Risk
10/1/2013
10:48 AM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

Online Trust Alliance Embraces National Cyber Security Awareness Month

Announces three-part initiative to advance industry self-regulatory efforts

Bellevue, WA (October 1, 2013) – On the 10th anniversary of the National Cyber Security Awareness Month, the Online Trust Alliance (OTA) today announced a three-part initiative to advance industry self-regulatory efforts addressing security and privacy issues that affect consumers and businesses worldwide.

Networks of malicious malware - known as botnets and fraudulent ads are at the center of online privacy and security concerns. The explosive rise in botnets is estimated to have compromised one in 10 home-based computers. Concurrently, international cybercriminals are increasingly using malicious and fraudulent advertising, known as malvertising to compromise users' privacy, bank accounts and to facilitate identify theft. In just the past twelve months, OTA estimates over one-billion malicious ad impressions were served to unsuspecting consumers as they surf the web. Counter-measures introduced by OTA today to combat this problem include:

• Botnet Remediation & Removal Best Practices

• Fraudulent Advertising & Customer Risk Framework

• Customer On-Boarding Best Practices for Hosters and Cloud Service Providers

OTA was recognized by the White House last year and recently re-appointed by the Federal Communications Commission to the Communications Security, Reliability and Interoperability Council, OTA as a leading convener of multi-stakeholder efforts. OTA works across the ecosystem with commerce sites, advertisers, hosters, ISPs, financial instructions, and security vendors to provide prescriptive advice to help neutralize botnets, stem the spread of malicious and fraudulent advertising, and help cloud service providers identify fraudulent businesses.

"It is critical that we implement technical safeguards, but also equip business and internet intermediaries with the tools needed to help stem the tide of cybercrime," said Craig Spiezle, executive director and president OTA. "By implementing these practices, consumers, businesses, and industry will mutually benefit. Businesses who fail to adopt are unnecessarily putting consumers at risk."

"We have a shared responsibility to help prevent, detect, and remediate the spread of botnets. Collaboration among ISPs, the security community, OS providers, banking and commerce sites is a key to fighting these threats. It is critical for users to keep their software applications up-to-date including protection from malicious downloads and dubious apps," said John Scarrow, general manager of online safety service at Microsoft.

"One 'bad actor' can hurt an ESP's or hoster's overall reputation and adversely affect the reputation of other customers using the same infrastructure. Having a solid vetting process in place can obviously help minimize the risk to an organization's reputation," said James Koons, chief privacy officer at Listrak. "Being on the front lines we have learned vetting is a great opportunity to detect fraud while enhancing client relationships. OTA's New Account Risk Framework is an excellent tool for any organization and underscores the value of collaboration and data sharing."

Recognizing that over one billion malicious ad impressions were served this past year, the OTA Advertising Security Working Group has been working with publishers, ad networks, and advertisers. Based on their analysis upwards of 60% of malvertising is attributed to cybercriminals merely masquerading as legitimate advertisers or agencies inserting malicious and fraudulent ads. These prescriptive guidelines will make a significant dent into the threats which are undermining the trust and integrity of online advertising.

"Protecting the integrity of online advertising is critical to the industry and the vitality of the internet. The combination of malvertising, click fraud, and ads from fraudulent companies is undermining consumer trust, which in turn undermines marketing effectiveness. We call on our partners and fellow ad networks to adopt these best practices to help stem the tide of fraudulent and malicious advertising," said Paul Harrison, co-founder and chief technology officer at Simpli.fi. "We applaud OTA's leadership to help protect consumers' data, identity and privacy from abuse."

These documents and additional resources are available at https://otalliance.org/resources. OTA will be hosting webinars providing prescriptive advice to enhance consumer protection and online trust.

Thursday, October 3, 9 AM PDT – Noon EST

On-Boarding Best Practices for Ad Networks, Hosters & Cloud Service Providers

https://cc.readytalk.com/r/qg2gdfyhikcy&eom

Friday, October 4, 9 AM PDT / Noon EST

Anti-Botnet Remediation Best Practices

https://cc.readytalk.com/r/6xwcmo5v6cev&eom

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
themagnificentdance
50%
50%
themagnificentdance,
User Rank: Apprentice
9/19/2014 | 11:40:45 AM
Adtomatik is the best!

Adtomatik has been my predetermined ad network for a long time. Never tried anything better. Higher fill rates and the best ecpm. An the most important thing: it's brand safe! Recommended!
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.