Archive for December, 2008

UK government needs to move faster to protect infrastructure

Wednesday, December 24th, 2008

I feel very strongly that government needs to take a tough stand on cyber crime, so it was interesting to learn from Network Box’s recent research that 80 per cent of businesses believe the government is not doing enough to protect our national infrastructure from cyber threats.

Earlier this year, we saw a debate in the House of Lords that followed its 2007 report on Internet Security, calling for increased measures by government to protect the UK from cyber threats. Little seems to have changed since the first report. The thing that is the most worrying to me is the lack of international co-operation on cyber crime. While the UK is working with the EU on a five-year plan in place to fight Internet crime, this isn’t really tackling the problem – the vast majority of threats come from outside the EU, particularly from Russia, the US, China and Brazil.

The other concern I have, and one that is reflected by businesses, is a lack of speed of response by government to these threats. Cyber criminals move fast, and government simply doesn’t respond quickly enough to deal with them.

Our research showed that the majority of businesses (61 per cent) believe that malware downloaded from the Internet is the single biggest threat to security. As we move into 2009, businesses need to ensure that they are providing adequate protection to their employees who use the Internet, in the same way that they have done with email, to prevent malware being downloaded from websites.

But this is still treating the symptom, not the cause. I would be delighted if a new year brings a renewed willingness by governments worldwide to work together to combat the menace of cyber crime. Sadly, I feel that this would be over-optimism on my part.

The new endpoints – are we prepared?

Thursday, December 18th, 2008

The lines between personal and work Internet use are becoming more and more blurred. This year was the tipping point that saw the battle for corporate network security being fought at new endpoints. Smartphones, PDAs and laptops are widely used; most employees regularly use social networks such as LinkedIn and even Facebook for legitimate business reasons, and corporate blogs and the likes of Twitter are becoming the norm in business life. Employees are working remotely – either from home or on the move; and sharing and transferring data is commonplace.

These new endpoints are becoming the new Trojans in terms of security risks, and many companies simply don’t have the security measures in place – including effective education of their employees – to address the new working practices. We’re all increasingly relaxed about downloading information from friends, or sharing personal information on social networks, and this can lead to complacency.

Cyber criminals are very aware that they can take advantage of social network users’ natural curiosity to spread potentially malicious applications: 2008 saw a wide range of social media sites compromised and used to distribute malware.

2009 is likely to see a rise in personal data theft, and in SQL injection and cross-scripting attacks on websites. With so many more sites to monitor in corporate life, network security managers must plan accordingly.