Great Lakes Blog

Malware going mainstream, warns Symantec

According to a recent computer safety survey by specialist company Symantec, malware may be lurking in places that users least expect.  In previous years, hackers tended to focus their efforts on adult websites and other niche locations that regular business users were unlikely to frequent – including forums discussing methods for violating intellectual property rights.  Recently, however, malware creators have changed their strategy.  Instead of loading malware onto sites that have long been a primary focus of attention by antimalware researchers, they are now going mainstream, seeking – and finding – ways in which to infect sites that the average user may perceive to be completely innocuous.  These mainstream sites even include religious websites.

In many cases, the site owners and managers have no involvement with the hacker or malware creator.  Instead, the site itself is hacked and malware programs are loaded onto it.  Such programs are then automatically downloaded onto the computers of anyone who visits the site and does not have robust data protection measures already in place on their system.

The shift in strategy is particularly important to business computer users because when systems are connected by a coordinated network, one “bad apple” truly can spoil the entire bunch.  Sophisticated malware will strive to spread itself across the entire network, infecting all the business’s systems.  The resulting downtime can be costly in terms not only of hardware and software, some of which may have to be replaced, but also in terms of productivity.  This is true even if the company has taken sensible measures to make sure they have duplicate data in the form of an online backup.  Such a backup should not be infected by the malware, but if data recovery cannot proceed until the company’s systems are up and running again, the malware attack will still result in inconvenience and often, direct costs that the company must assume in order to remain operating.

Another serious consequence of a malware attack is the possible spread of the infection to a company’s own customers.  This can happen if a virus or other type of malware has been programmed to seek out contact lists and generate emails to anyone included on such a list.  These emails will, of course, contain copies of the malware and may well end up infecting the systems of vendors and buyers who work with the company.  Such a circumstance, once fully understood, can only tend to create a loss of confidence in the SMB – and a loss of confidence, as all businesses know, can be just as devastating to the bottom line as an actual loss of data.

Previously, companies might have been able to tell themselves that responsible employees would not be hit by a drive-by malware attack, since such workers would, of course, not be visiting suspect sites using company infrastructure.  The new malware strategy in place by hackers, however, now means that workers may trigger an infection even while visiting a mainstream website that is appropriate and necessary for them to do their work.

Arranging for robust computer security, including antimalware measures provided by an industry expert, has never been more important to the future of SMBs.

HOW ROBUST IS YOUR NETWORK SECURITY?

Take advantage of this FREE OFFER from Great Lakes Computer for a proactive review of your computer network systems with a 27 point problem prevention network audit.  Gain the knowledge you need to be able to manage your system’s integrity and security.

This new eBook provides you with 10 important questions to ask yourself as you review your current data backup strategy along with 10 action items you can take to effectively protect your data.

by Greg Shields, Microsoft MVP and VMware vExpert

The following is a blog about the security issues with mobile hotspots and other devices common in today’s workplace, from Crain’s Cleveland Business Information Security Blog, written by M URSULA HERRMANN.  We have posted her blog posts before and they have been met with great reviews.  This one should be no exception.

When employees bring their own devices, they also bring headaches

You allow your employees to bring their own smart phones to work. One day your enterprise’s connection to the Internet goes down. Joe from marketing is not concerned. He sends an internal email around to some of your other employees, giving them the SSID and password to a mobile hot spot he’s set up using his phone’s wireless connection. “I’ve got 4G; we won’t even notice the difference,” he says.

Everybody he’s emailed turns on wireless on their laptops and gets back to work. As word of mouth spreads, others configure their phones as hot spots as well and share the information. Your entire office is happily working away while your assistant is calling your Internet provider to get an ETA for repair.

Is it a good thing that your employees have found a way to work?  Sure — if you don’t mind that your corporate data is now flowing over networks you have no way to control. Suddenly, your firewalls, network intrusion detection, vulnerability scanners, sniffers, loggers and real-time monitoring all are useless.

Not only are your employees’ smart phones’ carriers now controlling your data flow, but you have no control over how secure their hot spots are. Someone could be connecting to one of them and seeing whatever is on Cindy’s laptop. If that just happens to be company proprietary information, you’ve just given away the store.

Aside from being very vigilant, or not allowing BYOD at all, there are some things that you can do to discourage your users from setting up mobile hot spots to do their work. You can set up a secondary Internet connection that is, perhaps, less robust than your primary connection but that can be used if the primary connection goes down, and fortify it with NIDS and monitors so that you have control over it. Your users then can connect to that network and continue to do their work, but you need to make sure that they connect to the regular network when its Internet connection comes back up.

You can monitor for “rogue” wireless access points in your office space — which you should be doing anyway — and if your users are using their smart phones to create hot spots, you can take action. If you are going to do this, you should make sure that setting up such access is specifically disallowed in your security policy — which it should be — and make sure that your users have signed an Acceptable Use Policy if they are bringing their own devices in.

You can prevent your users from connecting to wireless at all from their work machines, but if they are using laptops, that may be a little harder to do, since presumably you would want them to be able to make such connections when they are traveling or working from home. Another similar solution might be to have those with wireless capability use an alternate workspace if you are not already doing that, so that they will (presumably) already have safeguards for their machines and data in place when they connect to the Internet. All other users would be restricted to Ethernet only, so that they wouldn’t have the ability to connect to a rogue wireless hotspot.

The problem of BYOD and Bring Your Own Network isn’t going away, but there are ways that you can manage it. Just be aware that this scenario can occur, and take steps to prevent it before it happens.