Waging War With The Web

Christian Perry

10/6/2009

Today’s World Wide Web bears little resemblance to the Web of 10 years ago. Almost every aspect of modern enterprises touches the Web in one way or another, thanks to communication and productivity innovations that continue to evolve. But evolving alongside those innovations are Web threats, which have reached confounding levels of sophistication and stealth.

“The fundamental shift in Web application vulnerability disclosure began to happen in 2005 and really began to mature in 2006,” says Dan Holden, X-Force product manager for IBM Internet Security Systems (www.iss.net). “The sheer numbers of vulnerabilities allowed attackers to take a second look and analyze how they were going about spreading their malware and growing their botnets. When you take into account the number of malicious URLs being hosted, the unsecured and universal application that is the Web browser, and then the fact that half of the vulnerabilities disclosed over the last three and a half years are related to Web applications, all of a sudden the Web looks like the Wild West.”

Threat Stampede

Today’s biggest Web threats, according to Holden, are XSS (cross-site scripting), SQL injection, and PHP file-includes. Further, according to the X-Force 2009 Mid-Year Trend and Risk Report, Firefox vulnerabilities are also on the rise, and ActiveX threats continue to be the most exploited client-side vulnerability. The report also notes that the number of new malicious Web links discovered in the first half of 2009 increased a whopping 508% over the same time period in 2008.

Data at rest is particularly vulnerable to Web attacks, says Mike Logan, president of Axis Technology (www.axistechnologyllc.com), because these threats “sniff out” and collect the data. This vulnerability is exacerbated when employees click rogue links they find in emails or on Web sites—including social networking sites such as Facebook—which in turn can open the door to quickly evolving phishing scams and similar malware.

“Both phishing and malware use a combination of advanced technology and social engineering techniques to steal identities, money, or resources without the user knowing until well after the crime has been committed,” says James Brooks, director of product management for Cyveillance (www.cyveillance.com). “To make matters worse, both threats have grown exponentially over the past five years, consisting of millions of unique attacks during that period.”

Fighting Back

Although standard antivirus and firewall technologies continue to be stalwarts in the battle against Web threats, the far-reaching sophistication behind DoS (denial of service) and other attacks now forces many enterprises to go beyond traditional security methods. Because Web threats can now reach almost every point in the enterprise, security must similarly reach beyond just the data center to protect end users and everyone in between. Policies required to deliver that security might not prove popular with employees, but that shouldn’t stop management from enforcing them.

“Organizations must stand strong in the face of the sentiment that security somehow impedes productivity as well as the continued expectations around personal use policies,” says Jim Ivers, chief marketing officer for Triumfant (www.triumfant.com). “The Marines took some heat on their decision to ban Twitter and other social media outlets, but they suddenly looked very sage when Twitter suffered a long DoS attack within days of their announcement—and even smarter now it has been revealed that botnets can be controlled via Twitter.”

Employees might skip around the Web with little or no knowledge that threats lurk behind those jaunts, spurring the need for managers to raise enterprise-wide awareness. Matt Watchinski, senior director of Sourcefire’s Vulnerability Research Team (www.sourcefire.com), says that although plenty of people think nothing bad will happen on the Web, it’s still imperative that organizations educate their employees on the dangers of Web-related threats.

Watchinski also recommends that patch management systems are updated not only with Microsoft Windows updates, but also with client packages. “I’ve seen a lot of organizations stop at the point that all their Windows systems are actually getting updates on Patch Tuesday, which just isn’t enough these days. You’ll need to make sure that things like Adobe Reader, Firefox, Flash, etc., are getting updated, also. Additionally, if your organization can support this type of environment, don’t let people run whatever application they want. Cut it down to a list of approved applications that can be updated and maintained over time,” he advises.

Holden adds that other Web-targeted tools, such as Web filtering and Web application testing (especially during the development process), are a must to prevent problems. Similarly useful, he says, is an intrusion prevention technology that can detect and even prevent Web browser and Web application threats in a nonreactive manner.

A newer aspect of the Web can actually be a benefit for enterprises seeking additional refuge from Web threats. Christopher Ciabarra, president of Network Intercept (www.networkintercept.com), explains that an access-controlled cloud environment could help to safeguard organizations from major Web-based attacks, including DoS.

“It would give your organization multiple access points to enter the cloud around the world, which would make it pretty hard to be under a DoS attack, as each entry point would have to go down to be an effective DoS attack,” Ciabarra says. “With access control plugged in, each user would be accountable for their actions and could be disconnected at will if they try to perform an attack, safeguarding all enterprise assets from attacks.”

No Longer Business As Usual

According to Ivers, although the use of the term “Web 2.0” is overdone, it remains crucial for organizations to recognize that the fight against Web threats is quite unlike the fights of years past. Innovation must be applied to both strategy and technology implementation to battle continually evolving threats that attack enterprises in perpetually different ways.

“Any organization that uses a business-as-usual approach to IT security is simply fighting a different battle than is being waged by the other side,” Ivers says. “Cyber criminals are certainly not attacking in a business-as-usual mode.”

Article by Christian Perry for

CONFERENCE SCHEDULE

National Association Partner

ITEC-TV

Weekly ITEC-TV netcast live or on-demand!

Featuring ITEC General Manager Bill Sell and ExtremeLabs analyst Tom Henderson every Wednesday at 4:00 PM Eastern time.

Each week ITEC-TV hosts leading IT experts examining the day's most newsworthy technology issues.

ITEC Conference & Showcase

ITEC Connect

Waging War With The Web

Christian Perry

10/6/2009

CONFERENCE SCHEDULE

National Association Partner

ITEC-TV

ITEC Conference & Showcase

ITEC Connect

Waging War With The Web

Christian Perry

10/6/2009

Subscribe to ITEC Connect Newsletter

CONFERENCE SCHEDULE

National Association Partner

ITEC-TV