William Jackson | Is any Web site safe?
Connecting state and local government leaders
Cybereye'commentary: Malware is on the move.
It's not a secret that information technology managers need to be aware of new consumer technologies and consider their legitimate role in the workplace (GCN.com/1021). These devices, from intelligent cell phones to increasingly fast and roomy removable drives, will creep into the enterprise whether you acknowledge them or not, so it is best to accept them and manage them when appropriate, and restrict or ban them when necessary. The importance of properly managing all devices in your work environment was underscored by a couple of recent reports showing just how scary the Internet can be. The most recent Internet Threat Report from Symantec gives a typically gloomy assessment of the past six months. 'It brings home something we speculated might be taking place,' said Dean Turner, director of Symantec's Global Intelligence Network. 'Pretty much everything has moved to the Web. Increasingly, trusted Web sites have become the focal point of the activity.' Symantec reports a 136 percent increase in malicious code threats in the last half of 2007 ' and of the 1.1 million threats identified, two-thirds of them were created last year. Of the top 10 threats, six were designed to compromise Web pages. This trend toward Web site exploits has been apparent for some time. Blue Coat Systems has put it in first place in its list of top 10 security threats for this year. 'Using [Structured Query Language] and IFrame injections, plus other attacks, hackers go on infecting popular, legitimate Web sites with malicious code,' the company wrote. 'The worst part is that visitors don't have to explicitly download any content to have their own machines infected. Simply browsing sections of these infected sites allows evil scripts to embed themselves in customer PCs and do tremendous damage.' Protecting against these threats is becoming increasingly difficult. 'It's not so much the browsers themselves; it's the plug-ins' that contain the vulnerabilities, Turner said. The most common of these involve Extensible Markup Language, and exploits of Java are on the increase. The compromised site scans the browser to find vulnerable plug-ins, then installs the appropriate exploit code. So it is becoming more difficult to ensure that any Internet-connected device is free from infection. It is more important than ever to manage every device that is being used on your network so that policies for configuration and security controls can be enforced. Where remote access is needed, some robust network access control will be required. But it is not enough to manage your own network. Controls on increasingly mobile data need to be strengthened. When data goes home or on the road, whether on an agency laptop PC, a personal cell phone or a USB stick, it can be exposed to all of the risks that have turned the average home PC into something resembling a digital Petri dish. This means enforceable policies on where and how work is done. This can be counterproductive if not done properly. Most workers take data home with them to get more work done. Telling them not to do it is not likely to make them happy or more productive. Employees must be educated not only on what security policies are, but also the reasons for them. It isn't easy, but no policy will be successful without the cooperation of the end user.XXXSPLITXXX- Right there at No. 4 on the list: 'Thieves and 'ne'er-do-wells' will continue to target laptops harboring valuable identity-based information.' According to Blue Coat, the going price for records with personally identifiable information is about $14 per name, making the files in a laptop PC potentially many times more valuable than the hardware. So it was not that surprising when an NIH researcher who had placed a work laptop loaded with patient records in the trunk of his car found that someone had broken into his car and stolen the computer. Authorities usually have reassured the public in cases such as this that the thefts appeared to be crimes of opportunity. This implies that the thief was after a computer that could be sold for a fast buck rather than the information on it. But in a sophisticated black market in which a list of 10,000 names could be worth $140,000, we have to assume that even the most opportunistic thief is as likely to be after the data as the hardware.
The National Institutes of Health might have avoided a major embarrassment if someone had taken a close look at Blue Coat Systems' list of top 10 security threats for 2008.
Cybereye columninst
William Jackson
GCN
The National Institutes of Health might have avoided a major embarrassment if someone had taken a close look at Blue Coat Systems' list of top 10 security threats for 2008.
NEXT STORY: Lines of site