of Homeland Security pen-test survey highlights need for IT security safety net says Idappcom
June 2011 by Marc Jacob
News that the US Department of Homeland Security has identified the weak link in IT security is the human element comes as no surprise to Idappcom, the data traffic analysis and security specialist.
According to Ray Bryant, the firm’s CEO, after DOHS staff quietly dropped data disks and USB sticks in the car parks of government agency and allied company buildings, they found 60 per cent of them were inserted into the company/agency’s computer systems.
"What’s even more ironic is that if the disk case had an official logo, then the `success rate’ soared to 90 per cent, something that the DOHS notes as proving there is no device known to mankind that prevents people from being idiots," he said.
"This observation - the proof of anecdotal evidence if you will - has ramifications in all aspects of IT security, and especially, I believe, when it comes to network security, as it also shows you cannot rely on staff installing IT security systems properly," he added.
Bryant went on to say that, whilst many IT security professionals do install their IPS, IDS, UTM and firewall systems effectively, as well as configuring them correctly, there is a sizeable minority who do not, largely due to a lack of effective training.
And then the question becomes - how do you spot these incorrectly configured systems, whose insecurity tends to get worse as time goes by, often owing to patches and updates not `taking’ as they should - another symptom, says the Idappcom CEO, of poor configuration.
The answer, he explains, is automated and effective auditing of the security appliance and allied systems, which then assists the IT security management about which areas of network/IT system security need tightening up on.
Automated pen testing and auditing systems cannot even hope to correct for the human failings identified in the US DOHS survey, but, says Bryant, that can compensate by acting as a real-world check on the efficiency of a given IT security system, quickly and efficiently identifying the areas where security needs to enhanced.
The fact that the test subjects were `infected’ with an ET-call-home app - which could have been a trojan or similar piece of malware – clearly proves the case that human operatives make errors.
"IT systems, however - when properly configured - do not normally make such errors, so applying a safety net of IT security audit layer such as our TrafficIQ technology, makes a lot of sense," he said.
"TrafficIQ won’t stop human error creeping into even the most effective of IT security departments, but it will help management compensate for configuration and similar consequential problems. To err is human, but to fail to compensate for those errors is an unnecessary risk," he added.
