Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many times I hear that big entities such as NASA, Gov places, big enterprises get attacked somehow. So my questions is, if those huge places get hacked, then it could easily be us. I assume those places have great firewall policies, servers etc... Any comments?

share|improve this question
The question becomes, why would they want to hack you? Do you have something worth the trouble :D – Arenstar Nov 18 '10 at 14:29
That's assuming you're not just a target of convenience. Sometimes people are just plain bored and feel like if they find an opening, it's your own fault for having the opening. Or any of a number of reasons...there are people that do it just to show they can. – Bart Silverstrim Nov 18 '10 at 15:52
+1 as this is absolutely true. If you exist on the internet, you are a target. Possibly not in the same scale as a global bank, but you still exist. That is enough. – Rory Alsop Dec 11 '10 at 16:40

Very very vague question. You're assuming that huge organizations are all tight ships...they're not, necessarily. It's far easier to lock down a tiny network.

Plus we don't know what your configuration is, your user education/tech skill is, what you have in place to prevent social engineering, etc.

Each place has it's own culture and way of doing things and their own tolerance for security issues. Some are more lax than others, and there's no one-size-fits-all approach to security. I think your premise may be flawed in reasoning.

EDIT: I would add that for security, most breaches aren't from "hackers". They're disgruntled insiders. Your users are your greatest asset and weakest link. How many problems come from careless disposal of hard drives (check on ebay, run a recovery on the drive...), discs taken, someone's file or email is carelessly forwarded, shares that aren't properly secured and sensitive material is put on them, laptops stolen or misplaced and aren't encrypted...even just plain ticking off an IT worker or other employee with authorization to material who gets angry with their boss or work situation. Or policies are just plain weak and let users play with P2P software that ends up sharing their entire drives.

In the end you have less to worry about China or Russian botnets and more to worry about your employees deciding they've had enough of the crap they get at work or just being careless.

share|improve this answer
Actually, based on the numbers, far more breaches are from 'hackers' - it's orders of magnitude more. And the large breaches are mostly external too. Try googling for Worldpay + FBI for example. The internal ones are typically the ones that can last a long time and are often only discovered by accident. – Rory Alsop Dec 10 '10 at 21:04
I think it depends on how they're defining things. I really doubt there are many targeting "hackers" out there. Most of it is automated, and of those, the attacks are usually using some form of social engineering to get users to execute the code necessary to do something. So from the system perspective it's still internal authorized users doing things. Also I'd question the numbers as reported; many businesses probably don't advertise hacks. – Bart Silverstrim Dec 13 '10 at 11:14
Another thing to consider would be the use of automated attacks vs. actual hacking. Hacking as I use it is used to actually steal information or data from a business/entity (although old-school hackers would cringe at that, I'll use the pop-definition.) Automated attacks that use internal machines to zombie them I'm not sure I'd count in those numbers. – Bart Silverstrim Dec 13 '10 at 11:18
I read the worldpay incident you cited...unless I'm misreading it the incident involved a small number of people that managed to get access to sensitive information, then spread it out to a series of others to help hide the activity in exchange for a percent of the cut. The FBI information sounds like a lot of hype mixed in; "9 million in 12 hours! That's huge!" – Bart Silverstrim Dec 13 '10 at 11:24
And it is a lot of money, but it was still perpetrated by a few people and spread to a network of yes-men. Most of the FBI release sounded like hype. I'm still inclined to believe there's a lot more stealing of documents and and information from insiders than believe they're outnumbered by actual sophisticated hackers. – Bart Silverstrim Dec 13 '10 at 11:30

I wouldn't guess at this. Run Nessus against your public IP space and then run it again on the inside. Take the reports it generates and rectify known vulnerabilities by applying service packs, patches, and security updates. This is your job! Management may not see it as important, but just show them the vulnerability report and they'll give you time to get it done.

Or pay someone to do it for you :)

share|improve this answer

The correct place to discuss this would be over on the newly formed IT Security Stack Exchange.

From my 15 years dealing with exactly this, some points:

As Bart said, large corporates don't typically run a tight ship. They usually do the minimum to meet regulatory requirements, as they don't need to be secure, they just need to mitigate the risk to the required level of acceptance.

Contrary to what Arenstar says, hackers don't care who you are - the tools to scan the entire Internet for vulnerabilities are constantly running. Anything that pops out of this first phase then is passed on to other automated tools which will look to install a shell, bot or warezshare. At this point they still don't care who you are, and I have had to carry out the same incident response and cleanup actions in a global bank and a local hardware shop.

While they are in there, they may well have a poke around, they may not,but you want to put controls in place because if they do find a customer accounts database or something equally juicy they will abuse it, either themselves or by selling the contents to someone else. It's reward for low risk and low effort - of course they will.

  • Rule 1 - patch. If you keep all security patches up to date then at least you limit your exposure just to 0-days and misconfiguration..
  • Rule 2 - defence in depth - you limit the damage that can be done before you spot the intrusion
  • Rule 3 - monitor. If you can't afford an IDS on your perimeter you could outsource the service, or at least monitor your sensitive servers.
share|improve this answer

The hackers you speak of, are not interested in your ftp/web server or music collection...
script/irc kiddies are, but even without a firewall, half of them could not break in anyway..

IMHO, there are people out there that are way smarter than the people being hired for "security".. and generally we learn from these people too.. ( oddly enough )
If you have nothing on offer for the select few really talented hackers, which im sure you dont, then you have nothing to worry about..

They will not care to aimlessly scan the internet for open ports.. Paranoia is a waste of time if we all look at this logically.. :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.