I'm still shocked at how little some admins know about their own networks. I often advise clients on the recon steps we take and suggest they do the same. For example, I've often been on sites that have clear and defined "no wifi" policies, but yet, during wireless LAN surveys paired with ARP discovery, we often find they indeed have wireless access points all over the place, and worse yet, nobody seemed to know it. I'll often see old Unix servers still connected to the network and not documented anywhere. It usually turns out these servers haven't been used (or patched) for years. Just nobody bothered to unplug them or disconnect them from the LAN. Why? How can one possibly secure something if they don't know it's there? How can a security guard physically secure a building if said building has 10 doors and he only knows about 5 of them?
Keatron
Keatron Evans is a senior penetration tester and principal of Blink Digital Security, based in Chicago. He has more than 11 years experience doing penetration tests, vulnerability assesments and forensics. Keatron regularly consults with and sometimes trains government entities and corporations in the areas of network penetration, SCADA security, and other related national infrastructure security topics. He holds several information security certifications including CISSP, CSSA, CEH, CHFI, LPT, CCSP, MCSE:Security, MCT, Security+, and others. When not doing penetration tests, you can find Keatron teaching ethical hacking and forensics classes worldwide.
We are giving away 15 copies of Keatron's book Chained Exploits: Advanced Hacking Attacks, which will be published in February. Go here for entry details.
The Leader in Network Knowledge
Nobody likes to document
Nobody likes to document anything. It's a pain and leads to more pains.
Really?
I understand that, but documentation today is not what it was 10 years ago. The concept of automating documentation has come a long way. With all of the cheap and even free tools that give us acceptable levels of documentation, there's really not much of an excuse for not doing it. There's a slew of LAN surveying and LAN analyzing tools available. While documentation can be a pain, it is also a pain to recover from having security compromised that was enabled by an undocumented and unpatched node.
Security is a process, a mantra, and a way of thinking. A key part of any solid security program and process is documentation. Those who refuse to do it are going to have a bumpy ride over the next few years. One of the first things attackers look for when checking a target network for vulnerabilities is unpatched nodes. Nodes that go undocumented have a much higher chance of going unpatched. Those that go unpatched are usually a SURE and easy entry point.
Post new comment