The Compromise Crisis

Advice 2010-04-07 15:47

Mark Murtagh, technical director at Websense believes that employing a unified security solution means organisations

Can you really choose between web, email or data security? Box or SaaS? It’s no secret that modern threats are converging and a significant portion of data loss occurs via targeted web and email attacks. So why is it that many organisations manage multiple different security technologies? How do you find the middle ground on security?

Where there is opportunity to do business, there is opportunity for cybercrime. The proliferation of information held and shared electronically proves rich pickings for aggressive fast moving security threats. Businesses or particular verticals are now actively highly targeted in spear fishing attacks for specific information, and the campaign can hit across email, the internet and data theft in one campaign.

In February, for example, the Websense Research Labs discovered a new Trojan specifically targeting UK government and military employees. Thousands of emails, allegedly from the National Intelligence Council, encouraged recipients to download a document from a Web page that looked trustworthy. This contained a Zeus bot with rootkit capabilities to download more malicious files on to the victim’s computer that would steal banking information and even prevent antivirus updates.
Whole picture
With this real life example, it’s obvious how crucial it is to protect all channels with a security solution that studies the whole picture. The email in this instance was in itself not dangerous – but the web link it contained needed further scrutiny. Before anyone even opened the email, would your security have recognised the URL that led to a malicious payload?

Legacy solutions don’t talk to each other and this leaves businesses unable to deal with these sophisticated blended threats that can easily dodge stand-alone applications. Modern threats require coordinated management.
Today's threats
However, many security vendors still only supply legacy point solutions which often fail to recognise the threats; much less manage effectively given multiple policy, detection engine and reporting frameworks. Reputation-based methods and URL filtering lacks the speed and agility to identify threats linked to dynamic content or attacks on legitimate websites. The holes left by these point based security solutions can be, and are, exploited by cybercriminals. To put it bluntly, legacy point solutions were designed to protect against yesterday’s threats. Today’s threats need unified content security.

When you look at the challenges faced by organisations in the real world, there are a lot of security choices to consider and they all have an impact on the success of a company. The explosion of Web 2.0 properties and cloud computing has opened up a new world in terms of creating, sharing and managing information for businesses. We are seeing a new generation of faster, nimbler and ultra responsive ‘borderless’ companies. Staying competitive, staying secure and staying within budget are all high priorities for a successful business.