Think of the impact that IT has on our society, let alone the workplace. There are so many things that we can do because of it and as a tool, things could go totally wrong sometimes. It is very tempting to get the company’s confidential documents and sell them to the competing company, client information could be tampered, and so on. Calum Macleod of Cyber-Ark has shared some tips in order to avoid this in your own company.
- Do not expose your internal network
- Make sure that intermediate storage is secure
- Ensure that Data at Rest is protected
- Protection from data deletion, data loss
- Protection from data tampering
- Auditing and monitoring
- End-to-End network protection
- Auditing is required to ensure that a detailed history of activities can be reviewed and validated.
- Process Integrity
Think of the system you have in your company. Find out if your data is at the risk of being tampered. Ask yourself, are you auditing and monitoring? Maybe it could just be this one time of lapse wherein you let one person get out of your office with a lot of important documents. Now that is bad. You never know what this person will do with your data. Even if the person will not sell them to the competing company, the mere act of it being with that person. Are your computers safe from tampering or are they quite vulnerable? If they are quite vulnerable, it might be high time for you to change it.
You might end up having a very strict company policy when you find out that your company documents (among others) are at risk. You would want to keep your reputation when it comes to dealing with your clients. Another thing is that you would like to make sure that everything that you have is intact for your own sake (like filing away some papers). Once you have assessed the existing company policies, you could probably take a break and have a cup of coffee to help you relax a bit.
Tags: IT Security Basics, Network Security, Physical Security, Real-World Issues, Tips
Categories: IT Security Basics, Network Security, Physical Security, Real-World Issues, Tips
I’ve always thought that hackers stick together when it comes to controlling someone’s machine, but apparently they don’t. The Trojan SpamThru comes with its copy of anti-virus software to remove any of its competitors from the machine.
Malware that attempt to block access to anti-virus software updates is pretty common, but this takes a different tack to keep itself ahead of its rivals. How does it work? SpamThru secretly installs a pirated copy of Kaspersky’s anti-virus for Wingate onto your compromised computer from a server controlled by hackers. It then programs to bypass any license signature checks before downloading updates. That means users remain unaware of the hidden anti-virus scanning for any of the other malware and eliminating them. SpamThru also uses P2P to control all of the machines it has infected. Even if the central server gets shut down, the hacker can immediately update his peers in the network to identify a new central server. As long as he controls one peer, his network will remain strong. All this is done so SpamThru’s built in junk mail dispatching client can operate in peace. It can even randomize the height and width of embedded gif files in the spam sent to defeat anti-spam solutions that reject e-mail with static images.
Good thing it’s easy to remove by downloading the latest set of anti-virus updates. This increase in sophistication, comparable with commercially available software out in the market, does raise an interesting question. If the hackers can use anti-virus software to promote their own ends, will security personnel come up with ways to put viruses and Trojans to good use?
[tags]news, trojans, malware[/tags]
Tags: Malware, News, Real-World Issues, trojans
Categories: News, Real-World Issues
I use search engines to look up everything. Recipes, news, info on whatever interest me at the moment, everything can be found at after typing a few words in the search bar. Since it’s become commonplace to use search engines, hackers look for ways to exploit this habit. Typing popular keywords can return even risky sites in the first pages results, since search engines have little to no filtering security measures being implemented. Sites with sponsored ads are even more likely to contain embedded adware and trojans. Though search engines may have advertising policies and listing and ranking rules about which sites show up in their search results, it’s up to the user’s good judgment to select what sites they will visit.
Search engines can also be a doorway to malware because of caching. Caches are used to store a backup copy of data temporarily. Search engines like Google and MSN save a virtual copy of a site in their servers, so even if a site goes down or is inaccessible due to slow connection speeds, the information and data can still be retrieved. Companies and service providers often use caching servers to speed up performance and lessen traffic in the network. But what if the site has a piece of malicious code embedded into its pages? Caches don’t save everything on a page, but a malicious piece of javascript will be part of the copy. The cached copy is identical to the original in that aspect, so accessing a cached page will have the same effect as accessing the original. So keep that in mind while browsing through your search results.
[tags]search engines, caching[/tags]
Tags: caching, Real-World Issues, search-engines, Spyware
Categories: Real-World Issues, Spyware
October’s turning out to be browsers revamp month with Microsoft’s release of Internet Explorer 7 last week, and Mozilla’s Firefox 2.0 coming out tomorrow. Though Opera isn’t getting a new version, it does give a public advisory concerning a flaw with long link handling, ending with a recommendation to update to Opera 9.02. The improvements to these browsers can spell an increase in popularity, but only if the maintain the interest of their current loyal customers and capture that of their competitor’s.
So far the latest Firefox’s near release candidate has allowed several comparisons to be made with IE 7. Both browsers offer tabbed browsing, feeds support, and an easy way to manage bookmarks. The customizations users can do has increased, now that IE also offer add-ons (the equivalent of Firefox’s extensions) though there are differences in the way they manage them.
The antiphishing features and improved security for both browsers will come as a relief to users who’d had to deal with these phishing attempts for the longest time by using different methods. Though Firefox and IE both check a site’s address against a list of known blacklisted phishing sites, IE also sends a warning if a site is suspicious. IE had increased its default internet security rating to high, and warns if any changes in the settings may endanger your computer. The option to delete your browser’s history, currently available in Firefox 1.5, has been added to IE.
This battle between browsers, especially when it comes to their improved security features, highlights how important this issue has become. But in the end, only the user can decide if he will stay with the old, or change to the new.
[tags]browsers, ie 7, firefox 2.0[/tags]
Tags: browsers, firefox-2.0, ie-7, News
Categories: News
Companies these days provide for mobile devices their employees use to ensure they’re available at all times. The downside of this is that their employees may also use these laptops and phones for personal use, all at the company’s expense, and the real risk of losing valuable data if they’re stolen. We’ve talked about data breaches caused by stolen laptops before. Companies should begin weighing the advantage of employee mobility with the disadvantages of possible data loss and decreased productivity.
It’s become much easier for employees to download movies, music, and watch video streaming while in the office and then load them to their mobile devices. Instead of working, they might be tempted to watch their downloads during company hours. Some pornography and gambling sites have begun to exploit this trend by offering their services for phones. These are the very same sites most hackers use to spread their viruses. This way confidential data on these devices can be breached and destroyed even without the user’s knowledge.
For the past few years companies have filtered e-mail and limited web access in the office, but similar control does not exist for mobile devices. Until the advent of similar filtering software, companies can opt to acquire and manage the distribution of their phones to their employees. In such a situation each employee is responsible for their usage. They can also create guidelines and policies to limit how the employees can and cannot use their phones, though they should be aware that their employees will resist stringent control.
[tags]mobility,productivity,mobile devices,filtering software,usage,software,employess[/tags]
Tags: employess, filtering-software, mobile-devices, mobility, productivity, Real-World Issues, Security Policies, software, usage
Categories: Real-World Issues, Security Policies
