Endpoint
5/18/2012
03:55 PM
Connect Directly
RSS
E-Mail
50%
50%

How To Keep Your Users -- And Your Data -- Safe On The Web

Careless -- and occasionally malicious -- Web-browsing users might be the most serious threat to your organization's data. Here are some tips for keeping it safe.

On the Internet, nobody knows you're a dog. And increasingly, nobody knows you're a hacker.

In the past year, attackers targeting businesses have started making more use of stealthy Web-borne attacks aimed at end users--specifically going after employees. Emails with malicious links, drive-by malware downloads, and error messages pushing fake antivirus scanners are all popular methods hackers are using to get through your company's front door.

Last year, 39% of email-borne malware consisted of hyperlinks, not attachments; that was up from 24% of email that carried hyperlinks in 2010, according to the latest version of Symantec's Internet Security Threat Report.

Why all the focus on the Web? Because it works. Over the last year, we've seen major breaches, at companies including Sony, RSA, and Zappos.com, and several U.S. military contractors that started with a few clicks on a malicious link. Employees need only make one mistake and they can open the door to targeted, sophisticated attacks and cause mayhem in your business.

"We are seeing the Web being a preferred medium for attackers," says Paula Greve, director of Web security research at McAfee, Intel's security software subsidiary. "It becomes a lot harder for the user to discern whether something in their inbox or on the Web is something that want to go to."

Hackers often use email scams to get people to click on a link that pulls in malicious content from the Web, fooling people into downloading malicious code and circumventing corporate information security measures.And the Web is increasingly being used as a medium to carry malicious communications between infected computers and command-and-control servers. Nearly half of all malicious software communicates out to the Internet within the first 60 seconds of infecting a computer, and about 80% of those communications use some form of Web protocol, says the Web filtering and security company Websense.

Exploitation using the Web has become easier with the availability of more advanced malware creation and distribution programs, such as the Blackhole and Phoenix exploit kits. In addition, it's getting harder for users to determine if a site is dangerous. The vast majority--about 61%--of sites hosting malware are legitimate, according to Symantec's Norton Safe Web service, which identifies malicious websites. And it's not gambling or porn sites that have the highest proportion of compromised pages--it's religious sites that do. In many cases, the site itself isn't the problem, but rather third-party content, such as advertisements, that carries the malicious attacks.

IT pros may look at the numbers and say, "How can this website be infected? It is a top-1,000 website," says John Harrison, group product manager with Symantec's security response group. "Well, it may be an advertisement on the site, and that makes our job difficult, because it may be one in 10,000 advertisements that come up in rotation."

Coping with these threats isn't easy, especially as hackers focus more on gaining access with browser-based and social network attacks, as well as efforts that take advantage of mobile device weaknesses. But there are steps companies can take to protect against these tactics.

Robert Lemos is a veteran technology journalist of more than 16 years and a former research engineer, writing articles that have appeared in Business Week, CIO Magazine, CNET News.com, Computing Japan, CSO Magazine, Dark Reading, eWEEK, InfoWorld, MIT's Technology Review, ... View Full Bio

Previous
1 of 5
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2963
Published: 2014-07-10
Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName, (2) _2_lastName, or (3) _2_middleName parameter.

CVE-2014-3310
Published: 2014-07-10
The File Transfer feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center does not verify that a requested file was an offered file, which allows remote attackers to read arbitrary files via a modified request, aka Bug IDs CSCup62442 and CSCup58463.

CVE-2014-3311
Published: 2014-07-10
Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467.

CVE-2014-3315
Published: 2014-07-10
Cross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCup76308.

CVE-2014-3316
Published: 2014-07-10
The Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload restrictions via a crafted parameter, aka Bug ID CSCup76297.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.