Hacking is no more inherently difficult than plumbing or carpentry, and just as in anything, there is a small minority who are very intelligent and talented, and a great majority who are not. Craig Rowland, Cisco Systems Inc. In one presentation at WebSec, Global Integrity Senior VP Mark Rasch, a former federal prosecutor, said that 82 percent of successful attacks on corporate systems are perpetrated by disgruntled employees or contract workers. Security is about planning, not just the latest technology. That high-end firewall may keep out the best of hackers, but it can't stop an employee who's already inside a company's network.
Good security is hard and requires significant resources.
Both Rowland and Char emphasize, however, that very few hacks are particularly sophisticated. In simulated attacks, Global Integrity was able to acquire passwords 90 percent of the time by either calling a user and impersonating the help desk, or vice versa, according to Rasch. Attacks which do exploit technical weaknesses in the target system are rarely new or undocumented. Most can be blocked with free patches available from vendors. As many systems administrators are lax about installing security patches, crackers can get a substantial payoff with little effort by exploiting old weaknesses over and over again.