Cyber Security Logic

Computer Security Threat Vectors

 Email Article |  Twitter |  Facebook |   Google Buzz |  digg it |   delicious |   StumbleUpon |   LinkedIn |   Technorati |  reddit | 

There are a number of vectors or paths that can lead to compromising computer security. Threats are sent to computers via email and instant messaging. Computer users unknowingly go out and get threats while surfing the Internet. There is the silent threat from disgruntled or greedy insiders. Finally there are threats delivered by plugging accessories into the computer. How well known are all these computer security threat vectors? 

• Most people know that threats from Malware are often delivered by email. This is the oldest threat vector.
• Fewer however are aware that the delivery medium has now shifted to the web and more Malware is now delivered from the web than email.
• Very few know about or have considered the insider threat potential.
• Almost no one is aware of threats coming from USB devices, picture frames and other devices affected with malware from the Manufacturer.

Email security is getting better all the time. Given a good layered solution it is hard to get a virus attached to an email delivered. Most email threats now come in the form of links to malicious websites. Your email security solution provider needs to specialize in email security in order to have a chance to keep up with the threats to computer security from this threat vector.

People implicitly trust the Internet by clicking on links in emails or surfing  fearlessly because they don’t know any better or realize that any site can be infected and dishing out malicious code. The majority of the threats today are delivered by compromised web sites dishing out malicious code. Like email security your web security solution provider needs to specialize in this layer of computer security as well.

The threat from disgruntled employees or employees trying to make a quick buck can be the most damaging and hardest to prevent. It is unfortunate that we also have to consider a threat from those who we employ and helping provide their livelihood. Steps in restricting access to resources, including servers, files, and intellectual properties may be considered as part of the computer security process.  

If that weren’t enough USB devices, including free thumb drives given away at trade shows, picture frames and other USB connected devices are being infected with malware during the manufacturing process. Because so many computers auto run programs installed on these devices it is an attractive vector. Taking steps in removing the auto run command and locking down USB devices will become more popular and now is the time to get ahead of this computer security threat vector.

Computer security threats come in many forms and so should your proactive response. It takes a combination of security software & solutions, people and procedures to have a chance at staying protected these days. Think layers and stay safe out there.

Security Software Needs Our Help

 Email Article |  Twitter |  Facebook |   Google Buzz |  digg it |   delicious |   StumbleUpon |   LinkedIn |   Technorati |  reddit | 

The biggest problem most Security Software has today is that it is reactive by design. Most security software looks for common elements in the threat's code, malicious web pages, behaviors or other identifiable traits, then reacts.

But before the software can react, a list of common elements (signatures) must be built when a threat is discovered "in the wild" (aka on the Internet), so when that threat is seen again, the software can hopefully block and or process it accordingly.

There are a couple of problems with that approach. First, if the security software doesn't have the signature or understand the technology of the attacking threat(s), it is too late and the threat gets in. Second, by being reactive, security solutions are always trying to keep up with the bad guys.

Picture a global wild-wild-west. That is what the Internet is today. Now you can see why security software needs our help.

We need to move from reactive to proactive. Especially in the small to mid-sized business and home user markets because they represent the largest threat surface area. SMB and home users are a growing demographic targeted by hackers because these groups have the least amount of experience dealing with threats and securing data.

Tips for the Business owner:

• Adopt a Layered Security Solution, no matter what the network configuration is or how it is used.
• Take charge and ownership of security policies, tools and acceptable computer use. Business computers should be used for business work.
• Keep everything up to date, everything.
• Back up appropriately.

Tips for the Small office\home office and home users:

• Use a security suite to help with your Layered Security Solution.
• Keep everything up to date.
• Back up appropriately.
• Remove local administrator rights.

Security is not convenient or easy. It takes consistent work, so help out by lending a helping hand.

Cyber Security Software needs some help!

 Email Article |  Twitter |  Facebook |   Google Buzz |  digg it |   delicious |   StumbleUpon |   LinkedIn |   Technorati |  reddit | 

It appears that the US is in serious trouble when it comes to Cyber security. 

Experience has shown us here at Software Security Solutions that most consumers (home computer users) feel that Antivirus software is all they need and that the Internet is a safe place (surprise, it is not). Businesses focus on keeping their business going, and not so much on computer security. Being part of a small business I certainly understand that focus.

Not much effort is required to find hard evidence showing that security software and security appliance hardware is not holding up to the latest threats. See an example despite all the efforts of the Antivirus and Internet Security Industry here.>Cyber threats to the US<

Cyber security requires much more than security software and hardware appliances can provide both at home and at work. It requires understanding, work, process and much more. The bottom line is; if we choose to connect critical information (making us a target) to the internet, then prepare to get the just desserts.

So what can we do? Right now the answer is Layered Security. The answer is complex, for now, but first we need to rewind a bit.

Job one could be to standardize. Job two could be to simplify.

Security Standards: (for Antivirus Software Manufactures) 

Standards make it easier to manage and support whatever it is we are trying to do, if the standards are not written by a crack-pot. Why can't we start by standardizing the names of the threats we do know about? It is no secret that most the Antivirus software companies' detections are pretty much the same when we factor in the exposure risk. So why all the smoke and mirrors of every Antivirus company calling the same threat something different? What good does it do, and how does that help protect the end users?  

Simplify - (for Antivirus Software Manufactures and end users alike)

Do we really need every widget, bell and whistle? Do we really need all those different programs doing the same thing differently? How are we at making sure every one of those programs on each computer is secure and up to date? What can we do to simplify, thus reducing the threat surface area? Is there opportunity in standardizing and simplifying our computer security?

When life is simple, life is good. Just ask someone that doesn't own a computer. They seem to get along just fine.

Security Software Scare Tactics

 Email Article |  Twitter |  Facebook |   Google Buzz |  digg it |   delicious |   StumbleUpon |   LinkedIn |   Technorati |  reddit | 

Rat's, Worms and Viruses - oh my!

I saw a picture of an Antivirus Ad running in a store-front window the other day. The ad used a bunch of in-sync monitors intended to give the passerby an uneasy, but at the same time safe feeling, about being on the Internet. It occurred to me this was a very creative way of presenting FUD.

Fear, Uncertainty and Doubt is a main motivator driving our economy. These are key emotions played upon by many industries because fear is big business. 

I am not a big FUD fan because it is not a fair tactic, especially when used on those who are easily impressed or naive about things of this world. It is hard to draw a definitive line between what should be feared and simply presenting the facts. Wouldn't it be better to just promote the positive and not accentuate the unknown?

So, maybe this begs the questions;

1. Is the Internet to be feared? And;

2. Does Internet Security really exist?

The nature of the Internet is a medium to mostly share information. If you have information that is not to be shared, it probably should not be connected to the Internet. Why? Because of this fact; you cannot simultaneously share and secure the same data. Simple sounding, yet harder make real. Or is it?

Reading what I read daily about Internet security, the uneasy feeling about being on the Internet is well deserved. Experience tells me that the safe feeling about Internet Security must be worked hard for and earned.

So yes, Internet Security really does exist and is a direct result of the choices we make. Life is a risk, so we live with the choices we make every day. Choose well. That's the best one can do.