NTA Monitor

Latest News

Living with threats

1st August 2010 Back in 2004, Bill Gates predicted that spam would be a thing of the past within two years. As we all know now, and quite a lot of people predicted at the time, far from being a solved problem, the volume of spam has continued to increase. Read More

Web application security goes from bad to worse in many sectors

27th July 2010 NTA Monitor's 2010 Annual Web Application Security Report analysed the data gathered from web application security tests performed for a wide range of industry sectors over a 12-month period... Read More

IT Managers get to grips with Internet security issues

4th May 2010 According to NTA Monitor's 2010 Annual Security Report, the average number of Internet security vulnerabilities afflicting organisations has fallen.. Read More

Responsible Patching

1st January 2010 Microsoft's response to the "zero day" exploit that was used in the cyber attacks against Google shows that software vendors still have a lot to learn when it comes to responding to vulnerabilities. Read More

The Return of the Insider Threat

When NTA started security testing twelve years ago, the main focus was on the insider threat. There were many reports with statistics showing that most security breaches were due to insiders. By contrast there was very little focus on the external threat via Internet and third-party network links. Back then many companies did not even have a firewall.

Now almost everyone understands the need for perimeter security, and best practice in this area has improved hugely compared over the last twelve years. But in many sectors, internal security has not improved anywhere near as much. Now, when we perform external and internal penetration tests, it is common to see a reduced level of threat associated with the perimeter security but a much higher level of threat associated with the internal security measures - something that is jokingly referred to as a "hard shell and soft, chewy centre".

Some common themes for poor internal security are:

Although the potential risk from external attackers is much greater because of their higher numbers, the internal risk is still significant, and if the level of internal security falls too far, it can become the larger threat.

When designing security measures, it is vital to defend on a broad front and ensure that the security measures in all areas meet the minimum required strength. The "weakest link" nature of security means that concentrating in one particular area at the expense of others is generally a mistake.