In the News
Keeping unwanted intruders at bay
2007-01-22
Pour l'originalarticle in Connecticut Business News Journal, Cliquez ici.
If you use a computer at work, chances are your days to watch World Cup matches or shop online in the comfort of your cubicle are numbered.
The threat from viruses, worms, trojans and spyware is so potentially costly that businesses are locking down their networks with antivirus software and spam filters, hardware appliances such as Web filters, and managed security services.
Business owners typically bear the cost of their employees' digital lifestyles, and it extends far beyond lost productivity.
Bryan Connolly of PCEase, a Guilford-based IT consultant who serves companies with ten to 25 employees, says a complaint he frequently hears from business owners is that their Internet access gets bogged down no matter how much they spend to increase bandwidth. The reason is that the computer has replaced the copier as the piece of office equipment employees most often exploit.
"You walk around the office," he says, "and you hear people streaming radio stations from where they used to live, and people watching soccer from Brazil."
Even more costly for businesses is employee Web use that introduces spyware, worms, trojans or viruses. An employee surfing the Web to find footage of Saddam's hanging might inadvertently pick up a piece of code that turns the company computer into a zombie or introduces a virus that infects the company network.
Or maybe an employee of a financial firm sends a personal e-mail recommending a stock transaction. The advice backfires, and the company is held liable because the message was sent on the corporate mail server.
"Anything you hear is true, and more," Connolly says.
There are three ways businesses can prevent damage and protect their computers: with hardware, software and managed security systems.
Brian Martinik, principal of Milford-based Axiom Network Designs, is a proponent of the hardware solution. He advises corporate clients to install a Barracuda Web filter, which is a device that not only protects against viruses and spyware, but allows the boss to block access to selected Internet sites.
It also can unmask the employee who spent three hours playing poker online before the big board meeting by recording which Internet sites each user visits and when. "It's pretty powerful reporting," Martinik says.
Even so, at $2,000 to $3,000 plus an annual update subscription, it is often a hard sell unless the company has been injured by a security breach. "They have to feel the pain, so to speak," Martinik says.
Spam firewalls are an easier sell. "If you sift through 30 or 40 e-mails every day and only ten are legitimate, it takes away from your productivity," Martinik notes. When spam is blocked, customers see an immediate return on the investment. (Barracuda's spam filters cost $1,500 and up, plus subscription.)
Ed Bonyai of Dr. Edison's Computer Medicine in New Haven advises clients to install antivirus software. He favors a program by Kaspersky. It has "a small memory footprint, gets just about everything and it doesn't totally take over a computer's registry and kernel to the point of where, if it breaks, the whole computer is messed up," Bonyai says.
He also likes Kaspersky's responsiveness. "A while back, I found an unknown virus on a computer I was working on," he recounts. "I sent it to Kaspersky. Within two hours, the company had issued an update for the new virus. That impressed me. A lot."
He advises customers to avoid McAfee and Norton antivirus programs, which are the top two on the market. Malware writers fashion programs to compromise them specifically because of their popularity, Bonyai says, and in the hours before McAffee or Norton identifies each new threat and issues an update, the malware enjoys free run of the computers it has infected.
Connolly, another software proponent, says the tools built into the operating system, such as Windows XP's Service Pack 2, are pretty reliable, but for additional protection he favors AVG and avast! CQ antivirus programs. He also advises companies to make sure their e-mail host has a spam filter and antivirus software in place.
Managed security services, the third type of malware armor, operate "in a cloud," explains David Hahn, director of product management for MessageLabs. All Internet traffic goes through remote data centers, where it is scanned and filtered before reaching the customers' computers.
The service allows client companies to protect their e-mail and to proactively enforce their computer-use policies by blocking access to selected categories of Web sites, such as gambling or political sites; and by generating lists of URLs each employee has visited. E-mail and Web security services for a company with 50 employees would cost $485 per month, he says.
But there are other holes to plug. Hahn says that instant messaging, which began as a social-networking medium used mainly by teenagers, is now one of the biggest areas of vulnerability in the corporate setting.
"There are more than 100 million active IM accounts in the United States today," he says, most of which operate through consumer services like MSN, Yahoo, AOL and Google. According to an AOL survey conducted in 2005, 38 percent of respondents said they send more IMs than e-mails. "It's ubiquitous," Hahn says, and some analysts predict it will eclipse e-mail use within a couple of years.
