You Will Be Hacked

You do not have to be a defense contractor. Or a Chinese dissident. Or a Russian mobster. Or anyone in particular.

You will be hacked.

Because you can be. And because there may be a potential economic advantage for someone to do so. Your system could provide a gateway to a more profitable to important one. Or it could simply be that you become a target because you represent the digital equivalent of a nice jog in the park. Practice keeps the skills sharp. Dont take it personally: it's business or politics.

There are a number of things you can do to attempt to limit the damage before or after or both as the following article explains. And there are steps you can take to clean up following an attack. But you can not assume you are too small, too insignificant, too sophisticated or too well-defended to prevent an intrusion.

Which is not to say you should just bend over or lie back and think of England or accept any of the other exculpatory admonitions for submission. But you should have a strategy to deal with the after-effects,  an idea or two about how to contain the impact - and, in the all too probable case, a way to determine if it's already happened. JL

Greg Satell comments in Forbes:

In recent weeks we’ve seen hacker incursions into the US Dept. of Defense, the Federal Reserve Bank, The New York Times and even the Bush family, just to name a few.  What chance do the rest of us have?

Like any other form of attack, the first step towards protection and prevention begins with understanding the threat.

The Biggest Weakness of Any System
A computer network is more than just a collection of hardware and software protocols, but also includes the people who access it and that is every system’s greatest vulnerability.  Often, rather than having to execute intricate coding gymnastics, intruders just convince someone to unlock the door for them and walk right in.
In the hacker community, the technique is known as social engineering.  A typical ruse is for the intruder to impersonate someone from technical support or someone else in an official capacity (even using their real name, which is fairly simple to look up online) and then under the pretext of running an audit or some diagnostics, they convince someone to give up their password.
A related approach is phishing, in which an e-mail is sent to a particular person with an attachment or a link that releases malicious code.  Sometimes, some social engineering is involved as well, as when a publicly available report is sent from an e-mail associated with an actual person in the company or a contrived technical service call directs an employee to a web site which downloads code.
Sometimes, hackers will go so far as to print out business cards with the company logo, show up after hours and, under the pretext of forgetting a key card, get janitorial staff to let them in.  From there, a basic password cracking program loaded onto a USB drive can give them full access to the system.
Exposed Software Vulnerabilities
Every system these days incorporates a combination of technologies from a variety of sources.  At any given time, there are vulnerabilities in some or all of them.  Once they are exposed, they will most likely be posted to one of many hacker forums and from there, they will be disseminated quickly.
A recent example is the security hole in Java that reportedly was responsible for many of the breaches lately.  Most web sites use Java, so even a small vulnerability that is patched quickly is likely to lead to a number of successful incursions.
Often, software vulnerabilities are exploited by way of a code injection, in which a string of code is input into an entry field (e.g. a search box or subscription field), which gives them access to the system.  Once they’re in, they can often gain access to the rest of the system and, in some cases, are even able to gain root access, which gives them administrator privileges.
Denial of Service
In truth, a hacker doesn’t even need to get into your system to do some real damage.  One popular approach is the distributed denial of service attack (DDOS), which sends such a massive amount of queries that it overloads the server.
There are a few ways that this can be executed.  One is to organize a mass action by encouraging enough people to download software such as the Low Orbit Ion Cannon, which continually sends query packets to a particular server.  Another is to use a botnet, which can incorporate hundreds of thousands of computers to attack the target.
In either case, the result is a crashed web server for days or even weeks, which can result in either simple embarrassment or, in the worst cases, millions of dollars in lost revenues.  Sometimes, the targets worsen matters by making challenging statements to the attackers, encouraging them to step up their recruiting efforts.
What To Do?
We live in a digital age and the simple reality is, sooner or later, you will be hacked.  The best you can do is try to limit your vulnerability and when you finally do get hit, be prepared to respond quickly and effectively.
So the first step is to make sure your software and security protocols are up to date.  Software companies often release security patches to close holes in their products.  Make sure that you implement them as soon as they are released.
It’s also important that employees are aware of the possibility of phishing and other forms of social engineering and that they use secure passwords. However, also be aware that the stricter the security protocols are, the less likely that they are adhered to, so do your best to ensure that procedures are user friendly.
Finally, it is crucial to hire a competent security firm that continues to test your systems, monitors for vulnerabilities and incursions and has the ability to react quickly when they occur. Notably, in most of the attacks mentioned at the beginning of this post, the attacks were noticed immediately and contained before they could do significant damage.