Just as NASA would never rely on untested parachutes, you shouldn’t rely on untested network security. State-of-the-art technology or not, you should always vigorously test your security systems before approving them.
Your antivirus software, firewall and corporate policies are all that stands between you and an unregulated landscape of potential threats. These range from sophisticated spyware, Denial of Service Attacks (DoS) and data interception to accidental leakage from your own staff.
Yet, despite the increased threat and greater awareness of cyber security incidents, security budgets have decreased from 2013 and 54% of organisations still do not annually review the effectiveness of their security.
According to Systems Engineer at R & G Technologies, Ryan Tucker, many companies neglect network security testing. “Like insurance, network security testing is easy to overlook because the effects aren’t visible in day-to-day operations. You need to invest time and money into regular testing and this sometimes stretches the IT budget beyond what’s desired,” he says.
Many companies take a reactive approach to network security to cut costs. Instead of proactively testing for potential problems, they subdue them as they appear, wasting valuable resources on repairs and losing productivity due to downtime. What many businesses fail to realise is that testing reduces expenditure in the long term and pushes security to optimum performance.
Make network security testing a priority and keep your organisation out of reach of anyone who would try to do harm.
Read on to learn three ways you can test network security.
1. Download a virus test file to check your antivirus
As antivirus tools are designed and rigorously tested by security experts, many people assume it’s irrelevant to further test their performance. However, incorrect installations, configuration issues and/or obsolete versions could render the security software less effective. You need to regularly test your antivirus to confirm it’s protecting you from both common threats and new malicious files.
If you haven’t tested your antimalware, you won’t know if it’s been incorrectly installed or configured or even if it needs a critical software update until the attack is already upon you and the damage has been done.
Regular testing will highlight any of these potential issues. According to Kapersky’s 2013 study, up to 315,000 new malicious files appear daily, so it pays to stay updated. Use a virus test file to ensure your antivirus is up to speed and your organisation is truly guarded from nasty payloads.
How to test your antivirus
Downloading a virus test file allows you to test your antivirus in a simulated environment - without the risk. Visit the EICAR.org website and download a virus test file or use the test file included in your software package. The file at EICAR is free, harmless and - because it doesn’t contain viral code - won’t disrupt your systems or your office’s productivity. If your antivirus is working, it will treat the file as though it is infected. Ideally, you won’t be able to download it. However, some antimalware will allow you to download the file, but won’t allow you to interact with it in any way, shape or form.
If you are able to download and run the file, you know there is something wrong. Try reinstalling the antivirus product, revisiting your configuration settings and checking for updates. At this point, you may need to engage online support from your vendor’s technicians to ensure you’re maximising protection.
Learning from Xavier
Xavier, a client of R & G Technologies, is a not-for-profit organisation that specialises in supporting and empowering families with disabled children. Their organisation handles sensitive, confidential data, so we had to make it a priority to test their antivirus before deploying new systems.
The results of the test demonstrated the importance of testing before exposing your company to the public internet: We were able to download the infected EICAR test file because of an improper configuration setting that turned off the real-time protection.
Antivirus can either scan the hard drive for viruses at a point in time, completing scheduled sweeps on demand, or it can run in the background, monitoring the files you download as you try to download them. This real-time protection had been disabled, so the antivirus wasn’t checking new downloads for malicious content and Tucker was able to download the virus test file.
By taking a proactive approach to network security, you can identify security risks before there is a breach.
2. Use a vulnerability scanner to test your firewall
Your firewall is a critical component of a multi-layered approach to network security that sits behind your antivirus. Yet there’s a tendency for staff to obliviously poke holes in the company firewall to boost system performance - with half-hearted promises to fix it later.
As a result, firewalls are often littered with security holes and exploitable vulnerabilities.Regular testing helps you unearth these vulnerabilities and fix them before cybercriminals have a chance to take advantage of them. This means it’s not enough to merely implement a firewall and walk away. You must maintain, update and - most importantly - test them regularly.
Even hackers say IT security systems are a waste of time and money as long as security administrators fail to watch over their firewall. You must preside over it and use a vulnerability scanner to test what its weaknesses are. Vulnerability scanners are an indispensable part of protecting your organisation’s most valuable assets and assist you in keeping unwanted intruders away from your confidential information.
