Shaun Stanislaus blog

Your 10 Biggest Network Security Worries

The right hardware, policies and user education can help in the fight.

From spyware and phishing to intrusion attempts, the threats
attacking today’s computer networks are more dangerous
than ever. Many threats are targeting specific industries with
convincing-looking e-mail and phone calls. The hackers hope
to direct employees to counterfeit Web sites, in order to harvest
passwords and private financial information or steal computer and
network resources. “The revenue from cybercrime in the United
States now exceeds that of illegal drug activity,” says Scott Pinzon,
editor-in-chief of WatchGuard’s LiveSecurity Service, WatchGuard
Technologies Inc.

“We’re seeing a change in the threat landscape, from ones that were noisy and
targeting the perimeter of the network, to becoming much more silent, difficult
to detect and highly targeted,” says Kelly Martin, group product manager,
Symantec Corp. “These attacks are mostly targeting Web browsers and the client
applications on the computer itself. And while a small business network may not be
as complicated as an enterprise network, they still have desktop and mobile clients.”
Because small businesses have fewer IT resources at their disposal, they need
solutions that provide comparable protection, at affordable costs and requiring
minimal administration. Here is a list of the biggest threats or sources of
vulnerabilities today’s small business IT professionals need to defend their networks
against, along with tips on how to fight them.

1 Spyware
Spyware is software that installs itself on a computer without the knowledge or
permission of the owner, be it your company or the main person using the system.
According to antispyware vendor Webroot Software Inc.’s State of Spyware Report,
nine out of 10 PCs connected to the Internet are infected with spyware, and some
form of spyware can be found on 87 percent of corporate PCs.
Spyware can get into your computer from executable attachments in e-mail,
“hostile applets” on Web sites, hidden on installation CDs or downloaded files and through security holes in other applications. Spyware also “piggybacks” on top
of quasi-legitimate downloads, often pretending to be a browser accessory or
important security update. Sometimes the “permission” is buried in the fine print of
an end-user license agreement (EULA) document or Web page.
Once installed, spyware programs often masquerade as legitimate files or
programs, or do other tricks to avoid detection. Some spyware may simply attempt
to change your browser’s home page or present pop-up ads. Too much spyware
— even of this type — can seriously degrade a computer’s performance,
increasing startup and shutdown times, slowing regular operations to a crawl
or bringing the machine to a complete halt. But increasingly, most spyware is
malicious in intent, monitoring a user’s keystrokes or examining their files for
passwords, financial account numbers and other sensitive data, and then sending
that information back to the spyware’s creator, who may use it for identify theft.
Spyware can be difficult to detect and difficult to remove. The best solution is to
prevent it before it gets onto your computers, by doing URL (Uniform Resource
Locator) and content filtering at the network gateway and, if possible, on the
computer. However, it’s also important to run antispyware software on user
machines, such as McAfee AntiSpyware, Trend Micro Anti-Spyware and Webroot
Spy Sweeper. For a hardware solution, consider Barracuda Networks’ Barracuda
Web Filter, previously known as the Barracuda Spyware Firewall. The Barracuda
Web Filter attacks existing spyware installations by detecting any spyware access
to the Internet and notifying the administrator.

2 Blended Attacks
As the name suggests, blended attacks combine several types of activity. They
combine the characteristics of viruses, worms and other malicious code with
server and Internet vulnerabilities to rapidly initiate, transmit, spread and cause
widespread damage.
“The goal is to extract confidential information from your system,” says Symantec’s
Martin. “It may start with a phishing attack through e-mail, instant messaging
[IM] or a ‘voice phishing’ call as the point of entry, figuring out how to get your
attention.” Then the attack tries to trick the user into going to a Web site that
drops malicious code, so even if the user doesn’t give private information, their
system gets compromised.
Tools to block blended attacks include deep packet inspection (DPI) firewalls,
intrusion prevention and “behavior blocking” — tools that alert on unusual
software activity — and, of course, ensuring that your users know what not to
click on.

