Old hacking tricks still do the trick...

Recently Trustwave released it's Global Security Report 2010.

“In 2009, the most notable trend is the continued use of existing attack techniques despite the security industry’s awareness of these vulnerabilities.”

These findings are alarming and at the same time understandable. Let's take the average time between an initial breach and its detection. It was 156 days according to the paper. In some cases, the lapse was close to two years(!). The reason is obvious as we devote our attention to countering the latest vulnerabilities and are focussing on new issues such as social networking and cloud computing, we tend to oversee what is already there. And even if we do, knowledge of heritage systems is often not well documented, or unavailable at all because of restructuring, outsourcing or other cost cutting measures whose unwanted side effects always show up long after the deed was done.

This tells us once more, that we need to assess our complete it infrastructure and it's risks regularly and to remain vigilant. Most important however, information security should be part of basic enterprise policies, which message has to be heard and understood by top executives.

We have moved into an era where information security is key to all business functions, but some of the issues we talked about a dozen years ago we are still talking about today. We need to make our point to those who don’t do this for a living...