Endpoint
5/18/2012
03:55 PM
50%
50%

How To Keep Your Users -- And Your Data -- Safe On The Web

Careless -- and occasionally malicious -- Web-browsing users might be the most serious threat to your organization's data. Here are some tips for keeping it safe.

On the Internet, nobody knows you're a dog. And increasingly, nobody knows you're a hacker.

In the past year, attackers targeting businesses have started making more use of stealthy Web-borne attacks aimed at end users--specifically going after employees. Emails with malicious links, drive-by malware downloads, and error messages pushing fake antivirus scanners are all popular methods hackers are using to get through your company's front door.

Last year, 39% of email-borne malware consisted of hyperlinks, not attachments; that was up from 24% of email that carried hyperlinks in 2010, according to the latest version of Symantec's Internet Security Threat Report.

Why all the focus on the Web? Because it works. Over the last year, we've seen major breaches, at companies including Sony, RSA, and Zappos.com, and several U.S. military contractors that started with a few clicks on a malicious link. Employees need only make one mistake and they can open the door to targeted, sophisticated attacks and cause mayhem in your business.

"We are seeing the Web being a preferred medium for attackers," says Paula Greve, director of Web security research at McAfee, Intel's security software subsidiary. "It becomes a lot harder for the user to discern whether something in their inbox or on the Web is something that want to go to."

Hackers often use email scams to get people to click on a link that pulls in malicious content from the Web, fooling people into downloading malicious code and circumventing corporate information security measures.And the Web is increasingly being used as a medium to carry malicious communications between infected computers and command-and-control servers. Nearly half of all malicious software communicates out to the Internet within the first 60 seconds of infecting a computer, and about 80% of those communications use some form of Web protocol, says the Web filtering and security company Websense.

Exploitation using the Web has become easier with the availability of more advanced malware creation and distribution programs, such as the Blackhole and Phoenix exploit kits. In addition, it's getting harder for users to determine if a site is dangerous. The vast majority--about 61%--of sites hosting malware are legitimate, according to Symantec's Norton Safe Web service, which identifies malicious websites. And it's not gambling or porn sites that have the highest proportion of compromised pages--it's religious sites that do. In many cases, the site itself isn't the problem, but rather third-party content, such as advertisements, that carries the malicious attacks.

IT pros may look at the numbers and say, "How can this website be infected? It is a top-1,000 website," says John Harrison, group product manager with Symantec's security response group. "Well, it may be an advertisement on the site, and that makes our job difficult, because it may be one in 10,000 advertisements that come up in rotation."

Coping with these threats isn't easy, especially as hackers focus more on gaining access with browser-based and social network attacks, as well as efforts that take advantage of mobile device weaknesses. But there are steps companies can take to protect against these tactics.

Robert Lemos is a veteran technology journalist of more than 16 years and a former research engineer, writing articles that have appeared in Business Week, CIO Magazine, CNET News.com, Computing Japan, CSO Magazine, Dark Reading, eWEEK, InfoWorld, MIT's Technology Review, ... View Full Bio

Previous
1 of 5
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8015
Published: 2014-12-22
The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400.

CVE-2014-8017
Published: 2014-12-22
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.

CVE-2014-8018
Published: 2014-12-22
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur1...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.