Catching Up With The User…

By Guy Bunker | June 29, 2010 | Leave a Comment 

Guy Bunker

With the news that a couple of Android apps have been pulled as they misrepresented their purpose (they were used as research – duping users into downloading and installing them – to see if people would), it raises an(other) interesting question for IT departments around applications, mobile devices and keeping up with the user.

While companies have been getting stricter at what can and cannot be installed on corporate laptops, the same is not true of smartphones. There are now tens of thousands of apps for phones like the iPhone and Android, and while they do have to go through an approval purpose, it won’t be your corporate one.

I have recently been involved in writing security policies for a number of companies and it becomes very apparent as to the need for up-to-date polices coupled with a suitable education programme. Technology is moving rapidly and care needs to be taken to protect corporate data wherever it is and however it is accessed. Updates to policies are worthless if they are not effectively communicated – this is a case in point – updating the policy on downloading apps won’t stop people from doing it if they don’t know about it. If you have technology to prevent inappropriate apps from being installed on smartphones, great – if not, then you need to remind staff of some of the dangers of just downloading and installing apps from the web.

Cyber criminals go after the low hanging fruit and the smartphone is just that – a simple way into a person’s life and potentially the corporate network.

Guy Bunker

Shanghai to London – Spammers will be following the crowds

By Greg Day, EMEA Security CTO for Symantec | June 23, 2010 | Leave a Comment 

Greg Day, EMEA Security CTO for Symantec

Symantec’s security response team have found that Shanghai World Expo 2010 is the latest major world event to be hijacked by spammers. We’ve been monitoring several different variations of spam that uses World Expo keywords and email subjects to deliver their usual mix of fake promotions, products and services to unsuspecting web users.

With around 70 to 100 million visitors expected to turn up at the World Expo, it’s no surprise that spammers are attempting to take advantage of it. We saw the same thing with Vancouver Olympics, and are observing it right now with the World Cup, and the ticket. And as ticket registration for London 2012 has already begun, the UK could become the next prime target for these scams. To help you avoid the scammers, we’ve put together the following tips.

Do’s

  • Ensure when signing up to receive mail, that you verify what additional items you are opting into at the same time and de-select the ones you do not want to receive.
  • Unsubscribe from legitimate mailings that you no longer want to receive and be selective about the websites that you register your e-mail address on.
  • Avoid clicking on suspicious links in e-mail or IM messages. These may be links to spoofed websites. We suggest typing web addresses directly in to the browser rather than relying upon links within your messages.
  • You must also make sure you delete any spam you receive. It is worthwhile considering a reputable antispam solution to handle your filtering, such as Symantec’s Brightmail messaging security family of solutions.

Don’ts

  • Do not open unknown e-mail attachments or spam messages. These attachments are what could potentially infect your computer.
  • Do not fill out forms with any personal or financial information or passwords. Reputable companies are unlikely to ask for your personal details via e-mail. If you are really unsure, get in touch with the company in question via an independent, trusted mechanism, such as a verified telephone number, or a known Internet address that you type into a new browser window and find out.
  • Never reply to spam as this could simply result in more spam.

 
Photo by Flickr user gustible, licensed under CC BY 2.0.

The Risk Of Cloud Upgrades…

By Guy Bunker | June 16, 2010 | 1 Comment 

Guy Bunker


So, you are using the cloud and all is going well. New upgrades to the software appear at regular intervals providing new functionality… all is going well. But what happens if something goes wrong? Twitter has just had such a problem, and it took down the service for many users. Who cares… it’s just Twitter?!?!? Well, quite a few companies have Twitter as a key part of their communication strategy these days, so when it’s down it does make a difference. However, the real issue here is the risk around upgrading cloud applications.

Obviously, the vendor doesn’t plan to make a mistake – but what if they do? What if it was your CRM system, or your ERP solution? In this particular instance, there were missing, late and/or duplicate entries… what would happen if this were your ERP system – could it handle the problems and more importantly would you know about it before the auditors!

Part of any risk analysis for the business needs to include the risks associated with 3rd party suppliers – and IT and data handlers are no exception. Service Level Agreements need to reflect these possibilities and potentially have clauses for reverting (quickly) to earlier versions, rather than bug-fixing on-the-fly to resolve issues. Now is the time to take a look at the contracts you have – and ask your supplier the questions… “What if an upgrade goes wrong?”

Guy Bunker

Racheting Up Information Security…

By Guy Bunker | June 15, 2010 | Leave a Comment 

Guy Bunker

We have been talking about Information Security for a few years now, but with the changes in legislation earlier this year that means you can incur £500K fines, it’s time to look beyond the reactive and towards the proactive. Time to move from Information Security to Information Assurance.

So why Information Assurance rather than just Information Security? Businesses rely on information, and most realise that accurate, available and appropriately shared information is key to growing a business. Conversely, missing or inaccurate information in the wrong hands will damage the business and potentially the business’ reputation.

From a security aspect, it is only the security of the information and systems that is taken into account. Data loss prevention and all the, now commonplace measures to prevent it, coupled with endpoint and datacentre security strategies enable companies to ‘tick the box’. Reporting and auditing are key for this to be provable so that information is kept safe and the newspapers and legislators held at bay. Assurance is all this – and more! Information assurance is about assessing the business’ ability to keep the information safe and that it is accurate and available - to the right people at the right time. It’s about developing a shared understanding across all areas of the business as to how information is used, and its about improving the information available according to business priorities.

As we start to move out of recession, but while the purse strings are still being tightly held it is time to revisit information strategies and look at how information can be used more effectively to drive the business. New rapid assessment services are starting to appear which can build on your information security policies and turn them into information assurance ones.

Guy Bunker

Tabnapping…

By Guy Bunker | June 8, 2010 | 1 Comment 

Guy Bunker

… What? A new browser-based threat has been created – just to show it can be done. However, rest assured, this will be used for real in the near future. It’s called Tabnapping… sort of like kidnapping, but with the tabs on your browser. The way it works is that you visit in infected site and when you navigate away from a tab, it changes the tab name and the content.

The social engineering at work here is that most people have multiple tabs in their browsers open at the same time – and they don’t really remember which is which (why would you?) so you click on the one you think you need (but it’s been tabnapped) and you reenter details… mistake! As for how easy is is… take a look at this page which shows how it works – then open another tab and wait 5 seconds and return to the old tab!

What to do? Well, the problem with these sorts of attacks is that they are tough to break as there are legitimate uses for the functionality used – think about auto-logout from online banking systems. So… the best way to combat it is to educate people as to the risk – send out an email today! (Of course, hopefully you will have anti-malware installed as well – which will help prevent you from going to dodgy sites etc…)

Guy Bunker

The Magnificent (Windows) Seven

By Greg Day, EMEA Security CTO for Symantec | June 4, 2010 | Leave a Comment 

Greg Day, EMEA Security CTO for Symantec

The wild west forms the backdrop for our latest video on Windows 7. Shot from the hip we warn y’all how to avoid the bandits associated with migrating to this hotshot platform.

For an IT manager working to migrate to Windows 7, Symantec provides the silver bullet to help you ride off into the sunset. Check out our new video to see what I mean, partner.