For TechRepublic, I'm Bob Artner. We want to talk todayabout backdoor or second-generation security attacks. To illustrate my point,I've drawn the world's most simplified security outline. Here we go. On the onehand, we've got the bad guys. On the other hand, we've got the corporatejewels. What are they trying to get after? Usually your company Web site, yourcompany e-mail server, and by extension the rest of the storage on the network.So, you know what happens, they come after you right away, right in your face.Deny service attacks into the company Web site, try to overwhelm your e-mailservers with volume and with viruses.
So what do you do? You respond as a security professional byputting firewalls, increasing firewalls, adding authentication into the companyWeb sites, having corporate anti-virus screening at the server level, and yousay to yourself, "My problems are over. Everything is perfect." Well,it's not like that. What happens now? Your backdoor attacks. Bad guys, they'renot stupid, whether they were, they recognize the security is stronger here, sothey come in and they look at end users, and then they look at your vendors.They say, "You know what, we can't get in through here perhaps, but endusers connect to company e-mail servers through VPNs, or through dialogue, sowe'll go and attack here. We'll try to get a vulnerability here because theymight not even have a firewall at their house, or their apartment, or if theydo it's probably pretty weak, or it's got a standard 'change me' as the defaultfirewall password." Or they'll go and will try to get a vulnerability at avendor site who's connected to you through the Xtranet, and then they get intoyour corporation that way.
So, what you have to say to yourself as a network securityprofessional is, you know this stuff is important. It's necessary, but it's notsufficient. I've got to go now and secure the weakest links in my securitychain and close down the back door.
