Application Security: Have We Locked the Windows and Left the Door Open?

Abstract

Years ago, network administrators realized that security mattered. The data that was kept on the corporate systems was vital to the survival of the company. They set up firewalls. They locked down the building, often putting guards at the entrance. They limited access to server rooms, and they limited or eliminated all remote access. To insure these controls were adequate, they limited the number of people who could modify firewall rules and administer the network. They limited the number of users on the network. They periodically reviewed remote access points and remote access user lists, and double- checked firewall rules and instituted forms for granting and terminating user access. As if they were not paranoid enough, they even installed intrusion detection systems to notify them if any of the above controls failed.