Importance of internal network security
Internal network security is very often underestimated by its administrators. In fact, in certain environments such security does not even exist, allowing one user to easily access another user's computer using well-known exploits, trust relationships and default settings. Most of these attacks require little or no skill, putting the integrity of a network at stake.
Due to the amount of flexibility needed for normal operation, internal networks cannot afford maximum security. On the other hand, with no security at all, internal users can be a major threat to many corporate internal networks.
According to the CERT Co-ordination Centre at Carnegie Mellon University in the US:
"An `insider intrusion' is any compromise of a network, system or database that is committed by someone who has (or used to have) legitimate access to the network, system or data. Such `insiders' can include current and former employees, part-time employees, business partners, consultants and contractors." - Computer Weekly.
A user within the company already has access to many internal resources without needing to bypass firewalls or other security mechanisms. In fact, these security measures are generally used to prevent non-trusted external sources, such as Internet users, from accessing the internal network. However, most threats come from internal users. An internal user, equipped with hacking skills, can successfully penetrate and achieve administrative network rights while ensuring that their abuse is hard to identify or even detect. The Computer Crime and Security Survey compiled in 2003 by the Computer Security Institute and the FBI discovered that approximately 65% of respondents reported at least one security incident involving an insider.
Poor network security may also allow malicious users that break into a network system to access the rest of the internal network more easily. This would enable a sophisticated attacker to read and possibly leak confidential emails and documents, delete data and damage computers - leading to loss of important information and more. Spiteful intruders may also use your network and network resources to turn around and attack (or spy!) other sites (i.e. attack relaying). In this way, all evidence of the attack will lead back to you and your company, without exposing the hacker's own identity.
Most vulnerabilities can be easily patched and attacks against known exploits can be easily stopped by administrators if they get to know about them in time. GFI LANguard N.S.S. assists administrators in the identification of these vulnerabilities!
