VIRUS SEASON

How to protect your biz from Internet threats.
-By Jonathan Brody

ONE STOP PORTAL
FOR VETERANS:

The Federal Government has established VETbiz for veteran business owners. The site vetbiz.gov is also known as the Department of Veterans Affairs, Center for Veterans Enterprise. VETbiz is a resource for veterans who own or want to start a business. It is full of resources on loans, business programs, training opportunities and much more.

Even the smallest of businesses are not immune to Internet threats. Just a single security breach could bring your business operations to a halt, decreasing productivity, and potentially compromising data integrity, customer confidence and revenue flow. And today’s threats can come from anywhere, wired or wireless networks, internally or externally. Gone are the good old days when identifying and securing the network perimeter was easy, and securing it was just as straightforward.

It seems like only yesterday that a firewall and antivirus were all a small business needed to protect its data. By current standards, yesterday’s threats were slow-moving and predictable, and blocking them at the network perimeter kept their impact to a minimum.

And studies have shown that small businesses often leave large security gaps. A recent survey of 1,000 small businesses by Symantec and the Small Business Technology Institute found that small businesses are largely unaware and uneducated about information security risks and their economic repercussions. Twenty percent of small businesses surveyed have yet to implement simple virus scanning on email.

Unfortunately, even simple virus scanning on email won’t cut it in today’s business environment. Today, information is continually moving among employees, partners, and customers, few of whom operate within the controlled sphere of the small business network. Each endpoint represents a potential entry point for cybercriminals who are increasingly intent upon compromising sensitive information for financial gain.

At the same time, industry and government regulations have put small businesses under greater pressure to make sure that online business communications and transactions are protected and that information remains secure and available.

Clearly, the network is no longer the perimeter. Today, people are the perimeter. Information protection is no longer about protecting the network. It’s about protecting information wherever it resides.

In the digital age, business data constantly flows among an expansive range of organizations and individuals whose security status varies. Small businesses are dependent on these interconnections for the performance of their business for the on-time delivery of goods and services as well as their financial performance.

For example, salespeople might connect to the small business network through a hotel network. Guests access the Internet through the wired or wireless LAN. Mobile workers at kiosks check email and download attachments. Customers transact business online from home Internet connections and public wireless hot spots.

Valuable information is vulnerable to exposure over each of these connections. As a result, protecting information in such an environment requires the elimination of exposures not only inside the network but also across business boundaries. This includes endpoint enforcement through protection, configuration, and usage, as well as endpoint compliance, and that means securing all endpoints and all access points all the time.

Of course, simple user error can also put small businesses, not to mention their customers, partners and employees, at risk for a security breach. For example, a government agency recently revealed that an employee’s laptop was stolen, along with personal information on a staggering 2.2 million active-duty military personnel.

While the repercussions of this event have yet to be determined, it has already been called one of the nation’s largest security breaches to date. And the potential magnitude of its impact underscores the often tenuous line between information protection and information exposure in the interconnected environment in which businesses and individuals live, work and play.

Evolution of a Threat
What a difference a few years can make, particularly where the Internet is concerned. In 1988 the first Internet worm was launched. It spread to just 6,000 computers, of course, that represented one-tenth of all the computers on the Internet at the time.

By 1993, Internet traffic was expanding at an annual growth rate of nearly 342 percent. The following year, a virus writer took advantage of this growing communications phenomenon to spread malicious code and posted the Kaos virus to a newsgroup.

Those were the good old days. Where yesterday’s threats were noisy and visible to everyone, today’s threats are silent and often go unnoticed, by design. After all, with the current price of a successful adware and spyware install at somewhere between five and 20 cents a pop, stealth pays.

That’s not all. While earlier threats were indiscriminate and hit virtually anyone and everyone, today’s threats are highly targeted and regionalized. Cybercriminals are in it for the money now, unleashing quiet but sophisticated, modular malicious code aimed at perpetrating identity theft, extortion and fraud.

To reduce information exposure, small businesses must secure both their managed and unmanaged endpoints, because that’s where the information resides. Since managed endpoints are within an organization’s administrative control, persistent agents can be used to implement appropriate countermeasures. This is important, as these endpoints often have more extensive rights for accessing and storing information, which in turn signals the need for more robust security measures.

Among the most effective tools for protecting managed endpoints are antivirus, personal firewall, and intrusion protection technologies. While antivirus tools are ubiquitous today, the most effective protection comes from technologies that include anomaly or heuristic-based threat detection as well as antispyware capabilities.

Personal firewalls are another widely recognized countermeasure, although their effectiveness is limited to protecting at the network layer. Personal firewalls often cannot stop application layer attacks that utilize protocols and connections allowed by their rule base. Nevertheless, personal firewalls are a valuable component of managed endpoint protection as they permit only traffic that is explicitly allowed by policy.

Intrusion protection technologies offer another layer of security for managed endpoints. Host-based intrusion protection complements antivirus by guarding against unknown attacks that operate at the system and application levels. Network intrusion protection tools guard against network-based threats such as worms. While some network intrusion protection solutions rely on signatures and, therefore, guard against known attacks, other solutions provide more advanced mechanisms such as vulnerability-based signatures and protocol anomaly detection to keep unknown threats out.

Rounding out these more common security technologies are application control, host integrity checking, patch management, buffer overflow protection, and encryption technologies. Application control picks up where personal firewall technology leaves off and further defines allowable traffic. Host integrity checking evaluates various security attributes to ensure that the endpoint is defended against any threats it may encounter.

Patch management identifies and eradicates weaknesses in software code, while buffer overflow protection monitors endpoints for known and unknown threats that attempt to exploit buffer overflow vulnerabilities. Finally, file and disk encryption guards against information loss in the event that an endpoint such as a laptop is stolen or lost.

Protecting unmanaged endpoints is also critical in order to reduce the risk of information exposure. However, because these devices are outside an organization’s control, they require “on-demand” protection that does not impose changes or restrictions beyond the duration of a specific interaction.

To that end, small businesses can leverage a number of on-demand technologies, including host integrity checking, cache cleaning, malicious code protection, firewalls, and a secure virtual workspace. On-demand host integrity checking and on-demand firewalls provide much the same protection as their agent-based counterparts, while on-demand cache cleaning removes information remnants from browsers and application-specific caches when a session ends.

On-demand malicious code protection leverages behavioral analysis techniques to identify keystroke loggers and other malicious codes that may reside on an unmanaged endpoint. Further, on-demand secure virtual workspace technology guards against information leakage by creating an encrypted workspace on the unmanaged endpoint.
Of course, no information protection solution is effective without the cooperation of the people who actually use the managed and unmanaged endpoints. While business security responsibility and accountability is widely acknowledged as a vital yet challenging component of an information security strategy for any small business, its effectiveness can be greatly enhanced when organizations carefully codify requirements and responsibilities and apply automation to ease enforcement.

Although the days when just a firewall or antivirus provided adequate protection are long gone, small businesses have a wide range of tools from which to choose as they look beyond the network to protecting information regardless of where it resides at any given moment.