As it turns out, students in the many fields of IT such as software development are still being taught the lessons of old and not being taught how to pro-actively design software to defend itself from attack. This is the result of a recent survey which shows that many programmers and developers to be are not getting ample courses in integrating security into their systems. They are left to fend for themselves and have to rely on patches to overcome development bugs that could have been fixed before they became problems in the first place.
I started out as a programmer in the glory days of FoxPro and C++ and such events that we have now are non-existent or are not as malicious as they are now. Back then, they simply messed up the display of garbled the contents of a floppy with no bearing on Phishing or Vishing and the myriad of stuff today’s malware do. Security has become such an issue with development that people today have to rely on anti-viruses and other intrusion prevention systems for their systems to remain reliable. Incorporating more security into applications would prevent weaknesses even if bugs are present in the program for no system is totally fool-proof. We would still need these intrusion protection systems yet not as highly dependent on them for basic security needs.
Most companies rely on million dollar contracts with software developers who design software to protect their software, McAfee, Symantec and many other security software developers have shifted focus more on intrusion prevention and less on anti-viruses for today’s malware have gotten to a level of sophistication that they can self-modify themselves to elude anti-virus programs of the past. Integrating encryption and other security provisions into the software itself may take longer but it would provide a level of security that hackers would not find easy to break. Education is the key and knowledge is power, so giving the next generation of developers the knowledge to incorporate security greatly increases the level of power over these malicious programs and the hackers who make them.
Handhelds : Still the Biggest threat to Corporate Security
Employee’s love them, Network Administrators hate them, the advent of more function packed handheld devices have sparked a re-evaluation of the threat these small devices pose. Traditionally, networks were quite safe for to gain access to it you needed to be hooked up to the network, physically with a LAN cable. Now that the shift to wireless has become the network engineer’s best friend the network has surely been simplified and companies are switching to the new technology. Thy no longer needed wires and all existing computers are either replaced with ones that support Wi-Fi or bought individual dongles that allowed connection within the office. That was still an easy security agenda for they usually had a range of a couple of hundred feet.
Then came wireless internet hotspots which commercial developers started to put up to get more workers out of the office into their shops allowing them to work while, say having coffee. That’s where the problems began for the more office correspondence left the walls of the office, the more harder was it to secure. VPN’s were implemented that allowed a secure channel within existing networks making it a bit better. But that was still quite vulnerable to attack and security experts needed a better way of securing corporate data where-ever the user might be. Projections by business and security analysts estimate volume to increase to 100 million email transactions to and from outside the office locations that is still causing nightmares as the next step is found in the drive to secure this network without physical bounds.
[tags]Handheld Computing, Mobile Computing[/tags]
Another Bug hiding in the Thick – Exploits
The evolution of the internet has given us the Web 2.0 which is a more open form of the previous internet. The traditional internet had people and companies make their own web sites on their own computers or servers, with anybody else just logging in and getting (actually it’s more of reading) the stuff that you need and leave without getting a chance to tell the site’s owner if the information was either very helpful or a complete waste of time. Net 2.0 has allowed the opening up of borders between the said linked computers allowing people to become more interactive in their use of the web. You search for an article on the web through a search engine and find yourself in a blogging site. The information you find is very much useless so you leave a comment telling the owner such. He then reads the post and makes the information on the blog more informative thus giving him feedback on the contents of the site. This was totally unheard of in the old internet days when, what you see was what you got (literally).
The social Net 2.0 has allowed users to influence the way the internet is setup along with the information it contains. Companies get instant feedback from users thus allowing them to improve customer services. The problem, exploits or another form of malicious code that is up to no good. Imagine a social web site like MySpace where you have a page that you share over the net with your pal’s. A hacker finds a hole in the security net and leaves a few short lines of code in the form of a hidden program. It then takes all information you send and receive or use, such as purchase information from internet-based companies. This exploit, turns your page or rather the information gathered from it into his personal atm machine, using the information he has leeched and goes on a shopping spree online. Sounds crazy? You figure it out. Google found almost half a million of such exploited sites out of only 4.5 million surveyed sites (which is only a fraction of the total computers linked on the internet).
You do the math….
Data Security and Integrity
Information is knowledge so information is power. Much so that data that is used, stored and shared within a business environment as all of us know is the subject of too much security that has data centers locked up away from the actual site. Some companies even have armored or secure clean rooms where if something was to happen in the actual office or work site the data center can survive anything under a nuclear blast. But most it professionals still forget the importance of integrity of data that is stored within these data centers.
Yes they have been secure for all the years the several servers have been sending and retrieving data to and from the data center but is the information that we work so hard to keep intact accurate? What if some malicious code somewhat managed to sneak past the thousand dollar anti-virus and other protective software? And has been wreaking havoc within the data center walls? I mean, they do not have to destroy or corrupt the data for as simple alteration of making 1’s into 0’s could be enough to reduce all the information stored within useless.
That is where redundancy comes in which many people now consider to be an old fashioned approach and a waste of important resources. Say a back-up tape/s of all the initial data that is updated with current data say yearly and processed with the same information that entered the data center in a parallel run to see if all was well. It might seem to be a lot of work and investment of manpower but it is assured to keep the integrity of all the information within, going in and out of all data centers. Say a 1,000,000.00 pension suddenly turned into a 1,100,000.00 pension, wouldn’t that ruin your day?
That’s why companies like RSA’s Enterprise Data Security offer in Data security and control systems to prevent such problems from arising in the first place. In any system, the weakest link is till the human operator who can easily misplace a file or other data that can make or break a company. So instead of having to develop their own systems for the same purpose, most opt to hire someone to do that job for them which allows the business to do what it was put up to do, earn a profit.
Better Security by Thinking as a Hacker
The best way to find out the security breaches is to think like a hacker on how to penetrate a secure network through various means. Accessibility to servers may have to go through different stages since various encrypted usernames and passwords would stand in the way of a successful hack.
The approach is quite simple. It is a reverse psychology of sorts since to become a full-proof secure system, ways on how to be able to get over the fences for such walls that have been put off must be severely tested.
Unorthodox as it may seem, the various approaches to be done will certainly be simple at this point because at the rate that hackers are able to go around security fences today, a lot of progress has been made in being able to make the lives of administrators a living hell as far as IT security is concerned.
[tags]hacker, network security, breach, coding, cracks, cryptography[/tags]
How To Optimize Websites and Be Safe
It is perhaps the dream of most sites to be one of the known sites that will be included in the affordable search engine optimization practices we have today. Many have resorted towards link building and other known online marketing practices and have paid dividends by entrusting the same to companies such as Los Angeles SEO.
But of course, there are security concerns that most people take into consideration today. One is that potential worms and Trojans may just take the place of a site, providing the irritating pop-ups which are usually the origin of these said worms and banes of the Internet.
While search engine optimization is what many web and blog site owners are aggressively seeking, just make sure you do it the professional way and avoid the scam and spammers the web holds as well today. Rather than becoming an ideal site, you may just find your site the least one to be visited at any given day due to hazards many are avoiding.
[tags]search engine optimzation, seo, online marketing, security, worms, trojans[/tags]