Security Corner
BLASTER NO MATCH FOR BEST PRACTICES
By Eric Sundin and Neil Murray
For all the havoc created by the recent Blaster and Nachi worms, anyone following best practices in computer systems security would have been protected. Think of the three conceptual areas for electronic computer system security:
- Filtering (Firewalls),
- System Administration,
- Monitoring.
Filtering with firewalls can be setup to limit the type of access that is allowed to enter a network dependant on business case. This cuts down the number of vulnerabilities by eliminating traffic from the Internet that is not specifically allowed in. In the case of Blaster and Nachi, proper filtering would have prevented the initial spread of the worms, as they were dependant on very specific TCP ports that are rarely used.
System administration includes the ongoing configuration and updates of systems by the people who look after them. If systems and people were perfect this would not be a security issue. However, people make mistakes, so security vulnerabilities happen through human error. Operating systems also contain flaws that can only be discovered with the passage of time and fixed with the appropriate patches as soon as they become available. The vulnerabilities exploited by Blaster and Nachi were actually discovered several months before the attacks and the necessary patches made available. Anyone following a plan of running regular updates would have been adequately protected.
Monitoring is essential to any type of physical or electronic security to reveal security breaches when they happen and before significant damage occurs. There are many early signs of security breaches that can easily be detected by simply monitoring server and network equipment logs, all of which can be customized for the environment. This was the final defence perimeter against Blaster and Nachi for IT departments that may have neglected proper Filtering and regular System Administration. Monitoring would have detected unusual network traffic and alerted IT staff to the imminent threat.