3 End Runs
While many attacks start by “pounding on the front door” — hitting the gateway
that connects your local area network (LAN) to the Internet — many will go
around, possibly never even touching the network en route to a computer.
Gateway-level security won’t protect computers from threats on CDs or USB
(Universal Serial Bus) flash drives. Nor will it protect an employee computer or
handheld that’s being used outside the office, such as in a wireless hotspot,
where eavesdroppers or rogue access points (APs) may intercept traffic if the
machine being used doesn’t have sufficient client-level security. These attacks
are called end runs.
According to “Network Security and Intrusion Prevention,” a January 2005 survey
of 250 North American security professionals conducted by Enterprise Strategy
Group (ESG) Research, Milford, Maine, infected employee notebooks make up 39
percent of worm attacks that get into a company LAN. The second most common
source was through the firewall, followed by nonemployee notebooks and virtual
private networks (VPNs) connected to home systems. “Three of the top four
sources of this threat went around the firewall,” says Jon Oltsik, senior analyst at
ESG Research. “This is why multilayered ‘defense in depth’ threat management
is necessary.”
Some threats can go right through older gateway-level security, which may not
recognize threats that are spread across multiple packets or don’t match their
database. DPI and URL/content filtering and blocking play an important role in this
type of threat prevention.

4 Rogue Access Points
Rogue access points — APs that don’t belong to IT or aren’t configured by IT to
reflect company security policies — represent a major network security threat.
They can allow unauthorized parties to eavesdrop on network traffic and attempt
to inject threats. Once a rogue AP has been connected to the network — which
can be as simple as plugging a Wi-Fi adapter into a USB port, connecting an AP
to an untended Ethernet port or using a Wi-Fi-equipped notebook or handheld
computer — an unauthorized user may be able to access your network from
outside the building or even further away.
Features for detecting rogue APs and blocking their access are available in many
new wireless switches, as well as in gateway-level Unified Threat Management
(UTM) security appliances from such vendors as Cisco, Juniper, SonicWALL and
WatchGuard. UTM appliances take the place of separate single-purpose security
devices, reducing cost and management. Capabilities include firewall, VPN,
intrusion prevention, antivirus/antispyware and content/URL filtering. Increasingly,
UTM appliances have a range of security engines built in. IT can then choose which
modules to pay for and activate.

5 Web and Browser Exploits
Web exploits attempt to breach security through Web servers, such as Microsoft IIS
Apache, Sun’s Java Web server and IBM WebSphere. Successful attackers may gain
complete control of systems, allowing unauthorized access to directory listings and
the ability to create new accounts and read, change or delete data. According to
the Common Vulnerabilities and Exposures list compiled by the MITRE Corporation,
a not-for-profit technology research and development organization, roughly a
quarter of the security flaws from 1999 through 2005 were Web exploits.
Browser exploits, similarly, seek to take advantage of security vulnerabilities
in users’ Web browsers due to unpatched versions or unsecure configuration.
Malicious JavaScript, ActiveX or Java applets can, for example, crash user
computers, download “backdoor” or other malicious code, giving intruders full
access to the computer. Successful attacks can steal user logins and other sensitive
data and compromise user computers.
Solutions include URL/content filtering at the gateway, switch and client levels,
running vulnerability scanner software to check Web servers and client systems for
potential vulnerabilities, applying security patches, and configuring Web servers
and browsers securely.

6 Worms and Viruses
Viruses, which infect existing computer programs, and worms, which are
executable programs, are some of the oldest and most well-known types of
computer threats. Viruses tend to be in document, spreadsheet and other files and
spread via e-mail, while worms typically spread themselves directly over networks.
Once a worm or virus has infected a computer, it may begin wreaking havoc in
addition to attempting to replicate itself to other systems.
To protect against worms and viruses, run antivirus software both at your gateway
and on your computers. Also, consider also using secure switches inside your LAN.
Most of all, be sure to keep your antivirus definitions and software up to date.
7 Information Theft
Your company’s information includes user names and passwords, which can be
misused to gain access to databases, applications and systems. Lost, changed or
compromised names or passwords can, in the wrong hands, put your company at
risk from regulatory fines, loss of business and other costs.

