GRC Journal - (Page 49) THREATS LuRkING ON MESSAGING PLATfORMS Security & Privacy term, these solutions appear to be working reasonably well. For example, sitekey is a technology that is currently employed by some financial institutions and represents a relatively easy to use and effective solution. The long-term solution to this issue is a widespread secure messaging authentication system that is easy to use and deploy. The receiver thus can know with certainty the identity of the sender which effectively renders phishing unfeasible. JC: From our perspective, the messaging infrastructure is vulnerable to numerous threats. Regardless of the payload – be it spam, phishing, or viruses – it all is part of unwanted mail. As the volumes continue to increase and the payloads become more severe, it becomes increasingly important for organizations to block as much of the “bad mail” before it even hits the corporate network. We believe that reputation will play a critical role in protecting that network. At Secure Computing, we’ve invested years of research and analysis into classifying mail using reputation for multiple identifies including IP, domain, URL, message, and image reputation. This has helped protect our customers from numerous messaging threats, such as image spam, and also helps ensure the deliverability of good mail. What are the ramifications of taking insufficient preventative measures when securing a messaging platform for an organization? JM: Every year organizations spend significant amounts of money and resources to protect their data from unauthorized access. Yet, in many organizations today, a user can simply email valuable corporate information to unauthorized recipients. A secure messaging platform must be viewed as an important element in the overall information protection program of any organization. However, not all “secure messaging” platforms are the same. It is critical to have a platform that allows the sender full control of sent messages at all times and provides for real-time recipient authentication at the time the message is being opened. The system must also be “usable,” meaning secure messages must be accessible by recipients in disparate domains without a requirement to use a common technology like Public Key Infrastructure. At Sigaba, we have done extensive innovation in this area and have received numerous patents around our unique architecture. This is why large enterprise customers continue to deploy our technology. JC: The ramifications are far-reaching, as the bad guys continue to become more sophisticated. Simple denial-of-service attacks and network penetration attacks have been replaced by a large set of coordinated and insidious attacks. Blended attacks like spam and phishing have become exceedingly profitable for their senders, while insertion of malware on internal networks and the conversion of corporate desktops into zombie computers to use as proxies in future attacks gives intruders unfettered access to the most critical elements of an organization’s infrastructure. Does the visibility of spam satisfy the minds of organizations that it is the only substantial threat that endangers their corporation, and if so is there the need for companies to better educate themselves regarding unseen risks? JM: The landscape of threats is constantly changing. This is not a new trend per se. Attackers will constantly shift and adjust their strategies based on the defense mechanisms employed by their targeted victims. As such, organizations must continually educate themselves and evaluate their risk matrix. Moving forward, companies must look to implement a set of real-time security services. These services are available today in our secure messaging platform and will be consumable by other line of business applications as organizations go through their upgrade cycles. 178 BTQ Business Trends Quarterly Q1 2007 | www.btquarterly.com http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.