Security threats increase in downturn

As if the last few months’ economic turmoil hadn’t presented enough worries, here’s another: The economic downturn may be adding to the already significant security issues businesses face, warns security software vendor McAfee Inc. “Cybercriminals are cashing in on the fact that the economic downturn is causing people worldwide to increasingly turn to the web to seek the best deals, jobs and to manage their finances,” McAfee says in its December Virtual Criminology Report. “They are preying on fear and uncertainty and taking advantage of the fact that consumers are often more easily duped and distracted during times of difficulties.” The report also cautions that governments and businesses are allowing the economic mess to distract them from security issues. Dave Marcus, McAfee’s security and research manager in Santa Clara, CA, says there are already signs of the recession’s effect. The number of fake transaction sites online has jumped by a third and the number of people being lured into participation in online money-laundering schemes is increasing, he says. When people worry about where their next paycheque will come from, Marcus says they’re more likely to take chances and to fall victim to scams. They’re also more likely to do things they know they shouldn’t, like copying employers’ customer information onto thumb drives to take home in case they lose their jobs. “In the advance knowledge that they’re going to be going through a reduction in force,”, “employees might start collecting information with the idea to take it with them,” says Hein Gerber, director of security and business continuity planning with PricewaterhouseCoopers in Vancouver. “People will do whatever they need to do or whatever they have to do when they feel desperate or they feel threatened,” agrees Layton Peck, service growth lead for global managed security services at CGI Group Inc. of Montreal. “I was in the security industry the last time we hit a recession, and there was a bump.” A new set of problems David Meizlik, senior product marketing manager at Websense Inc. in San Diego, CA, says a rise in that kind of activity presents several problems. First, if there are layoffs, confidential information is more likely to go out the door with departing employee, and often on devices that are easily lost or stolen. Even if the employee who did the surreptitious download remains an employee, the company has an increased security risk. What can businesses do about this? Added attention to security threats from within is a good start. According to Marcus, “You’ve really got to take a hard look at what you’re doing right now and ask yourself the hard question – well, how does it really deal with an insider threat?” Of course, if present security provisions are found wanting, you’ll then run up against the other problem the economic downturn presents – less money for IT in general, including security. So now more than ever, enterprises have to be as efficient as possible in securing information at reasonable cost. “It’s about leveraging what you have rather than worrying about what you had or could have had,” says Meizlik. “Looking at the right tools and processes is probably more important,” adds Gerber. No matter how tight the purse strings are, certain basics need to be in place, namely antivirus software and a firewall. But while those familiar standbys are still necessary, they’re not enough for most businesses. “You’re seeing a big shift away from desktop stuff,” observes Joe Zasada, manager of technical services at St. John’s Ambulance Alberta in Calgary. Network firewalls and other network-based security tools have become the main thrust, he says. One way to combat insider and other threats is to segment your network, argues Graham Bushkes, Canadian vice-president of sales for Fortinet Inc. in Burnaby, BC. Installing internal firewalls to break the network into zones gives finer control and can help check the spread of any malware that finds its way into the network. A proliferation of web-based applications is demanding new protection. A traditional firewall lets through traffic on port 80, which is used for web traffic. A new category of safeguards called web application firewalls uses deep packet inspection to check this traffic for signs of exploits like SQL injection. “Web application firewalls have really gained in prominence in the last couple of years,” says Justin Folkerts, a security analyst at Vancouver-based Fusepoint Managed Services Inc. Traditional antivirus software that detects known viruses using signatures doesn’t do well with polymorphic viruses, which encrypt themselves, says Tom Slodichak, chief security officer at WhiteHat Inc. in Burlington, ON, so network-based tools that rely on behavioural analysis to spot suspicious activity are increasingly necessary. Beyond traditional approaches Intrusion detection systems (IDS), which simply spot suspicious traffic and generate alerts to security staff, are yesterday’s technology. They are being replaced by intrusion prevention systems (IPS), which actually block the suspect traffic rather than just sending alerts. With IDS, “you spend a whole lot of money and you get this deluge of data,” cautions Richard Stiennon, chief research analyst at IT-Harvest in Birmingham, MI. As the corporate security toolkit grows, tying it all together becomes more important and more difficult. Security software tends to produce steady streams of alerts to suspicious network activity, some important and some not. “How do I correlate and examine and analyse all these incidents?” CGI’s Peck asks. One answer is security incident and event management (SIEM), which aggregates information from other security tools to provide an integrated view. Putting multiple capabilities together in a single package is another way to go, particularly for smaller organizations that don’t want to buy or manage a lot of tools. This is the premise behind Unified Threat Management (UTM), which integrates the basic components of firewall and antivirus with virtual private networking and other capabilities like web content filtering. “It allows you to get three or four capabilities in a single appliance,” Peck says, “and they tend to be reasonably easy to run.” “You get better, faster security by consolidating features in one platform,” argues Bushkes. Selecting security tools and vendors can be a challenge. Zasada says he looks first for vendors whose products “play nicely with others.” Adherence to standards and compatibility with other vendors’ products avoid a lot of headaches, he says. While IT departments often try to reduce the number of vendors they use to keep things simple and take advantage of volume discounts, Gerber says this may not be a good idea when it comes to security. “If there’s a vulnerability in one of the products,” he says, “it’s most likely that vulnerability is going to affect (that vendor’s) other products as well.” So having security software from two or more vendors increases the odds that one product will catch what another didn’t. Zasada also likes to evaluate a potential vendor’s responsiveness by checking online user forums to see whether customers’ questions are getting answered promptly, and look at how often the company is updating its products to address new threats. Checking customer references is important, says George Kearns, Fusepoint’s chief executive. While the references a company gives you are bound to be chosen from its happiest customers, talking to the references can help you get a better sense of what the vendor is like to work with. Kearns says talking to multiple candidates is important when choosing a service provider. If one company raises issues that others didn’t, he says, you can go back to the other candidates to see what they have to say on the topic. “You iterate through this until you feel like you’ve touched all your bases.” See the print edition for additional material and sidebars to this article

Security threats increase in downturn

News | 01/19/2009 4:10 pm EST

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us