The problem for businesses? Messages are written in plain text, there's no encryption, and just like e-mail, they can contain links to malware-infected Web sites or files.
Corporations are vulnerable to outgoing threats as well. Consider the disgruntled employee who IMs all vendors and customers with misinformation. If he is using a Yahoo account, his employer will have no log or archive of those poison-pen messages.
MessageLabs, which has 15,000 customers worldwide ranging from ten-employee offices to major banks, creates private IM networks that allow each client corporation's managers to dictate who uses IM and for what purposes, and archives all communications. For example, a system might allow salespeople to IM but not customer-service employees, and it might choose to proscribe all file transfers. The cost for a 50-employee office would be $595 per month.
The challenge for business owners is to make sure their security system keeps pace with the bad guys. If you think a spam-filled e-mail box is irritating, Hahn says, look out for SPIM (spam of Instant Messaging) and SPIT (spam over Internet telephony). Web-enabled mobile devices and VoIP (voice over Internet protocol) are "significant areas for product development" at MessageLabs, Hahn says.
Even if a company's hardware and software protection are up to snuff, there is always the wild card of "wetware" - the human user, Connolly says. He tells the story of a bank that hired a security analyst to find its vulnerabilities. As part of his analysis, the consultant littered the parking lot with USB thumb drives on promotional key rings. The next morning, eight out of ten employees who picked them up went to their desks and inserted them into the USB ports on their PCs - just to see what was on them.
By doing so they could have launched trojans that undermined their employer's security. "At that point," Connolly says, "the barbarian is behind the wall." The company's solution to that wetware problem? It siliconed the USB ports closed.
Here's some security advice from the pros:
ï Derek Koziol, a Geeks on Call franchisee who serves small-business customers from New Haven to Enfield, says don't download anything "free." Screen-savers, custom cursors, free software trials (unless they're offered by a major manufacturer with a reputation to protect, and you're sure the site is legitimate), free peeks at porn sites, and the most notorious: sites offering illegal software. "If it looks too good to be true, it probably is," he says.
ï Back up your files and documents religiously, says Koziol. Also, anticipate your company's growth and plan accordingly. Bonyai recommends buying 2brightsparks software (about $25) and a 250 MB external USB drive ($100).
ï Don't allow employees to use Wi-Fi connections. They are not secure, Connolly says. Packet sniffers can observe the data traffic and reverse-engineer passwords without much difficulty.
ï Make sure your password is a mix of numbers and letters, capitalized as well as lowercase, as opposed to your pet's name, or the word "password." And don't write it on a Post-It note and affix it to your monitor.
ï To let your e-mail recipients verify that a message is legitimate, Bonyai recommends using PGP (Pretty Good Privacy) software that bears a digital signature. The addressee clicks a link in the e-mail body and the e-mail is checked to validate its origin.
ï Choose Mozilla Firefox rather than Internet Explorer as your Web browser. Connolly sites a Washington Post report that for 284 days in 2006, exploit coding for known, unpatched critical flaws in pre-IE7 versions of Internet Explorer was readily available on the Web. And for 98 days last year, Microsoft did not provide fixes for vulnerabilities already in active use by criminals. By contrast, Firefox security was breached for just nine days in 2006.
Fearing a Mac Attack
Are Apple's Macintosh computers less susceptible to malware than PCs?
The short answer is yes, in part because fewer people use Macs, so authors of spyware and other malicious programs have less reason to target them. According to the market research firm IDC, Apple currently has 2.8 percent of the personal computing market, but analysts predict that share will rise to four percent by the end of 2007 as computer users become increasingly frustrated with PC security problems.
Viruses follow the market, says Brian Connolly of PCEase. A security breach already has been reported in the beta version of Vista, Microsoft's new Windows operating system, and it won't even be available to consumers until January 30.
But numbers aren't the only factor. Chris Hart of MyMacTech.com, who has worked on Macs for more than 12 years, says they are inherently safer than PCs.
"Security is an integral part of the Mac operating system, and user or administrator authorization is required to install any software that might embed itself deeply into the computer's file structure," Hart explains. As a result, spyware would not be able to take control of a Mac.
By contrast, he says, worms and other malware can insinuate themselves into the "deepest nooks and crannies of your PC - and all without you even being present."
To be sure, viruses have been written for Macs. Connolly says the very first virus he encountered was contained on a Macintosh floppy disk. Hart says, however, that the last time malicious software posed a widespread threat to the Mac was 1997. "Making an educated guess, I would estimate that 90 percent of Mac users operate their computers without anti-virus software," he says.
