Tests should represent both inside and outside attacks. Inside attacks can take place through modems, infiltration, social engineering, or by authorized users. Even a light scan can identify network hardware and operating systems, client and server types, and so forth. Hackers use this information to research known vulnerabilities or to find holes in the configuration. A complete security analysis involves defining an organization s current policy, performing an internal audit, performing external testing and generating reports.
Case studies demonstrate a wide range of vulnerability between organizations.
One currently unresolved security issue is firewall certification. An organization would recertify every time its configuration changes. Planned periodic certification would ensure that the firewall meets new threats. Social engineering and attacks by authorized users are by far the most common threats. These threats can be addressed by interior firewalls as well as personnel policies and procedures.