Formerly with the National Security Agency and Secret Service, Gartner Inc. vice president John Pescatore has the perspective and experience to comment on just about everything related to IT security. In this interview, conducted during the Gartner IT Security Summit, Pescatore lends his two cents on security spending, trends, cyberterrorism, government's role in security and what enterprises need to do safely stay afloat.

What should the enterprise take away from the talk about cyberterrorism?

Pescatore: Terrorism is a real threat. We're going to get hit again. I worked for the Secret Service years ago, and the biggest thing we used to worry about was the Radio Shack criminal, the one who gets his technology at Radio Shack. You cannot plan for al Qaeda-type events. You have to protect against the most likely type of threat and hope they go bother somebody else.

As far as what the typical enterprise should do, there's a lot of simple things you need to make sure you're doing right.

Everyone has antiviral and firewalls, but how often do you update antivirus signatures? How often do you test if your firewall policy is what it should be? No. 1 thing, the way any cyberattack works, the bad guys check for vulnerabilities and then they attack. You need to check for vulnerabilities before the bad guys. If hackers are rattling your doorknobs, if they're open, the hacker is going to come in. You should rattle your doorknobs first, [do] more frequent vulnerability assessments to block those attacks. Doesn't matter if it's a terrorist, pimply faced 14-year-old or a cybercriminal trying to steal credit card numbers or medical records, they're all going to come in the same way.

Sixty-five percent of attacks exploit misconfigured systems, and only 30% exploit known vulnerabilities where there's a patch out. Only 5% exploit things we didn't know where there was a problem. Address the 65% and check that things are configured right and you've just eliminated two-thirds of your problem. Focus on patch management and forcing software vendors to write better software and you've got the other 30% taken care of. Then, later on, worry about the 5% of evil geniuses who are attacking us with zero-day attacks.

[ Read more ]