The threat from viruses, worms, trojans and spyware is so potentially costly that businesses are locking down their networks with antivirus software and spam filters, hardware appliances such as Web filters, and managed security services.
Business owners typically bear the cost of their employees' digital lifestyles, and it extends far beyond lost productivity.
Bryan Connolly of PCEase, a Guilford-based IT consultant who serves companies with ten to 25 employees, says a complaint he frequently hears from business owners is that their Internet access gets bogged down no matter how much they spend to increase bandwidth. The reason is that the computer has replaced the copier as the piece of office equipment employees most often exploit.
"You walk around the office," he says, "and you hear people streaming radio stations from where they used to live, and people watching soccer from Brazil."
Even more costly for businesses is employee Web use that introduces spyware, worms, trojans or viruses. An employee surfing the Web to find footage of Saddam's hanging might inadvertently pick up a piece of code that turns the company computer into a zombie or introduces a virus that infects the company network.
Or maybe an employee of a financial firm sends a personal e-mail recommending a stock transaction. The advice backfires, and the company is held liable because the message was sent on the corporate mail server.
"Anything you hear is true, and more," Connolly says.
There are three ways businesses can prevent damage and protect their computers: with hardware, software and managed security systems.
Brian Martinik, principal of Milford-based Axiom Network Designs, is a proponent of the hardware solution. He advises corporate clients to install a Barracuda Web filter, which is a device that not only protects against viruses and spyware, but allows the boss to block access to selected Internet sites.
It also can unmask the employee who spent three hours playing poker online before the big board meeting by recording which Internet sites each user visits and when. "It's pretty powerful reporting," Martinik says.
Even so, at $2,000 to $3,000 plus an annual update subscription, it is often a hard sell unless the company has been injured by a security breach. "They have to feel the pain, so to speak," Martinik says.
Spam firewalls are an easier sell. "If you sift through 30 or 40 e-mails every day and only ten are legitimate, it takes away from your productivity," Martinik notes. When spam is blocked, customers see an immediate return on the investment. (Barracuda's spam filters cost $1,500 and up, plus subscription.)
Ed Bonyai of Dr. Edison's Computer Medicine in New Haven advises clients to install antivirus software. He favors a program by Kaspersky. It has "a small memory footprint, gets just about everything and it doesn't totally take over a computer's registry and kernel to the point of where, if it breaks, the whole computer is messed up," Bonyai says.
He also likes Kaspersky's responsiveness. "A while back, I found an unknown virus on a computer I was working on," he recounts. "I sent it to Kaspersky. Within two hours, the company had issued an update for the new virus. That impressed me. A lot."
He advises customers to avoid McAfee and Norton antivirus programs, which are the top two on the market. Malware writers fashion programs to compromise them specifically because of their popularity, Bonyai says, and in the hours before McAffee or Norton identifies each new threat and issues an update, the malware enjoys free run of the computers it has infected.
Connolly, another software proponent, says the tools built into the operating system, such as Windows XP's Service Pack 2, are pretty reliable, but for additional protection he favors AVG and avast! CQ antivirus programs. He also advises companies to make sure their e-mail host has a spam filter and antivirus software in place.
Managed security services, the third type of malware armor, operate "in a cloud," explains David Hahn, director of product management for MessageLabs. All Internet traffic goes through remote data centers, where it is scanned and filtered before reaching the customers' computers.
The service allows client companies to protect their e-mail and to proactively enforce their computer-use policies by blocking access to selected categories of Web sites, such as gambling or political sites; and by generating lists of URLs each employee has visited. E-mail and Web security services for a company with 50 employees would cost $485 per month, he says.
But there are other holes to plug. Hahn says that instant messaging, which began as a social-networking medium used mainly by teenagers, is now one of the biggest areas of vulnerability in the corporate setting.
"There are more than 100 million active IM accounts in the United States today," he says, most of which operate through consumer services like MSN, Yahoo, AOL and Google. According to an AOL survey conducted in 2005, 38 percent of respondents said they send more IMs than e-mails. "It's ubiquitous," Hahn says, and some analysts predict it will eclipse e-mail use within a couple of years.
The problem for businesses? Messages are written in plain text, there's no encryption, and just like e-mail, they can contain links to malware-infected Web sites or files.
