Do firewalls and IDS create a false sense of internal security?

Friday, 30 August 2002, 2:04 AM EST

Intranet security gaps are most commonly a result of a combination of firewall and IDS limitations, poor application development and deployment practices, and widespread accessibility. Network devices such as firewalls and IDSes offer little or no protection at the application layer. They are unable to verify requests made through ports 80 or 443, which are kept open for HTML and HTTP communications.

More critical, however, is the lack of management oversight and safeguards. In many cases, intranet applications are developed by outsourced contractors (or even employees). While they may know HTML well, they are likely to have minimal knowledge of corporate security practices. This lack of knowledge is compounded by a lack of information about web security imperatives. As a result, developers will often trust users interacting with the application, fail to religiously validate input streams, encrypt passwords, enforce user access rights or control database access and retrieval.

[ Read more ]




Spotlight

Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Thu, Feb 4th
    COPYRIGHT 1998-2016 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //