Hacker Series (Part 3)

The shift toward doing more over the Web, a practice known as "cloud computing", means that mistakes employees make in their private lives can do serious damage to their employers, because a single e-mail account can tie the two worlds together. Stealing the password for an individual’s Gmail account, for example, not only gives the hacker access to that persons personal e-mail, but also to any other Google applications they might use for work, like those used to create spreadsheets or presentations.


Email systems are a serious source of ingress for hackers. False e-mails in the name of a legitimate company or institution are sent to acquire sensitive personal information, such as usernames, passwords, and credit card numbers and often come to company email addresses. Phishing is cost effective for hackers and sometimes yields results that damage more than just the individual. An IT manager should block any emails from a questionable source and educate their users to delete any spam that makes it through the filters. It has been reported that 89.7 percent of all business email is spam. Trojans can be used to assume control over the infected PC and can cause damage such as a Key Logging application. Key Logging refers to the process of capturing and recording user keyboard strokes to obtain passwords or other encryption keys. Given the sheer volume of employees in large corporations, even one or two password or encryption captures could bring about great damage and loss.

The biggest threat to databases is Web applications according to experts and the business logic vulnerabilities within them.

“Close ties with Web applications can make databases vulnerable to SQL injection attacks, whereby attackers input strings of SQL code into weak Web applications fields. They can then raid the database linked to a specific Web application, and also use the link between the Web application and the database to launch more expansive attacks on entire database servers. According to IBM's ISS X-Force security research unit, SQL injection flaws last year were the Internet's most commonly exploited Web application vulnerability, growing by 134% over 2007” (Chichiwski, 2009)

In reality a large percentage of the security threats potentially go after the database. According to a Verizon report, database breaches accounted for 75% of all records reported breached. Many database security vulnerabilities are caused by simple lapses in security. In a 2008 poll, the Independent Oracle Users Group found that 26% of organizations take more than six months to install security patches on Oracle databases; 11% have never patched them.. Companies often make mistakes that leave databases vulnerable, such as leaving test databases on production servers or linking sensitive data to easily hacked Web-facing applications.