How to test your firewall
If you’re not a fan of ethical hacking, purchase a vulnerability scanner. This complete security package will shine a light on potential weaknesses in your firewall using the same methods hackers use to gain unauthorised access.
A vulnerability scanner defines and classifies security holes, forecasts the effectiveness of proposed countermeasures, automates patching and much more. An ideal scanner has an up-to-date database of known vulnerabilities, produces results without an excessive number of false positives and recommends countermeasures. When choosing a product, find a scanner that can grow with your organisation.
You can try Tenable Network Security’s Nessus. The paid software is easy to use, performs multiple scans concurrently, provides comprehensive reports and automates updates. A paid vulnerability scanner can be replicated with free software, but scans must be run from different places and organisations have to collect and interpret data themselves. This can be time intensive and makes frequent scanning unviable.
Regular scanning tests your network security with authenticity and ensures your systems are current. Employ a vulnerability scanner and you can rest easy knowing your security is airtight.
Let’s take a look at an example
We recently used a vulnerability scanner on one of our client’s networks, which discovered the server was directly exposed to the public internet. The demilitarised zone (DMZ) setting had been enabled by accident, forwarding the non-profit organisation’s files to a public address.
Because our client was running Remote Desktop and had a weak administrator password, the server was an easy target for hackers. With several exploitable services running, they were inviting information leakage, data theft and fraud.
With the help of a vulnerability scanner, our client was able to protect their organisation and create a safer environment for their clients.
3. Check folder permissions to stop data leakage
Over time, folder security can become so sloppy that no one bothers managing it anymore. The combination of staff turnover and undocumented changes to folder permissions make it impossible to govern access properly, leading to accidental or intentional data leakage.
Outdated and incorrect folder permissions are often overlooked as a serious problem. Yet in 2014, 27% of businesses lost sensitive data to internal IT threats, illustrating the import of managing security within and without.
Data leakage happens for a variety of reasons, including unenforced corporate policy, accidental sharing between staff members and deliberate theft or malicious behaviour from rogue employees.
Testing folder permissions can help reduce the impact insider threats have on an organisation’s wellbeing. This means more than just authorising and restricting access as the organisation shifts and grows. It means taking a proactive approach to network security and testing who has access to what and why.
How to stop data leakage
It only takes one innocuous staff member to rip a security hole across infinite amounts of company data, so it’s critical you test permissions on a regular basis. Talk to your employees and management and use built-in tools or third-party software to determine whether anyone has access to information they shouldn’t.
Check that employees aren’t using admin accounts when it’s not required, as these accounts have access to literally everything and a misstep in an admin account could cause company-wide damage.
Use built-in tools or third-party software to test folder permissions in one fell swoop. Organisations using Windows software can perform an audit using the Effective Permissions dialogue box, the iCacls command line too, and the Get-Acl PowerShell CommandLet.
Alternatively, third-party software like Datadvantage by Varonis unifies the functions of these tools and provides a comprehensive snapshot with less hassle. It shaves off the inefficiencies of conducting an extensive audit, simplifying the identification of excess permissions, the lockdown of sensitive content and more.
Folder security is often neglected because the greater threat is perceived to be outside your network. Regularly testing folder permissions enables complete organisational security from the inside out.
Let’s look at an example
We recently performed an audit of folder permissions for a client that revealed excessive permissions for all staff. This posed a big security risk.
According to Ryan Tucker, this isn’t an unusual occurrence.In fact, 43% of IT professionals admit they don’t educate employees on security policy well enough. Oftentimes, when executives or high-level staff are confronted with a Permission Denied message, the solution is to enable access everywhere, with plans to restructure later. If the staff member who shifted permissions leaves or the change is forgotten, organisations are left dangerously exposed to insider threats.
Regular testing helps you identify the forgotten chinks in your organisation’s armour, so they can be remediated quickly. The charity bolstered their network security by testing folder permissions, inviting a bright, unblemished future for those they’re charged to protect.
The value of testing network security
The era of mobility has opened up all sorts of challenges for network security in business. While it’s true that no amount of protection can make you invincible, testing allows you to see how your systems would hold up under a real-life attack.Challenging your security systems keeps your protection current and allows you to unearth potential weak spots. You’re able to stifle hazards before they can negatively impact your organisation’s health, fixing your gaze on the horizon instead of always having to watch your back.
Don't leave your network security untested. Contact us to learn how we can help you set up a network security testing schedule.