7 Information Theft
Your company’s information includes user names and passwords, which can be
misused to gain access to databases, applications and systems. Lost, changed or
compromised names or passwords can, in the wrong hands, put your company at
risk from regulatory fines, loss of business and other costs.
Preventing information theft requires securing your network to keep unauthorized
users away and also block unauthorized attempts to extract sensitive information.
Solutions include gateway-level firewalls, intrusion prevention, antivirus,
antispyware, spam blocking and URL/content filtering, as well as the use of VPN
connections for mobile and other remote users, Network Access Control (NAC)
and endpoint security to ensure that client devices are secured. (Don’t forget
physical security of your facilities and proper disposal of paper, computer media
and hard drives.)

8 Phishing
Phishing simply attempts to fool end users into believing that bogus e-mail, phone
calls or Web sites — often related to online banking and payment services — are
legitimate, with the intent of getting them to provide private information or
download hostile applets to infect the user’s computer. According to SonicWALL,
over six billion phishing e-mails are sent worldwide each month.
“Phishing is one of the harder threats to protect against, because it’s more about
[exploiting] human behavior,” says Sanjay Beri, director of product management,
security products group, Juniper Networks. “Web filtering, which blocks requests
to sites identified as phishing sites, helps a lot. If an employee tries to go there,
they’ll get a message indicating it’s a phishing or otherwise restricted site.”
To prevent phishing, look for gateway-level security that examines incoming e-mail
and Web code. Consider adding outbound blocking — blocking e-mail and URLs
from browsers to known or suspected phishing addresses.

9 Keystroke Logging
Keystroke logging, or keylogging, refers to programs that can record a user’s
keyboard (and possibly mouse) input to get user names, passwords, e-mail, instant
messages and other employee activities. Keylogger programs typically capture this
information to a file, and then surreptitiously forward these files for identify theft
or other misuses.
The most common method of keylogging is using spyware or other unauthorized
programs on a user’s computer. Other approaches include electronic
eavesdropping — hardware devices snuck into keyboards or a computer’s USB or
PS/2 ports. Along with vigilance, DPI and URL/content filtering are key defenses.

10 Instant Messaging Vulnerabilities
Like e-mail, instant messaging is a common vector by which viruses and spyware
spread, typically through sent files that users open. “When employees use IM and
peer-to-peer applications, they can easily download spyware without being aware
of it,” says Jon Kuhn, director of product management, SonicWALL Inc. “And often,
once opened, an IM virus will resend itself to everyone on the user’s contact list, as
well as installing spyware.”
To prevent IM-borne threats, use network, switch and client antivirus/antispyware
tools, keep computer operating systems and IM applications up to date — and
teach employees not to click on unrequested files. ◊

Banks slip through virus loophole

Is my money safe? A quiet rule change allows British banks to refuse to compensate the victims of online fraud if they do not have "up-to-date" anti-virus protection, says Shaun Stanislaus

A small addition to the Banking Code seems like such a minor thing. But the change, which came into effect at the end of March, has analysts and academics alike alarmed at what it could mean for online banking customers. Since the 2005 edition of the code (which dictates how UK banks do business with customers), section 12.9 has advised customers to keep their PCs secure. "Use up-to-date antivirus and spyware software and a personal firewall," it says.

The contentious addition to the new version is section 12.13. "Unless you have acted fraudulently or without reasonable care (for example, by not following the advice in section 12.9), you will not be liable for losses caused by someone else which take place through your online banking service," it says.

Thieves in the site

To banking security expert Steven Murdoch, that signals an official shift in liability for online banking fraud to the end user. "The most likely way the new rules will be applied is that the bank will decide they don't want to refund a customer, and may choose to quote this rule in their reasoning," says the researcher in the security group at the University of Cambridge's computer laboratory.

It's easy to see why banks might be worried about online security. Although losses from online banking fraud dropped a third last year compared to 2006, banks still lost £22.6m to online banking thieves. And Graham Cluley, senior technology consultant at antivirus firm Sophos, warns that banking trojans - malware that watches your PC in an attempt to steal your banking details - is becoming more sophisticated.

"The traditional way they do it is to log your keystrokes, but more sophisticated ones examine your mouse clicks or even take a little movie," says Cluley, adding that the trojans often target UK banks.

The code seems to allow it, but would banks ever really dictate that customers must use antivirus software if they're going to be compensated for internet fraud? "I wouldn't say never, but it's not on the agenda currently," says Sean Gilchrist, director of electronic banking at Barclays, which already distributes a pinpad which provides two-factor authentication for customers accessing its online banking service.

