CyberSight: Security

Fact Attack

A few facts about security:

Firewalls are vulnerable to tunnelling techniques. ACK Tunnelling can render a firewall useless. Firewalls can be switched off and the administration console "spoofed" to show they are still functioning. Independent security laboratories have indicated that firewalls have only a few years before they are obsolete.

Many security products use "MD5 hashing" techniques to identify threats; this uses a mathematical formula to calculate a "hash key" for each known threat. Hashing is highly accurate but this is its downfall; the threat author only needs to change 1 bit or 1 byte of code to render the threat invisible. Threat authors now write self-modifying code. This makes the threat invisible to detection systems until it has been re-discovered and re-indexed.

User abuse is probably a greater threat to security than "hacking". Most security products do not provide adequate protection from internal threats.

Existing security technologies have a significant impact on system performance. AV products can typically produce a tenfold downturn in performance. Firewalls often remove essential functionality completely. The more security you implement the slower the systems and the more restricted the functionality.

Most security systems work by comparing files on the system with a "threat" list supplied by their provider; this list is substantial and growing rapidly; many products are unable to support all threats without impacting further on performance.

Many security systems including those that "sniff" network traffic can only detect a threat when it is active; a little late in the day.

Blocking and filtering systems provide arbitrary security based upon the known.

Existing security cannot detect unknown devices that may pose a threat - Laptops, PDAs, Wireless Hacking, USB storage and other "Plug & Play" devices.

The new generation of STAT tools (Cryptic terminology for Strategic Targeted Attack Tools), render security tools like IDS useless by bombarding them with known threat signatures. The console becomes unusable and the real threat passes without detection. The STIK threat, where up to 450 threats per second are targeted at the system, is a good (or bad) example.

No system can be 100% secure; regardless of security measures implemented. Appreciating and understanding that one is still vulnerable is critical, if you think you aren't vulnerable then you probably are - complacency is security's greatest enemy and the attacker's friend.

We believe we offer a technically efficient and highly functional approach to reducing the risk; which is after all what security is all about.