Table of Contents
INTRODUCTION........................................................................................................................................ 6
ANATOMY OF A VULNERABILITY...................................................................................................... 7
VULNERABILITYATTRIBUTES.....................................................................................................................8
Fault........................................................................................................................................................ 9
Severity................................................................................................................................................... 9
Authentication....................................................................................................................................... 10
Tactic.................................................................................................................................................... 10
Consequence......................................................................................................................................... 11
ATTRIBUTES ANDVULNERABILITIES.........................................................................................................11
LOGIC ERRORS....................................................................................................................................... 12
OPERATINGSYSTEMVULNERABILITIES.....................................................................................................12
APPLICATIONSPECIFICVULNERABILITIES.................................................................................................13
NETWORKPROTOCOLDESIGN...................................................................................................................13
FORCEDTRUSTVIOLATIONS.....................................................................................................................14
SOCIAL ENGINEERING......................................................................................................................... 15
GAININGACCESS.......................................................................................................................................15
\u201cI forgot my password!\u201d....................................................................................................................... 15
\u201cWhat is your password?\u201d................................................................................................................... 16
Fishing for Information........................................................................................................................ 17
Trashing................................................................................................................................................ 17
Janitorial Right..................................................................................................................................... 17
CRIMINALSABOTAGE................................................................................................................................17
Corporate Sabotage.............................................................................................................................. 17
Internal Sabotage.................................................................................................................................. 18
Extortion............................................................................................................................................... 18
COMPUTER WEAKNESS........................................................................................................................ 19
SECURITY THROUGH OBSCURITY............................................................................................................... 19
ENCRYPTION..............................................................................................................................................19
Cryptographic Short Cuts..................................................................................................................... 20
Speed of Computer................................................................................................................................ 20
Lack of a Sufficiently Random Key....................................................................................................... 20
PASSWORDSECURITY................................................................................................................................20
SECUREHASHES........................................................................................................................................20
AGEDSOFTWARE ANDHARDWARE...........................................................................................................21
PEOPLE......................................................................................................................................................21
POLICY OVERSIGHTS............................................................................................................................ 22
RECOVERY OFDATA..................................................................................................................................22
RECOVERY OFFAILEDHARDWARE............................................................................................................23
INVESTIGATION OFINTRUDERS..................................................................................................................23
INVESTIGATION OF WHEN THECOMPANY ISACCUSED OFINTRUDING ONOTHERS....................................23
PROSECUTION OFINTRUDERS....................................................................................................................23
PROSECUTION OFCRIMINALEMPLOYEES..................................................................................................23
REPORTING OFINTRUDERS ANDCRIMINALEMPLOYEES TO THEPROPERAGENCIES.................................23
PHYSICALSECURITY OF THESITE..............................................................................................................24
ELECTRICALSECURITY OF THESITE..........................................................................................................24
Leave a Comment