BBS水木清华站∶精华区

发信人: lucid (透明～如果我是完全透明的，那请将我忽略), 信区: CompExpress
标  题: Many hacks are inside jobs
发信站: BBS 水木清华站 (Mon Dec 22 06:09:13 1997)

Many hacks are inside jobs
By Maria Seminerio
December 20, 1997 1:42 PM PST
ZDNN
Many site producers may be working overtime to guard against the
possibility of a security breach that's relatively remote, while
other, more pressing contingencies -- such as the threat from
disgruntled workers -- are left unanticipated, according to some
security experts and hackers themselves.

However, other experts warn that the Internet has opened up
opportunities for resourceful hackers that never existed before.

"The advent of the Internet has resulted in many attacks by external
attackers, versus internal ones," said Stephen Kent, chief scientist
in the information security unit of GTE Internetworking. "The
internal attacks may tend to be more financially motivated, but no
site on the Internet is safe from probing by potentially malicious
outsiders."

New sites are often probed for operating system or protocol
vulnerabilities within their first few days of existence, Kent
maintained. Sometimes site managers aren't even aware the attacks
are taking place, he said.

Businesses that traffic in sensitive, proprietary intellectual
property, such as advertising companies and cosmetics makers, are
among the most likely targets for hackers, said Patrick Taylor,
director of product marketing for Internet Security Systems, a
security consulting company in Atlanta.

"If you're in a business that's worth being in, there's someone out
there who will find your information valuable," Taylor said.

This is a lesson that more and more corporations are learning,
although the overall likelihood that business Web sites will suffer
security breaches is much lower than the likelihood of it happening
on government-run sites, the NCSA's Gordon said.

So far this year, 88 percent of the U.S. Department of Defense's Web
sites have suffered some form of break-in, compared with a
percentage for corporate sites that hovers around 45 percent, he
said.

While 45 percent sounds alarmingly high, consider the fact that by
many estimates, the majority of those breaches are perpetrated by
individuals inside the organizations with an automatic advantage --
not by outside hackers out for random mischief.

"Although attacks by outside hackers -- people who illegally access
electronic systems to obtain secret information or steal money --
generally receive more publicity, insiders pose a far greater threat
to computer security," according to The Lipman Report, a monthly
management newsletter published by security consulting firm
Guardsmark Inc.

A 1996 survey of 1,300 U.S. companies by business consultants Ernst
& Young found that a third had reported attacks on their networks by
company insiders, while just 17 percent experienced attacks from
outsiders.

While there is a lot of hype surrounding security issues, there are
also real problems that need to be addressed, particularly for
commerce sites, many experts said.

"I'm sure a lot happens that we just don't hear about," said Erica
Rugullies, an electronic-commerce analyst at Giga Information Group
in Cambridge, Mass. "I think it's realistic for merchants to be
concerned."

Perhaps the first step is making sure that all firewalls and other
security tools are in place and working correctly, the NCSA's Gordon
said.

"There haven't been any reported cases where proper security
measures were employed where there has been a security breach on a
major E-commerce site," Gordon said.

But, Gordon and other security experts warn, there can always be a
first time. Self-described hacker Active Matrix, who noted that
hackers love nothing better than a challenge, agreed.

"No system is totally secure, and there will always be the true
hacker who hacks simply for the challenge to go in and out, quietly
and smoothly," Active Matrix said.

--
※ 来源:·BBS 水木清华站 bbs.net.tsinghua.edu.cn·[FROM: 202.99.63.32]