|
|
|
|
| Read more articles on: |
|
|
 |
|
NEW DELHI: A recent study conducted by the SANS Institute and government representatives from the United States and the United Kingdom has revealed significant change in the pattern of online security attacks. While earlier the main targets were operating systems and e-mail servers the focus is seen to be shifting to software applications. Said an online report.
At a press conference in London, the SANS Institute and government representatives from the United States and the United Kingdom plan to release a report on the 20 most critical Internet security vulnerabilities for 2005. Said the report.
For the first time the security institute has introduced a separate category for cross-platform applications to capture this change in trend.
The applications under attack include enterprise backup software, anti-virus software, PHP applications, database software, peer-to-peer file sharing software, DNS software, media player software, IM software, and Internet browsers, said the report.
Vulnerabilities in network operating systems that empower routers and switches on the Internet such as Cisco’s Internetwork Operating System (IOS), are also under threat, reflects the report.
According to Alan Paller, director of research for the SANS Institute, this change in trend has pushed the Internet security back by almost six years. Quoting him, "Six years ago, attackers targeted operating systems and the operating system vendors didn't do automated patching. In the intervening years, automated patching protected everyone from government to grandma. Now the attackers are targeting popular applications, and the vendors of those applications do not do automated patching."
Automating patching is not the ultimate solution says Ira Winkler, author of "Spies Among Us" and global security strategist with CSC Consulting. According to a study conducted by Department of Defense, 70% of attacks are against configurations, poor system hardening, where patching plays can play no role at all, added Ira.
Another area of concern is backed-up data, any vulnerability in the backup software can give an attacker full access to the critical corporate data.
To read about the Twenty Most Critical Internet Security Vulnerabilities, click here.
|