GRC Journal - (Page 44) Security & Privacy Will an up-and-coming threat such as phishing become the most egregious burden and come to shift the attention of corporate America, or will spam’s reign as the king of fiscal impositions continue to dominate the concerns of the manufacturers? Phishing is a concern to those whose sites have been phished. But I don’t think spam and phishing are at the top of most organizations’ security concerns. A huge bank, like Bank of America, may be concerned about their site being phished; however, for an organization like Gartner, phishing is not at the top of the list of concerns. There are definitely other security threats within most companies where more concern should be placed – like content leakage and the loss of intellectual property. For most organizations, I don’t think spam and phishing are top security concerns for 2007 – it’s not to say that these aren’t important, but the technologies for detecting phishing sites have gotten better, browsers are evolving to incorporate anti-phishing capabilities, and the technologies for detecting spam have gotten better. For example, in the latest Gartner Information Security Hype Cycle, we position spam on “the plateau of permanent annoyance.” Spam is still there, but it’s become manageable background noise. Every now and then the spammers will come up with new techniques – like using text embedded in graphic images – and then the spam filters will develop techniques to counter the new threat – in this case, open up graphic images and look for text. Spam has gotten to a fairly manageable level; there’s still a lot of spam, but we’re good at blocking the vast majority of it. I’d say the area where people will be spending the most money and attention in 2007 will be trying to get a handle on unmanaged devices. Contractors with unmanaged machines, employees working from home with unmanaged machines, employee-owned consumer-oriented devices being connected – all of these things can bypass traditional perimeter security, potentially carry malicious code, and could walk off with corporate data. Gartner estimates that about half of all enterprises will undertake an initiative in 2007 to get a better handle on unmanaged devices connecting to their enterprise assets. What are the ramifications of taking insufficient preventative measures when securing a messaging platform? The most obvious ramification is lost productivity; the more stuff that gets through the filters, the more an employee’s time is wasted trying to sift through and get rid of it. It also wastes space on servers; it wastes bandwidth to send that spam around; and it potentially wastes backup resources as well. Ultimately, insufficient preventative measures could waste a lot of corporate resources and is a drain on corporate productivity. So far, we’ve focused a lot on inbound message protection. There is also a very real concern on protecting from information leakage; people emailing out content, information, source code, formulas, customer lists, etc. that could potentially leak intellectual property. Does the visibility of spam put organizations’ minds at ease that it is the only substantial threat that endangers their corporation? Is there a need for companies to better educate themselves regarding unseen risks? There is a risk now that since we’ve gotten pretty good at dealing with spam, we forget that the people with malicious intent will inevitably figure out another way to get to us. Even in the last week, for example, we’ve seen attacks where malicious content was loaded into Wikipedia, and there was another case where malicious content was uploaded into one of the Google video-sharing communities. These examples are a form of social engineering, but by using the good name and reputation of Wikipedia and Google, they were able to mask their malicious intent. I think the risk is that as things like anti-virus and spam become fairly well-known and well understood, organizations become complacent and forget that those people out there with malicious intent continue to innovate. So, our security protection technologies must continue to innovate as well. Unseen risks keep me awake at night, where most organizations don’t realize they have a problem. Security tools can’t report on what they aren’t programmed to identify. I believe most organizations are oblivious and blissfully ignorant to targeted threats that are financially motivated, taking false comfort in anti-virus and vulnerability assessment tools that continue to show everything is fine. Our prediction here is that by the end of 2007, 75 percent of enterprises will be infected with undetected, financially motivated, targeted malware that evaded their traditional perimeter and host defenses. Many times, organizations will push back on making investments for threats they can’t see or don’t believe in – just like some people don’t buy flood insurance until they’ve actually experienced a hurricane. In that same aspect, it may take a loss of inside information and public disclosure of confidential customer information for an organization to invest money into educating and protecting themselves from the thousands of unseen risks out there. Others that are more risk aware and more mature in the way that they approach and manage enterprise risk, will understand that the people with malicious intent continue to evolve and proactively make investments in newer security technologies to address targeted attacks before an attack creates damage. Losing credibility among end-users is an ever present threat associated with spam. Outside of immediate repercussions, what are the long-term effects of allowing spam to infiltrate an organization’s messaging platform? How difficult is it for a company to regain trust among clientele? There are two ways to look at this: 1) As an IT department, if I’m allowing spam to come in and waste the time of my end-users, I look bad and it looks like I’m not doing my job. It would also bring into question how confident I am as an end-user at other types of security IT is providing if they can’t keep simple spam out of my inbox. 2) Then there’s the other side; if I am a multi-national bank (let’s say ABC Bank), and somehow, somebody is able to send out spam that uses an ABC Bank’s email address because of a compromised system, that would create a huge loss of public confidence in ABC Bank from their customers. Q1 2007 | www.btquarterly.com BTQ Business Trends Quarterly 173 http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.