Keep viruses out of your network Archives - Foster Institute

Stop Drive-By-Downloads

Mike Foster — Thu, 05 Apr 2012 04:00:20 +0000

It is time to review your anti-spam filters and your web-filters to ensure you are adequately protected against targeted email attacks as well as drive-by-download attacks. The latter attacks happen when one of your users visits an infected site. The settings your IT department configured in 2011 probably need to be reconfigured to repel new attacks.

When I perform IT audits, IT Professionals, more often than not, express frustration that the anti-spam and/or web protection is inadequate. Either you don’t have the proper tools, or usually you already have the tools but tied IT’s hands. Ask IT to make reconfiguring and/or activating these tools a priority.

Good anti-spam solutions block unwanted email, allow email you are interested in receiving, and even attempts to block viruses arriving via email. One of the biggest signs of a good service, in addition to working properly, is that the service saves your workers and your IT team time by not needing to babysit the anti-spam solution.

Eliminate specific E-mail attachments since they may contain malicious code. This infection vector is a significant source of infections that lead to attackers gaining control over major assets in your network.

It is important for security and productivity to implement a solution to block Internet access to inappropriate sites. While most everyone in an organization can quickly agree on blocking certain sites because the inappropriate content could endanger the organization. For other categories of web sites, there may be more than one point of view.

Consider, at least initially, only blocking the sites that everyone can agree need to be blocked. Simply activating the blocking tool will usually help reduce drive-by-downloads at some sites.

Many firewalls support web filtering although many firewalls do not provide reporting features with enough detail. If your solution is inadequate, then upgrade the firewall or add a tool that will provide this functionality.

Please post your comments on this blog.

The post Stop Drive-By-Downloads appeared first on Foster Institute.

Quickly Identify an Attack Email Message–Know thy Enemy

Mike Foster — Thu, 29 Mar 2012 04:00:02 +0000

Many attacks come from the outside world. Those attacks are directed at your users. There are two ways, and teach these to your workers, to identify almost all of these dangerous email messages before the user clicks on them.

The giveaways are:

The email message has some kind of urgency. For example, “such and such will expire unless you…”
There is a link in the email or, less commonly, an attachment to the email message. Those links, when clicked, are when attackers can interact with your users in ways from tricking the user into giving out personal information to injecting malicious code into the user’s computer.

Protect your system from attacks. Teach your users to quickly identify the “urgency” and “click here to…” dangers.

Please post your comments on this blog.

The post Quickly Identify an Attack Email Message–Know thy Enemy appeared first on Foster Institute.

Make Security Awareness Training mandatory

Mike Foster — Thu, 13 Oct 2011 04:00:39 +0000

These days one of the best defenses against criminal IT hacks is to have users who are “on the lookout” for malicious temptations. For example, anytime a user receives an e-mail message that indicates some kind of urgency.

Messages such as “your account is about to be suspended” is most often a virus. Especially if the e-mail message contains a link and/or has an attachment. Another example is a message that indicates “Your order just shipped” from a company the user never ordered any product from. The immediate temptation is to click on the link in order to investigate and/or see if the order can be cancelled.

It is imperative that all of your users learn about common dangers and follow best practices. Require them all to attend the training courses you provide. Next time we’ll focus on the best delivery methods.

Please post your comments on this blog.

The post Make Security Awareness Training mandatory appeared first on Foster Institute.

Old-school anti-virus is no longer the best protection

Mike Foster — Thu, 29 Sep 2011 04:00:11 +0000

Anti-virus sounds like a great feature, right? But anti-virus can be ineffective in fighting newer threats.

For years, anti-virus tools attempted to detect viruses by looking for known “signatures.” Think of the “signatures” as a thumbprint of a virus. The anti-virus tools look for those thumbprints and the anti-virus vendors constantly update “signature” files in an effort to keep up with the thumbprints of all new viruses.

These days, some viruses can “morph” at regular intervals—keeping their same dangerous functionality and avoiding the signature matching. An analogy would be someone being able to change their thumbprint one or more times each day.

Over the years anti-virus has evolved to include new ways to stop viruses. One way is to watch for dangerous behavior. The problem here is for the anti-virus tool to be able to discern if the dangerous behavior is being performed by a legitimate process or a virus.

