Over the last ten years, major changes have occurred in IT. With the Internet driving the pace, one of the most significant developments has been the rise of IP to become the dominant protocol. Another key element has been the decentralisation of systems, with the perimeters of organisations rapidly disappearing. Anywhere, anytime, anyhow access is now becoming increasingly achievable.
This 'deperimeterisation' of the network has significantly changed the security landscape. Organisations now need to move from a reliance on powerful gateway security to a recognition that applications, departments and network segments need their own security. While this challenge has been recognised and addressed by many businesses, one key area has been largely overlooked - that of machine-to-machine connections (M2M). M2M connections are endemic and can range from all the complex communications within a modern aeroplane, through to internal Microsoft servers talking to each other.
In manufacturing, all processes are increasingly linked automatically. Lathes, for example, are driven by production scheduling systems and robots are managed by manufacturing systems. In the pharmaceutical industry, production processes are very closely monitored to ensure legal compliance with FDA and other regulations. In finance, automated linked processes are subject to close regulation; and ATMs communicate directly with their core corporate systems. In the average organisation, servers talk to other servers all the time without manual intervention.
While these linkages provide major cost benefits, most of these internal appliances are not given the same level of security as outward facing systems. They typically rely on gateway systems for firewall and anti-virus protection. This was more than adequate in the past but not any longer, as has become increasingly clear to the many organisations who have had to build patch scheduling (or rush patching) into their timetables.
Unsecured IP connected devices are potentially vulnerable to a range of problems such as network viruses, trojans and hacking. If you have access to a network, it's easy to find network connected IP addresses and, in the case of servers, to exploit current patch failures. A whole range of devices are at risk. Security cameras, for example, can be a problem. A recent report on 'The Register' described how a couple of simple web searches threw up over a thousand unprotected surveillance cameras. These cameras were not only viewable, but also remotely manageable by any external party with a mind to do so.
Other areas at risk include VoIP servers and VoIP devices. Digital telephone switches can also be a problem. The list of 'machines' with a potential security risk is long and includes wireless devices, video conferencing systems, data centre monitoring equipment, internal security cameras, webcams, POS devices and ATM devices. Even routers and switches are potentially vulnerable.
If the security of machinery connected to an IP network is compromised, the cost can be very expensive. Real life examples include a company where production was lost for days when robots on an IP network became infected. A pharmaceutical company had to take its systems down for two weeks, to recalibrate them to comply with Food and Drugs Administration (FDA) regulations, after needing to install urgent patches. Another organisation had company data compromised and lost because an internal server was hacked.
Other pages: : 1 * 2 * Next>>
|
You are here: hacking technology
> hacker course
> Content
Category: Home
> hacker course