Corporations are vulnerable to outgoing threats as well. Consider the disgruntled employee who IMs all vendors and customers with misinformation. If he is using a Yahoo account, his employer will have no log or archive of those poison-pen messages.
MessageLabs, which has 15,000 customers worldwide ranging from ten-employee offices to major banks, creates private IM networks that allow each client corporation's managers to dictate who uses IM and for what purposes, and archives all communications. For example, a system might allow salespeople to IM but not customer-service employees, and it might choose to proscribe all file transfers. The cost for a 50-employee office would be $595 per month.
The challenge for business owners is to make sure their security system keeps pace with the bad guys. If you think a spam-filled e-mail box is irritating, Hahn says, look out for SPIM (spam of Instant Messaging) and SPIT (spam over Internet telephony). Web-enabled mobile devices and VoIP (voice over Internet protocol) are "significant areas for product development" at MessageLabs, Hahn says.
Even if a company's hardware and software protection are up to snuff, there is always the wild card of "wetware" - the human user, Connolly says. He tells the story of a bank that hired a security analyst to find its vulnerabilities. As part of his analysis, the consultant littered the parking lot with USB thumb drives on promotional key rings. The next morning, eight out of ten employees who picked them up went to their desks and inserted them into the USB ports on their PCs - just to see what was on them.
By doing so they could have launched trojans that undermined their employer's security. "At that point," Connolly says, "the barbarian is behind the wall." The company's solution to that wetware problem? It siliconed the USB ports closed.
Here's some security advice from the pros:
ï Derek Koziol, a Geeks on Call franchisee who serves small-business customers from New Haven to Enfield, says don't download anything "free." Screen-savers, custom cursors, free software trials (unless they're offered by a major manufacturer with a reputation to protect, and you're sure the site is legitimate), free peeks at porn sites, and the most notorious: sites offering illegal software. "If it looks too good to be true, it probably is," he says.
ï Back up your files and documents religiously, says Koziol. Also, anticipate your company's growth and plan accordingly. Bonyai recommends buying 2brightsparks software (about $25) and a 250 MB external USB drive ($100).
ï Don't allow employees to use Wi-Fi connections. They are not secure, Connolly says. Packet sniffers can observe the data traffic and reverse-engineer passwords without much difficulty.
ï Make sure your password is a mix of numbers and letters, capitalized as well as lowercase, as opposed to your pet's name, or the word "password." And don't write it on a Post-It note and affix it to your monitor.
ï To let your e-mail recipients verify that a message is legitimate, Bonyai recommends using PGP (Pretty Good Privacy) software that bears a digital signature. The addressee clicks a link in the e-mail body and the e-mail is checked to validate its origin.
ï Choose Mozilla Firefox rather than Internet Explorer as your Web browser. Connolly sites a Washington Post report that for 284 days in 2006, exploit coding for known, unpatched critical flaws in pre-IE7 versions of Internet Explorer was readily available on the Web. And for 98 days last year, Microsoft did not provide fixes for vulnerabilities already in active use by criminals. By contrast, Firefox security was breached for just nine days in 2006.
Fearing a Mac Attack
Are Apple's Macintosh computers less susceptible to malware than PCs?
The short answer is yes, in part because fewer people use Macs, so authors of spyware and other malicious programs have less reason to target them. According to the market research firm IDC, Apple currently has 2.8 percent of the personal computing market, but analysts predict that share will rise to four percent by the end of 2007 as computer users become increasingly frustrated with PC security problems.
Viruses follow the market, says Brian Connolly of PCEase. A security breach already has been reported in the beta version of Vista, Microsoft's new Windows operating system, and it won't even be available to consumers until January 30.
But numbers aren't the only factor. Chris Hart of MyMacTech.com, who has worked on Macs for more than 12 years, says they are inherently safer than PCs.
"Security is an integral part of the Mac operating system, and user or administrator authorization is required to install any software that might embed itself deeply into the computer's file structure," Hart explains. As a result, spyware would not be able to take control of a Mac.
By contrast, he says, worms and other malware can insinuate themselves into the "deepest nooks and crannies of your PC - and all without you even being present."
To be sure, viruses have been written for Macs. Connolly says the very first virus he encountered was contained on a Macintosh floppy disk. Hart says, however, that the last time malicious software posed a widespread threat to the Mac was 1997. "Making an educated guess, I would estimate that 90 percent of Mac users operate their computers without anti-virus software," he says.