5. Allowing nonsecure remote access and management software.

One of the most popular ways for hackers to get into your network is to use a remote access and management software package, such as PCAnywhere, Virtual Network Computing (VNC) or Secure Shell (SSH). Often, these software applications are lacking the most basic security measures, such as good passwords.

The simplest way to find this problem is to run an external scan across your entire IP address space to look for PCAnywhere, VNC or SSH traffic. Once you find these applications, put extra security measures on them such as tokens or certificates in addition to passwords. Another option is to scan the Netflow data of your external facing routers and see if you have any remote access management traffic flowing across your network.

This problem is common enough to account for 27% of the compromised records in the Verizon Business report.

6. Failing to test noncritical applications for basic vulnerabilities.

Nearly 80% of all hacking attacks are the result of security holes in Web applications, according to the Verizon Business report. Network managers know that their biggest vulnerability is in Web applications, so they put all of their effort into testing their critical and Internet-facing systems.

The problem is that most hacking attacks leverage security mistakes in noncritical systems inside networks. "The main problem is that we're testing like crazy the critical Web applications, and we're not testing the non-Web applications," Tippett says. He recommends that network managers test all of their applications for basic vulnerabilities.

"People have been taught forever to focus in order of criticality, but the bad guys don't know what's critical or not. They go in order of what's easy," Tippett says. "Once they get inside your network, they can set up shop, take their time and watch your traffic."

7. Not adequately protecting your servers from malware.

Malware on servers accounts for 38% of all security breaches, Verizon Business says. Most malware is installed by a remote attacker and is used to capture data. Typically, malware is customized, so it can't be discovered by antivirus software. One way for network managers to find malware such as keylogger or spyware on their servers is to run host-based intrusion-detection system software on every server, not just critical servers.

Tippett suggests a simple way to prevent many of these attacks: Lock down servers so that no new applications can run on them. "Network managers hate to do that because they might want to add new software later," Tippett says. "I tell them to just unlock the lock, install the new software, and then lock it up again."