{"id":278,"date":"2018-06-14T19:04:57","date_gmt":"2018-06-14T19:04:57","guid":{"rendered":"https:\/\/pressbooks.ccconline.org\/bus3060\/chapter\/ch13-3\/"},"modified":"2026-02-03T23:17:32","modified_gmt":"2026-02-03T23:17:32","slug":"ch13-3","status":"publish","type":"chapter","link":"https:\/\/pressbooks.ccconline.org\/bus3060\/chapter\/ch13-3\/","title":{"raw":"13.3 Where Are Vulnerabilities? Understanding the Weaknesses","rendered":"13.3 Where Are Vulnerabilities? Understanding the Weaknesses"},"content":{"raw":"
\r\n
\r\n
\r\n
\r\n

Learning Objectives<\/span><\/p>\r\n\r\n<\/header>\r\n

\r\n

After studying this section you should be able to do the following:<\/p>\r\n\r\n

    \r\n \t
  1. Recognize the potential entry points for security compromise.<\/li>\r\n \t
  2. Understand infiltration techniques such as social engineering, phishing, malware, Web site compromises (such as SQL injection), and more.<\/li>\r\n \t
  3. Identify various methods and techniques to thwart infiltration.<\/li>\r\n<\/ol>\r\n<\/div>\r\n<\/div>\r\n \r\n\r\n<\/div>\r\n
    \r\n

    Figure 13.1<\/span><\/p>\r\n

    \r\n\"This\r\n<\/a><\/p>\r\n

    This diagram shows only some of the potential weaknesses that can compromise the security of an organization\u2019s information systems. Every physical or network \u201ctouch point\u201d is a potential vulnerability. Understanding where weaknesses may exist is a vital step toward improved security.<\/p>\r\n\r\n<\/div>\r\n \r\n

    Modern information systems have lots of interrelated components and if one of these components fails, there might be a way in to the goodies. This creates a large attack surface for potential infiltration and compromise, as well as one that is simply vulnerable to unintentional damage and disruption.<\/p>\r\n\r\n

    \r\n

    User and Administrator Threats<\/h2>\r\n
    \r\n

    Bad Apples<\/h2>\r\n

    While some of the more sensational exploits involve criminal gangs, research firm Gartner estimates that 70 percent of loss-causing security incidents involve insiders (Mardesich, 2009). Rogue employees can steal secrets, install malware, or hold a firm hostage. Check processing firm Fidelity National Information Services was betrayed when one of its database administrators lifted personal records on 2.3 million of the firm\u2019s customers and illegally sold them to direct marketers.<\/p>\r\n

    And it\u2019s not just firm employees. Many firms hire temporary staffers, contract employees, or outsource key components of their infrastructure. Other firms have been compromised by members of their cleaning or security staff. A contract employee working at Sentry Insurance stole information on 110,000 of the firm\u2019s clients (Vijayan, 2007).<\/p>\r\n\r\n<\/div>\r\n

    \r\n

    Social Engineering<\/h2>\r\n

    As P. T. Barnum is reported to have said, \u201cThere\u2019s a sucker born every minute.\u201d Con games that trick employees into revealing information or performing other tasks that compromise a firm are known as social engineering<\/em> in security circles. In some ways, crooks have never had easier access to background information that might be used to craft a scam. It\u2019s likely that a directory of a firm\u2019s employees, their titles, and other personal details is online right now via social networks like LinkedIn and Facebook. With just a few moments of searching, a skilled con artist can piece together a convincing and compelling story.<\/p>\r\n\r\n

    \r\n
    \r\n

    A Sampling of Methods Employed in Social Engineering<\/h4>\r\n