The Malware War -When A Solid Plan is Not Enough

Bruce Cain

4/1/2008

Most SMEs have a reasonably good antivirus and antispyware strategy in place. But how foolproof is it? As the sophistication of security attacks increases, preventing Trojans, worms, and other nasty files from infiltrating your network is becoming that much more important—and difficult to do. Your plan might have stopped viruses, spyware, and other malware in the past, but is it really sound enough for the future?

Complacency is a major risk when it comes to protecting your network—your anti-malware software and processes are only as good as what they can do for you now. No single solution or practice is perfect all the time.

“The number of malware samples has risen exponentially over the past two years. If you were ‘safe’ or free from infections last year, it doesn’t mean that you’ll be safe this year,” says Brian Grayek, vice president of product management for the Internet security business unit of CA (www.ca.com). “You must keep a continuous diligence against the potential for a malware infection. Never rely on complacency and how you’ve never been hit before and you are now ‘secure.’”

Declaring War

It is now common knowledge that whether it is a high school kid in the suburbs that devotes his free time to modifying virus scripts or a criminal in Asia who seeks to create malware to reap illegal profits by exploiting unsecured ports, someone at any given moment likely seeks to cause networks damage somewhere. But at the same time, the landscape continues to change and evolve. For example, there has been a shift away from email-born viruses to links in emails to download Web sites, says Leslie Forbes, a technical manager at F-Secure (www.f-secure.com).

"Users are increasingly invited to download so-called e-cards, invites, notifications, or other files from links that can attract viruses [and other unwanted files]," Forbes says. "A lot of administrators are not up to speed as they could be about these risks.”

Even for often-understaffed SMEs, there now needs to be someone or a team that focuses on virus threats or security in general. Just having antivirus and antispyware up and running on all of your network’s workstations is not enough.

“I come across some organizations where antivirus and antispyware is almost like a tick-box that you check. They say, ‘We have 500 versions of Windows XP and 500 antivirus [programs]’ and think that’s fine.” Forbes says. “But people often don’t realize that security is a process that is never done.”

Keeping Vendors Honest

It is easy to rely indefinitely on a third party for all of your security needs out of convenience, but doing so represents another example of how complacency can do a lot of harm.

“There are some people in the security market who walk in with a single CD. They say ‘Look, this can provide you with all the security for the company,” says Tony Anscombe, director of business development for Avira (www.avira.com). “There are vendors out there who try to package it all into one thing. Just because it all came on the CD doesn’t make it good.”

A particular antivirus and antispyware software suite may have seemed to work flawlessly in the past. But the talents of anti-malware software designers in a given firm can change, whether due to cutbacks or other reasons. And that means the talent pool of those whom our enterprise relies on to design the software that wards off malware can change, as well.

“It is far better to continually seek best-of-breed products and to continue evaluating that you are using the best-of-breed products,” Anscombe says.

One way to gauge how well your anti-malware software fares against the competition is to check for benchmark comparisons that objective third parties publish. “A vendor’s know-how and ability to provide newer updates can change,” Anscombe says. “I would keep my eye on who is getting the good detection rates. Someone who is doing really well technically today might not be doing so well three years from now.”

The Laptop As A Time Bomb

There is always concern about the security risks that workers who telecommute pose. Yet, securing these workers largely involves the same practices that apply to onsite staff. A telecommuter’s PC, like any work machine, should be locked down as much as possible. The standard practices of never allowing users to install software on their PCs and making sure that workstations get the required signature distributions apply to any networked machine, regardless of whether it is offsite.

Still, remote workers do require some special attention, says CA’s Grayek. “[It is important] to protect [remote and mobile workers’] systems with a managed firewall and host-based intrusion prevention system, as they will connect through ISPs you don’t control at airports, hotels, home, etc.,” Grayek says. “Rogue-free Wi-Fi hotspots designed to capture user info are increasingly common, and a VPN alone only provides a secure pipe for a potentially compromised PC.”

Indeed, it is often the mobile worker that can cause problems. “The issue is the truly nomadic user who wanders around the United States for two weeks and then plugs into the network. You need to catch up with him because you don’t know what he has been doing, and he needs the updates before anybody else,” Anscombe says. “You can configure it so that his updates get the priority before anything else.”

In addition to constant updates, a centralized server should automatically initiate scans once a week on any enterprise machine, regardless of whether it remains behind the firewall or a laptop for a mobile worker.

Ultimately, it is up to the admin who focuses on security issues to make sure that anti-malware scans are undertaken. The process is but one of many necessary procedures when it comes to anti-malware protection.

“Most companies are relatively aware of what they need to do, but whether they are doing it or not is up to them,” Anscombe says.
Source: Processor.com, March 28, 2008 Issue

CONFERENCE SCHEDULE

National Association Partner

ITEC-TV

Weekly ITEC-TV netcast live or on-demand!

Featuring ITEC General Manager Bill Sell and ExtremeLabs analyst Tom Henderson every Wednesday at 4:00 PM Eastern time.

Each week ITEC-TV hosts leading IT experts examining the day's most newsworthy technology issues.

ITEC Conference & Showcase

ITEC Connect

The Malware War -When A Solid Plan is Not Enough

Bruce Cain

4/1/2008

CONFERENCE SCHEDULE

National Association Partner

ITEC-TV

ITEC Conference & Showcase

ITEC Connect

The Malware War -When A Solid Plan is Not Enough

Bruce Cain

4/1/2008

Subscribe to ITEC Connect Newsletter

CONFERENCE SCHEDULE

National Association Partner

ITEC-TV