"I think that there may be particular circumstances where there has been a piece of fraud and we might challenge a customer harder," says Gilchrist, "but we're saying that we have an online fraud guarantee, and there's nothing in our plans to review that stance."

While at least some UK banks leave their options open, experts worry about other banking industries that have set a precedent by imposing draconian online security measures.

Breaking the bank

The New Zealand Bankers' Association (NZBA) revised its own banking code with a clause giving banks the explicit right to access customers' computers in the event of a fraudulent transaction. They could check whether the computer had anti-virus and anti-spyware protection, and if customers refused to hand over their equipment, their fraud claims could be dismissed.

Upset by customer protests, some New Zealand banks subsequently distanced themselves from the NZBA's code, essentially creating an unofficial, more lenient interpretation. "If they had gotten away with it, it would certainly have deterred a lot of defrauded customers from claiming," says Murdoch's colleague Ross Anderson.

"And what would happen when you bank using your PC at the Guardian, you get defrauded, [the bank] demands the PC, and the Guardian says no?" asks Anderson. "What if your wife or your daughter says no, as they have personal and sensitive data on the PC?"

Eric Domage, research manager for security products and services at analyst firm IDC, worries about social exclusion. If banks decide to interpret the UK Code in a way that forces computer users to guarantee the security of their PCs, a subset of UK society could be affected, he warns.

"Those who can't afford to have a PC but use a web cafe PC - including many immigrant workers in the UK - how would they have access?" he asks. After all, verifying the security level of a publicly used PC is as difficult as verifying the security of a private PC, weeks or months after a security breach.

Such arguments are premature, according to banking industry spokespeople eager to ease customer concerns. "This is not an offloading of responsibility," says one spokesperson at the British Bankers' Association, which administers the code. "We don't envision banks saying 'you lost money online so we're not paying you'."

Mark Bowerman, spokesperson for APACS, argues that the new provisions are there to protect customers by making responsibilities for online banking security clearer. But where one ambiguity is resolved, others may arise. "The Banking Code is a recommendation and always vague and high level," says Domage, who worries that banks may interpret the code as they see fit in the future. Are APACS and the BBA really in a position to guarantee that won't happen?

The code leaves other ambiguities, too. "For example, what is a good antivirus software?" Domage asks. Barclays is currently reviewing the F-Secure antivirus software that it provides for free to members of its online banking service and may switch packages. Would banks be happy for customers to use antivirus software that they didn't authorise? Several respected security researchers have a dim view of antivirus software overall. "It's not completely worthless, but mostly worthless," says Joe Stewart, senior security researcher at SecureWorks, who writes his own malware analysis tools from scratch.

Part of the problem is that malware writers increasingly test their work against antivirus engines before trying to infect computers with them, he says, which gives them a head start over the companies writing the antivirus software.

You can't stop them all

Most security vendors agree that there's no silver bullet for malware, and that a complete security guarantee is unlikely. But you're better off with antivirus software than without it, they add. "You won't be able to stop 100% of the viruses and infections," says Cody Pierce, a researcher at security research and intrusion prevention firm TippingPoint, "but you'll stop some of them."

But if you can't guarantee that you'll block banking trojans or other malware with antivirus software, how useful is it to mandate it in the Banking Code (or, as New Zealand's code did, to explicitly suggest that your fraud claim would be dismissed without it?)

Bowerman emphasises that banks would only begin to question customers' online security in cases of obvious negligence. "If you are the victim of a phishing attack, the vast majority of people get their money back," he says. "But if it happens seven times in seven weeks, then the bank is probably within its rights not to give you your money back."

That would be a clearcut case, but not all incidents are as black and white. Exactly what constitutes negligence when it comes to online security? "Every bank has their own fraud investigation team and will look at each instance on a case-by-case basis," says Bowerman. This makes it difficult for customers to know where the line is drawn.

Even though security experts may have difficulty agreeing on how effective online security measures really are, the Banking Code's new clause seems pretty clear on what insecurity means. Using such resolute language to address a problem as complex and volatile as online security apparently leaves the banks as the only party with room to manoeuvre.