Do firewalls and IDS create a false sense of internal security?

Friday, 30 August 2002, 2:04 AM EST

Intranet security gaps are most commonly a result of a combination of firewall and IDS limitations, poor application development and deployment practices, and widespread accessibility. Network devices such as firewalls and IDSes offer little or no protection at the application layer. They are unable to verify requests made through ports 80 or 443, which are kept open for HTML and HTTP communications.

More critical, however, is the lack of management oversight and safeguards. In many cases, intranet applications are developed by outsourced contractors (or even employees). While they may know HTML well, they are likely to have minimal knowledge of corporate security practices. This lack of knowledge is compounded by a lack of information about web security imperatives. As a result, developers will often trust users interacting with the application, fail to religiously validate input streams, encrypt passwords, enforce user access rights or control database access and retrieval.

[ Read more ]




Spotlight

Operation Pawn Storm: Varied targets and attack vectors, next-level spear-phishing tactics

Posted on 23 October 2014.  |  Targets of the spear phishing emails included staff at the Ministry of Defense in France, in the Vatican Embassy in Iraq, military officials from a number of countries, and more.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Oct 24th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //