5

Why do simple things (SSL, RSA identification, salted and multi-crypted users passwords, script injections awareness, firewall...) that one rigorous mind usually setup when installing a web server are not sufficient security ?

What kind of hacks going beyond those simple securities do big compagnies face so much that they have to hire security experts teams ?

3
  • 10
    The fact that you had to use ellipsis (...) in your list shows that simple measures aren't really that simple. Mar 3 '16 at 17:19
  • 1
    It's not just settings things up once. Servers that are facing the internet are constantly threatened by attackers, because software is never 100% secure. Keeping the system up-to-date and secure is a difficult task.
    – John
    Mar 3 '16 at 17:24
  • @DeerHunter I agree. Had to re-read your comment though, because I thought you meant the rhetorical term.
    – John
    Mar 3 '16 at 17:26
8

I consider things like "script injections awareness" and "firewall" and also "..." as far from simple. And don't forget the bugs, backdoors, critical information leaks etc you regularly find in critical software or hardware like glibc, openssl, firewalls, VPN routers ... And of course there is way more than this if you have a complex infrastructure and applications from different sources which work together.

All these bugs in 3rd party software and hardware together with bugs in your own software make it possible to attack a server from several ways. If direct ways don't work against a host it can be done in an indirect way like attacking the router, firewall or the remote administrator. And once you passed the first protections you are often free to move around. Real security requires lots of knowledge and time, which in essence means lots of money. This includes monitoring log files, updating software but also keeping up to date with the newest information because often a problem is known by the hackers before an update even exists.

5

You've essentially answered this yourself - it's down to scale.

If you have one server, it's easy to ensure that it is locked down properly, and that the software developers haven't made any mistakes in their code.

If you have ten servers, it's still fairly easy, but in the event of a new zero-day vulnerability, that's 10 servers you need to test work with the patched version, then update. It's getting a bit harder.

If you have hundreds of servers, each running distinct applications, each developed by different teams (think of how many applications Google support, for example, but even smaller companies can easily reach a few dozen applications, if you take things like webmail, Sharepoint, business continuity portals, CRM applications, etc into account), all being updated and changed regularly, being pushed and pulled by business requirements, it makes sense to have someone else come and look at what might have gone wrong with that process!

2
  • 3
    Strictly speaking, it's not scale that requires more man-hours of work, but scope/heterogeneity. If the servers are homogeneous, automation helps greatly (ansible/puppet/etc.). Mar 3 '16 at 17:31
  • 1
    True - that's why I specified distinct applications!
    – Matthew
    Mar 3 '16 at 17:34
1

The bigger the site the bigger the reward for attackers.. the more motivation for attackers to specifically target your site and look for vulnerabilities particular to it.

For small sites, being patched and basic security practices are enough to protect you from the automated/script kiddie level attacks. These are looking for the lowest hanging fruit; There are enough sites running known vulnerable versions of joomla or Wordpress to keep them happy.

But if your "at scale" the details in your user database (emails, names, personal details) is enough to attract an intelligent determined attacker and so your defenses need to become more sophisticated to match.

1

The biggest information security risk that large companies face, that goes beyond technical defense, is human fallibility. Social engineering is often much easier, and more effective than trying to force entry to a network. Why try to hack into a network when you can simply call a staff member and ask for their password, for example. Small companies are somewhat less prone to this, because, a) they're usually a less desirable target, and b) it's easier to educate and monitor the activities of a smaller group. A great deal of information security effort goes into protecting employees from themselves.

All the security education in the world may not necessarily be sufficient to guard against innate human responses. Consider the following...

Mary, PA to the CEO of a very large company, gets a frantic call one evening just before leaving work...

"Hi Mary, This is Bill from IT. We're detecting some suspicious activity on the network, and we believe someone is trying to hack into Terry (CEO's) account. His computer is running version 3.6.4 of Anti-Hacker XYZ, and we need to upgrade it urgently to 3.6.5. I'm off-site, so I can't do it. Can I send you an email with the required patch, and get you to run it?"

Now Mary doesn't know Bill, but why would she, there are 50 people in the IT team. She doesn't know them all. He's calling from an unknown mobile, but again, that's not uncommon. She knows she's not supposed to open unknown attachments, but this isn't unknown, because she got that call.

A very contrived example, but potentially, with nothing more than information readily available on the company website, a hacker has convinced the CEO's PA to install a Trojan onto the CEO's computer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.