Security

Enterprise Penetration and Vulnerability

Why is Windows NT impossible to secure from hackers? Why should you not use a dictionary word as a password?

by / February 3, 2005 0
Why is Windows NT impossible to secure from hackers? Why should you not use a dictionary word as a password?

Rex Nelson of Northrop Grumman led GTC attendees down the rabbit hole yesterday, showing them a hacker's eye view of Web sites, systems and vulnerabilities.

The economic impact of preventing such attacks is staggering, with an estimated $1.6 trillion just to secure North American networks alone in 2003. Even so, 96 percent of all our incidents could be prevented by patching systems as new vulnerabilities are found, he said.

Microsoft installed a back door in Windows NT, explained Nelson, and when word leaked out, it became a favorite target. Another favorite target of hackers are default installs, such as IIS 4.0 which can even be found with a search engine such as Google. Simple passwords are easy to guess or crack with an online tool.

Nelson presented a number of resources for those wanting to learn more, such as the Executive Summary of The National Strategy to Secure Cyberspace, which resulted in part from former President Clinton's interest in security matters.

Nelson said that some vulnerabilities are so obvious that hackers can find misconfigured systems, MasterCard numbers, etc., by a simple Google search. On arin.net you can find your organization, and all the IP addresses that are assigned to it. Hacker tools such as scanners are available online as well. And if you receive a game like "Elf Bowling" or "Whackamole" resist the temptation to open it -- they are often attached to malicious code.

Security is not a one-time fix, said Nelson, but has its own life cycle, and one of the key features for any agency is education and training of staff. And virus protection should be routine now, it is essential, and must be updated as new viruses are identified.
Wayne Hanson

Wayne E. Hanson served as a writer and editor with e.Republic from 1989 to 2013, having worked for several business units including Government Technology magazine, the Center for Digital Government, Governing, and Digital Communities. Hanson was a juror from 1999 to 2004 with the Stockholm Challenge and Global Junior Challenge competitions in information technology and education.