What are the biggest security 'holes' that companies often leave open?

There are great answers posted here so far. The number one security hole is definetely people. Our clients that are doing the best job at managing people for security are using software that monitors and reports back to the user themselves. We have found it most effective to provide this tool to users to help them manage their own security and productivity. Of course management has access to the data as well, but our method allows users to improve their own records. Staff security is both an IT and Human Resource issue after all.

There are a couple of other often over looked items:

Mobile data - those laptops, netbooks etc should be encrypted. The technology is available and either built-in or inexpensive. There's no reason a business should leave their data volnerable to theft out of the office.

Desktop PC's - An alarming number of businesses, even those managed by professional IT staff, are not updating their computers with the latest security patches, service packs, etc. Every software manufacturer releases updates on a regular basis and hackers learn from those updates what to attack and how to do it. If you don't apply to patch you are leaving yourself vulnerable. Adobe and Java are the two most over looked applications that are causing most malware infections today.

Alex,

From my experience the biggest security risks that are often overlook are those that deal with PC’s, company personnel use policies, and physical access. A high level of trust is put into employees as well as what ever AV product is put on the machines. End users are allowed admin or super user control of their machines in many cases. It is a sure thing that you will find someone in this group who has installed software that makes their PC vulnerable. The policies of how the end users access the network and the policies around passwords are a huge glaring hole. You can find passwords written down, find unlocked PC’s, or just hear people telling their passwords to co-workers. The physical access is often overlooked placing a PC on the corporate network in a public place. Given a small amount of time someone could easily use this to exploit data.

Great points Steve....and wireless networks too. I can't count the number of buildings I've been in where they have the AP hidden above the ceiling and I see the antenna (if it's a pad) or the tile marked with all the info I need to get into the device and into the network. Please folks, mark your AP's not with the names that help me, but mark them as the location that they are in. None of this 192.168.5.4 stuff, but how about 'AP NE Corner 2nd Floor'.

Also....change the passwords more often on the network gear. All too often an employee quits or is otherwise given the op to find a new position and none of the passwords are changed. Internal hits out number external hits day in and day out.

In my experience the top security hole is and continues to be people. Social engineering somebody in the company to give out sensitive information needed to gain access to resources and/or construct a profile that eventually gains access to information is to this day still the easiest way to penetrate any security infrastructure when performing audits. Many professions are trained to be helpful above all and often don't understand that seemingly simple information when combined with other information available through searches, company website, or other public records can quickly yield a very usable profile. The moment I have actual valid access information, all bets are off on any security infrastructure, best practice, etc.

The single biggest type of security holes is your own employees. Unverified trust in one's employees is the largest source of confidentiality breaches. And they are the easiest to compromise. You can't get a piece of technology drunk, blackmail it, or use social engineering ruses on it to gain access.

Probably isn't the bigges,t but for sure is the most disowned and underrated: the telephony security.
Many companies are moving from legacy to ip telephony without take in consideration:
- toll fraud on voip systems
- how is simply to register and listen voip calls with freeware sniffer applications
- the increase of low cost gsm tapping tools
- the hacking of telephony systems to compromise the stability
- fixed and mobile convergence, unified communications and security problems

Tipically we receive many customer requests when the problem is just occured, but an IT manager can comprehend the problem to prevent it. For that the market is moving to voip encryption, with mobile and fixed convergence, and specific voip firewalling solutions.