Simon Heron – SecureNet

As predicted, phishing attacks are on the increase as we start to feel the recession bite. Figures that we’ve released today show that phishing attacks now account for half of all viruses.

The US is back at the top spot of malware producing countries – not quite up at the levels we were seeing before the shutdown of the McColo spam hosting service, but still significantly increased from the beginning of the year.

It really is time to review the basics of corporate security. Whenever an economy is depressed, the instances of cyber crime – just like burglaries – increase.

Time spent now on educating employees, checking your Internet use policy, and applying some common sense security measures will pay dividends through the coming months.

Yesterday I mentioned the benefits of a security review and today an example of what a review could have prevented is illustrated graphically by the following article in SC Magazine:

Government network hit by Conficker worm as trail of poor management exposed

It is sadly not uncommon for organisations not to have a policy towards laptops being connected to their LAN, we see this in companies big and small.  It is usually the case that it has always been done this way and nobody questions the procedure.  Furthermore, the people bringing in the laptops can be senior so nobody challenges them.  Worst still, is the acceptance of laptops from a different organisation being allowed to connect which still happens.  A review would have revisited these practices and would have flagged it up as a major vulnerability.

Companies must develop a policy that isolates these devices, scans and cleans them of any malware but even after this, it is still advisable where possible to lock down their access to the main LAN.  This can be done on a DMZ with thin client access to the LAN and a gateway that scans outgoing traffic.  These two precautions ensure that even if the laptop is infected with some malware that the anti-virus has not detected, it will not infect the LAN and will not be busy spamming the world from the organisation’s IP address.

We do security reviews for companies which are proving popular as we move into more difficult times.  Companies want to ensure – with the increased threat both from internal and external sources – that they are covered, and that they are making the right moves to secure their information.  In a strange way, the government have done much to increase awareness of security pitfalls, by losing so much public data themselves. On one hand everyone (quite rightly) complains; but on the other they are thinking: “I hope that couldn’t happen to us.”.  Prevention is so much cheaper than cure. Most of the time the recommendations that we make don’t involve expenditure in new equipment or personnel, but rather just the implementing of simple strategies to ensure compliance with good practice.

For instance, with increased regulation there is concern that companies might be in violation of some new law that they were not aware of.  A typical example is the changes that have been made to the Companies Act in 2005 and 2006: these are old enough, but still we see companies not making the mandatory inclusions to their emails and websites.  It is quick and easy to add the right footers and information which immediately puts the company in compliance with the Act and prevents the company from being seen to be unprofessional.

However, there are still many examples of poor practice. For example: the annual accounts being sent on unencrypted CD’s to the accountants at the end of year; or no acceptable use policy that the employees can actually understand and sign; or passwords that haven’t been changed for a year and whose simplicity is frankly appalling.

The problem for security-minded professionals, of course, is not getting in the way of companies doing business.  It is easy to recommend a raft of procedures that will secure a company – and at the same time stop it from being productive!  The task is to assess the risk, and to ensure that serious risk is identified and tackled by avoiding, mitigating, transferring or accepting it. This is what companies need to spend more time doing now.  Risk grows as a depression deepens.  A poor economy means greater numbers of disgruntled employees, desperate individuals trying to make money and increased opportunity as we become more technologically enabled.

It’s not essential to employ an outsider to do this job for you. All the information you need is on the Internet and if you have the time, you can get up to speed on it. But the advantage of an outsider is that they bring an objective viewpoint, the experience of numerous reviews across a range of companies, and the time that they will save you.

In the end, the important thing is to take action. It could save money, reputation and careers.

At the end of February, the US Computer Emergency Readiness Team (US-CERT) issued an alert that proxy servers operating in interception mode (‘transparent proxies’) may be vulnerable to hacking.

Transparent proxies are servers used to intercept and automatically redirect network connections to a given destination address – for example, in order to filter content, or for web caching or security purposes. The issue is this: as these proxies often make connection decisions based on the HTTP header of the original connection request, they have been found to be vulnerable to hackers who can forge the HTTP header via active content, potentially gaining access to the destination resource through the proxy server.  For example, this could be an Intranet that wouldn’t usually be accessible publicly through the Internet.

The risk is fairly small, but as ever, it is better to be on the lookout and prepared. Our response to customers has been to issue advice to only allow proxy servers to connect to a limited number of well-known ports; and limit the CONNECT method to traffic using destination port 443/tcp.

If you don’t know whether your company could be vulnerable, check the list of security systems on the US-CERT website. It’s not definitive, but does list most major vendors’ systems, and whether their products are affected.

If you have any doubt at all as to whether your business could be affected by this, contact your security company for advice.