Anti-virus vendors are constantly playing the “cat and mouse” game of keeping up with new virus strategies. This is one more reason to always stay current with the latest anti-virus offerings available.

Please post your comments on this blog.

The post Old-school anti-virus is no longer the best protection appeared first on Foster Institute.

Should executives buy a second computer for banking?

Mike Foster — Thu, 30 Sep 2010 04:00:06 +0000

Has anyone every recommended that you buy a second computer for your home to use strictly for online banking and financial transactions?

This is a common recommendation and indeed, that would help you be more secure. I’ve even promoted something similar to this in my blog. You can read it here: https://fosterinstitute.com/blog//banking/.

In reality, an additional computer can be expensive and the chances are, at some point, some user will use that computer to access the Internet anyway and now the “banking only” computer is infected too.

There are other solutions, such as using VMware Desktop, to launch a “clean” browser to use for online banking, however VMware desktop is a little technical to set up and use for most senior executives. As time goes on, browsers are starting to run in their own isolated space that helps, too.

Another option is to use a product such as Faronics Deep Freeze that makes your home computer “go back to brand new” every time you reboot. That’s like having a new computer every time you sit down!

I feel the most probable solution is to make your home computers really secure and then use them for banking. This includes patches, anti-virus, a robust firewall, etc. If you want to take the extra step to get a separate computer, and make it super secure too, then you may decide that is best for you.

Please post your comments on this blog.

The post Should executives buy a second computer for banking? appeared first on Foster Institute.

A virus possibly contributed to a fatal passenger jet crash

Mike Foster — Thu, 02 Sep 2010 04:00:42 +0000

On August 20, 2008, 154 people died when Spanair Flight 5022 crashed right after takeoff in Spain. A preliminary report, discussed in an article in the Spanish daily newspaper El Pais indicates that a diagnostic computer should have detected problems with multiple systems on the aircraft. Had the problems been detected, the takeoff would have never been attempted. The computer was infected with a virus or other malware.

In theory, if the malware had not infected the diagnostic computer, the problem with the aircraft system would have been discovered, and those 154 people would still be alive.

Will viruses and other malware contribute to injuries and deaths? Imagine diagnostic imaging machines, like X-rays and CAT Scanners, exposing patients to too much radiation due to a virus. Traffic lights not functioning properly, especially on a highway with high speed limits, could lead to a horrible crash. Emergency services may already be delayed in their response due to computer malfunctions. The airline industry has plenty to worry about. What if trains fail to stop and crash into another train or the end of the line?

Apparently the Spanair diagnostic computer does not connect to the Internet so the infection likely came from an infected USB device, CD-ROM, or some other form of removable media.

Just last month, control systems manufacturer Siemens, who manufactures control systems, warned that malware called Stuxnet is spreading through infected USB devices to penetrate industrial control systems. I wonder if there are any control systems at nuclear power plants infected yet.

More and more regulations and laws are forcing organizations to wake up to the fact that IT security is very important.

Business executives and IT professionals alike must realize:Viruses and other malware do not necessarily make themselves obvious for the simple reason that, if you know a computer is infected, you are likely to have a qualified IT professional fix the problem.

Anti-virus programs do not always catch all viruses
Firewalls are not perfect either
End users can, accidentally or on purpose, bypass some of the best security you set up

How many more people will need to die, how much more money will be lost, before people become aware of the importance of IT security?

Please post your comments on this blog.

The post A virus possibly contributed to a fatal passenger jet crash appeared first on Foster Institute.

Is anti-virus obsolete?

Mike Foster — Thu, 29 Apr 2010 04:00:24 +0000

The problem with anti-virus programs these days is that so many viruses come out every hour that anti-virus programs can hardly keep their list of virus signatures up to date. If your anti-virus program doesn’t know a virus is “bad” until hours after the virus arrived, you are still infected and it may be too late.

A strategy that keeps gaining ground is the concept of “white listing” applications. In plain English, this means your computers have a list of programs that are on the “approved” list to run, such as Word, Firefox, Acrobat, Excel, etc.

Then, any other program cannot run. Period. That means virus 1, virus 2, virus 999, etc. is not allowed to run. This solves the whole problem of needing anti-virus. In theory, even if a virus does come into your network through e-mail, web site drive by download, or Ernie in shipping carrying in an infected memory stick, it doesn’t matter. The virus cannot run anyway!

