GRC Journal - (Page 45) DON’T WAIT fOR THE HuRRICANE TO HIT So there are two sides: the incoming spam and the impact it has on my reputation internally, and if somebody gets a foothold and sends outgoing spam that uses the company email address – both have potentially significant impacts, but I would say the latter is bigger. Regaining the lost trust of your clientele is much like regaining trust in your clients after you’ve had a public disclosure of information, like the mishap with ChoicePoint. ChoicePoint is still trying to recover from the release of their customers’ information a couple years ago, and for years to come people will associate ChoicePoint with a breech in information security. Since then, ChoicePoint has made significant investments and is now seen as a leader in many areas; but going back to the hurricane analogy, it took a flood before they made these investments. When a corporation is implementing a security platform, what features can prevent a financial disaster? How can these features best be demonstrated and understood before their actual implication? I think the advice of using a defense in depth strategy for information security applies now more than ever; multiple techniques used in combination to filter out malicious intent – whether you’re applying defense in depth to a converged network-based platform, a host end-point based platform, or a messaging-based platform. For example, with messaging the idea of only scanning email for threats is outdated; so, the support of multiple protocol streams is necessary. You should be looking at instant messaging, FTP, SMTP, potential attachments in voice-over IP conversations, etc. – all of these streams of messaging need to be analyzed – incoming for malicious content and outbound for inappropriate content, and using multiple techniques for the analysis of the content (signature-based, rules-based, and behavioral). To demonstrate the protection provided by converged security platforms, it’s possible to get leading-edge samples of spam that use advanced techniques, or malicious code that uses advanced techniques to avoid detection, and then run it through in a pilot or lab situation to see if this new platform, with these multiple layers of defense, will catch it. So, you can test some of the threats that have gotten through in the past against these new platforms in a lab environment, to see if the new defense in depth platform strategy works. One concern with spyware is that it is often considered to be simply a malicious code problem rather than an actual separate threat. Is an individual spyware prevention platform unsubstantiated, or is spyware a prominent and genuine concern that should be addressed with urgency and respect? Our research has consistently stated that spyware is not a separate problem; it’s malicious code with malicious intent that you should expect to be dealt with if you pay for an antivirus vendor to protect your end-points. Anti-virus vendors should not be asking organizations for more money for each new threat that emerges. We say spyware is not different; it’s malicious, and anti-virus vendors should catch it. The good news is: Symantec and other anti-virus vendors understand this, and for example, when you buy Symantec’s anti-virus protection product, you get anti-virus and anti-spyware protection at no additional costs. Today, there are very few vendors that try to charge separately for anti-spyware. And I give credit to Microsoft for giving away a good anti-spyware product and bundling it with Windows Vista to put this whole issue to bed. For the few remaining vendors trying to charge for this, I’d direct them to Microsoft’s quite competent antispyware protection product that they’ve provided at no cost. It’s time that the security industry started acting like the rest of the IT industry and gave users more each year for the same price. An underlying annoyance is the presence of hybrid worms. There may be a time period in which worms are not prevalent, and therefore overlooked. What actions can companies take to ensure that they do not overlook this problem which often peaks and falls? It’s true; there hasn’t been a good worm in a couple years now, and I think people risk becoming complacent. Organizations can make sure that they don’t overlook the problem by investing and maintaining best-inclass vulnerability assessment and patch management capabilities. They should invest in network and host-based intrusion prevention systems that can proactively shield systems even if they aren’t patched, and can catch targeted attacks as well. It’s quite like the hurricane analogy: the fact that there hasn’t been one doesn’t mean that you don’t need to continue to invest in insurance. Worms haven’t gone away, and they will be back; the question is, are you prepared? neil MacDonald is a VP and Distinguished Analyst in Gartner Research. Neil joined Gartner in 1995 as an analyst in Gartner’s networking research team, where he focused on network computing infrastructure including identity and access management, directory services, and networked operating system security. Prior, Neil worked in IT operations, where he was responsible for the planning, deployment, and support of a 9,500-node multi-protocol and multi-server network. 174 BTQ Business Trends Quarterly Q1 2007 | www.btquarterly.com http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.