UK plc neglects basic VPN security

[InfoSec News <isn () c4i org>]

http://www.theregister.co.uk/content/55/30939.html

By John Leyden
Posted: 29/05/2003

Corporate UK is failing to configure and manage its firewalls and VPN
services properly. Just like more publicised Web server
vulnerabilities, issues with security software are frequently left
unaddressed - months after a problem comes to light.

The Fifth Annual NTA Monitor Security Audit found that risks present
on corporate firewalls tested by NTA have risen by almost a fifth (or
17 per cent) since 2000. The report [1] was published last month but a
breakdown [2] looking specifically at firewall/VPN problems, published
today, sheds fresh light on an important - but neglected - area of
security.

Almost a third (31 per cent) of companies tested by NTA Monitor as
part of its Regular Monitor security testing service during 2002 left
their networks wide open to attack by either installing firewall VPNs
in their default configuration or by failing to follow best practice
security principles.

NTA Monitor found that the most common errors related to basic
mistakes in firewall management and the configuration of VPN services,
the permitted VPNs to be located and profiled.

"It is a key security principle to keep your firewall and remote
connections hidden from unauthorised users - if a firewall can't be
detected then it can't be hacked," said Roy Hills, technical director,
NTA Monitor.

By polling the services offered on standard proprietary ports an
attacker can identify the type of firewall VPN installed and
occasionally the version number. Having identified the firewall, a
cracker can target it for known exploits or maintain a record of its
profile to run against new threats.

NTA Monitor advises corporates, where possible, to prevent
unauthorised access by keeping firewalls and remote connections hidden
to all but authorised IP addresses. It also recommends that corporates
avoid allowing access to sequential IP (predictable) address ranges.

Last September, NTA Monitor discovered a flaw in CheckPoint's VPN
implementation of IKE aggressive mode, enabling unlimited password
attempts against accounts for remote VPN clients.

In tests performed on corporate sites between the start of February
and May 20, NTA Monitor found the vuln present in 58 per cent of sites
using this software - more than six months after the flaw was widely
reported.

"This underlines the fact that corporates are failing to make best
practice configuration changes or to apply relevant security patches,"  
Hills concludes.

NTA Monitor has issued a Good Practice Guide to securing a
firewall/VPN which can be found here [3].

[1] http://www.nta-monitor.com/auditreport/
[2] http://www.nta-monitor.com/vpn/
[3] http://www.nta-monitor.com/vpn/good-practice.htm



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.