Unethical hackers (in bad
sense of this word) are always looking for weaker points in a network
system to hack the security system of your company and get a hold of
confidential and new information.
Some "black-hat hackers" derive a vicarious pleasure from
wreaking havoc on security systems and some hackers do it for money.
Whatever may be the reason, malicious hackers are giving nightmares to
companies and organizations of almost all sizes. Especially, large
corporate houses, banks, financial institutions, security establishments
are favorite targets for hackers. However, this menace can be prevented
to a great extent if proper security measures are taken at the right
time.
Steps
-
1
Follow forums. It is
always a good idea to follow hacking forums as you will be able to pick
up on all the latest methods being used. A good ethical hacking forum
can be found at http://zero-security.org
-
2
Change default password immediately. Some software has built-in password to allow the first log in after installation; it is extremely unwise to leave it unchanged.
-
3
Identify entry points.
Install proper scanning software programs to identify all entry points
from the internet into the internal network of the company. Any attack
to the network needs to start from these points. Identifying these entry
points, however is not at all an easy task. It is better to take the
help of skilled ethical hackers who have taken special network security
training to perform this task successfully.
-
4
Perform attack and penetration tests.
By running the attack and penetration tests, you can identify those
vulnerable points in the network that can be easily accessed from both
external and internal users. After identifying these points, you would
be able to thwart attacks from external sources and correct the pitfalls
that could become the entry points for intruders to hack into your
network. The test must be done from both the internal as well as
external perspectives to detect all the vulnerable points.
-
5
Make user-awareness campaigns.
All possible steps must be taken to make all the users of the network
aware of the pitfalls of security and the necessary security practices
to minimize these risks. You can conduct the social-engineering tests to
determine the user awareness. Until all the users are aware of certain
factors related to the network, protection cannot be carried out in the
true sense of the term.
-
6
Configure firewalls. A
firewall if not configured properly can act like an open door for any
intruder. Hence it is vitally important to set the rules to allow
traffic through the firewall that is important to the business. A
firewall must have its own configurations depending upon the security
aspect of your organization. From time to time proper analysis of the
composition and nature of the traffic itself is also necessary to
maintain security.
-
7
Implement and use password policies.
Use strong password policies by having passwords of seven characters
which are of secure length and relatively easy to remember. Passwords
must be changed in every 60 days. The password should also be made up of
both alpha and numeric characters to make it more unique.
-
8
Use paswordless authentication.
Regardless of the policies above, passwords are less secure than SSH or
VPN keys so think about using these or similar technologies instead.
Where possible, use smart cards and other advanced methods.
-
9
Delete comments in website source code.
Comments used in source code may contain indirect information that can
help to crack the site, sometimes even usernames and passwords. All the
comments in source code that look inaccessible to external users should
also be removed as there are some techniques to view the source code of
nearly all web applications.
-
10
Remove unnecessary services from devices. You will not be dependent on reliability of the modules you actually do not use.
-
11
Remove default, test and example pages and applications that usually come with web server software. They may be a weak point to attack and as they are the same in many system the cracking experience can be easily reused.
-
12
Install anti-virus software.
Both intrusion detection systems and anti-virus software must be
updated regularly and if possible on a daily basis. The updated version
of anti-virus software is necessary as it helps in detecting even the
latest virus.
-
13
Ensure physical security.
Apart from ensuring the internal security of the network, you need to
think about the physical security of your organization. Until and unless
your organization has full security, any intruder can simply walk in
your office premises to gain whatever information he wants. Hence with
technical security, you must also ensure that the physical security
mechanisms of your organization are fully functional and effective.