The challenge lies in your IT department being able to keep an organized white list of “approved” programs. When an update to a program arrives, the new update has to be listed too or it will not run.

Many providers are offering solutions including Bit9 Parity and Lumension Application Control and there are constant advancements in making administration even easier.

Yes, some day anti-virus may be old news and never used again.

The post Is anti-virus obsolete? appeared first on Foster Institute.

Are vulnerability scans of your network helpful?

Mike Foster — Thu, 22 Apr 2010 04:00:12 +0000

As part of the Foster Institute IT Security Assessments, we always offer to perform vulnerability assessments and they are indeed very helpful. Executives can help IT professionals overcome the negative effect to the results of a vulnerability scan…

The primary reason we perform vulnerability assessments as parts of security assessments is to generate an inventory of all the computers currently alive on the network and a list of vulnerabilities those computers have.

The challenge is that the human brain loves a “list of what’s wrong.” Most of the IT professionals at organizations go immediately to work solving the identified problems thereby “killing alligators.”

We always implore executives and IT professionals alike to focus on “draining the swamp” in addition to, and sometimes instead of, “killing alligators.”

In our ongoing effort to help IT professionals and organizations focus on strategic, as well as tactical, plans to take IT to the next level, I sometimes feel like a dentist who hands out new toothbrushes as well as a gift certificate to the local candy store in the same visit.

Vulnerability assessments are wonderful—just remember to focus on the one or two strategic changes that can fix one hundred or more tactical issues.

The post Are vulnerability scans of your network helpful? appeared first on Foster Institute.

For real–beware attachments in e-mail

Mike Foster — Thu, 10 Sep 2009 04:00:36 +0000

Everyone should know better, but executives seem to think they are special. Organized cyber-gangs are sending an e-mail message directly to small and midsized company’s CFO with an attachment that installs a tool to steal banking passwords. Then the criminals transfer money out of the company’s accounts.

This article from the Washington Post has more details: http://www.washingtonpost.com/wp-dyn/content/article/2009/08/24/AR2009082402272.html

The reason criminals keep using the same old tricks is that the tricks work. Warn your fellow executives and other workers about the importance of never opening attachments you were not expecting even if they appear to come from a trusted source. When in doubt, contact the sender to see if they really did send you an attachment.

Your IT department can help you scan the attachment for viruses, and some of you have services that scan all of your attachments. Just remember that the scanning may not catch the virus. Some viruses have new code every four hours so the anti-virus programs cannot keep up with the changes.

Practice many levels of protection and be wary!

The post For real–beware attachments in e-mail appeared first on Foster Institute.

Does it help not to open e-mail from strangers?

Mike Foster — Thu, 30 Apr 2009 04:00:47 +0000

An executive recently wrote me, “I got a virus that infected our network because I opened an e-mail message from someone I didn’t recognize – I’ll never do that again!”

While that strategy may help some, it is far from being a reliable way to protect your network. First of all, without performing some technical detective work, it is hard for a non-IT professional to tell who the e-mail came from anyway. You may get an e-mail from a cybercriminal who uses “spoofing” to make the e-mail message appear that it is coming from your best friend, bank, the FTC, or anyone else.

Better protection comes from scanning tools running at one or more locations including your e-mail server, your firewall, your spam filter, and the anti-virus client on your local machine.

Training users “not to open e-mail from strangers” is a moot point if your user is supposed to open e-mail messages from prospects interested in your company’s products and/or services. There is some training that matters though…

Train your users to NEVER click on a link in an e-mail message. The link may say to the user, “click here to read an important announcement about your future employment at this company” and the link underneath may take the user to, “hose the network now dot com.”

Also train the users to never send out any private information in an e-mail message or attachment. The message can be misaddressed, intercepted or forwarded to the wrong person. If something is private, it needs to be encrypted using an effective encryption method. In another blog entry I addressed data loss prevention tools that can even help identify these messages and stop them before they leave your organization.

If your executives or other users use the strategy of “not opening mail from someone they don’t know,” that is a red flag alerting you to a problem you can resolve ASAP.

The post Does it help not to open e-mail from strangers? appeared first on Foster Institute.