2KKUU7ita

352
Part VII: The Part of Tens
Stick to the following tenets:
✓ Be realistic.
✓ Use good tools.
✓ Get to know your systems and practice honing your techniques.
I cover each of these in various depths in Chapters 5 through 15.
Assuming That You Can Eliminate
All Security Vulnerabilities
When it comes to computers, 100 percent, ironclad security is not attainable.
You can’t possibly prevent all security vulnerabilities, but you’ll do fine if you
uncover the low-hanging fruit and accomplish these tasks:
✓ Follow solid practices.
✓ Patch and harden your systems.
✓ Apply reasonable (cost-justified) security countermeasures.
Many chapters, such as the operating system chapters in Part IV, cover these
areas. It’s also important to remember that you’ll have unplanned costs.
You may find lots of security problems and will need the budget to plug the
holes. Otherwise, you may have gotten over the due diligence hurdle but now
have a due care problem on your hands. This is why you need to approach
information security from a risk perspective and have all the right people on
board.
Performing Tests Only Once
Ethical hacking is a snapshot of your overall state of security. New threats
and vulnerabilities surface continually, so you must perform these tests
periodically and consistently to make sure you keep up with the latest security
defenses for your systems. Develop both short- and long-term plans for
carrying out your security tests over the next few months and next few years.