 |
 How to toughen the weakest link in the security chain
by Douglas Schweitzer, A+, Network+. i-Net+, CIW, BIS
The guiding tenet of computer security is that an organization’s overall security is only as strong as its weakest link. While organizations around the globe routinely employ the use of powerful firewalls, antivirus software and sophisticated intrusion detection systems to guard precious information assets, they often neglect the most important and vulnerable security component, the human element.
Without a license, we are not allowed to drive a car, fly a plane or practice medicine; yet we are free to surf the Internet and send and receive e-mail. While the use of the Internet doesn’t have the same potential for causing harm as flying a plane without a license does, the use of the Internet nevertheless has the potential to wreak havoc on an organization’s networked PC’s. Anyone with access to any part of the system, physically or electronically, is a potential security risk. Security is about trust and trust is generally considered the weakest link in the security chain.
Social Engineering is the science of getting people to comply with your wishes and concentrates on the weakest link of the computer security chain. When it comes to malicious code defense, social engineering is one factor of virus delivery that’s certain to improve over time and become harder to detect, as well. Because e-mail messages can include file attachments, malicious individuals will send an infected file incorporated as an attachment with a catchy subject line in the hope that the recipient will open it. This was precisely the case with the infamous AnnaKournikova worm, Melissa virus and Naked Wife Trojan. Using the psychology of temptation, the creators of both AnnaKournikova and Naked Wife enticed a large segment of the Internet population into opening the attachment thereby activating the virus. Even the famous “I Love You” virus spread rapidly because the e-mail message it was attached to appeared to be genuine sign of affection from someone the recipient knew.
Social engineering has employed a number of ways to entice unsuspecting users into opening e-mail attachments, from pornography to phony security warnings and advice. So how do organizations defend against such attacks? The only protection against social-engineering attacks is through education of your employees.
Network defenses will certainly be enhanced when employees are motivated (not scared) to adopt a commonsense approach to security and trained to recognize possible security problems. This can be accomplished through an awareness and education program. The best training doesn’t include IT security as just another policy of the organization, but highlights the consequences of poor security practices. To diminish the risks posed by malicious code, The National Infrastructure Protection Agency (NIPC) offers these tips to mitigate these types of threats in the future.
- Close the preview pane of your e-mail program. The preview pane is the feature that shows you the contents of an e-mail before you choose to open it. It is often displayed below the pane that displays a list of e-mails, their titles and time of receipt or transmission.
- Disable the Java script and Active-X features of your web browser. Java and Active-X were designed to run more advanced features and to use services or make changes on the computer you are using. Unless these features are explicitly required, it is safer to deactivate them to prevent malicious scripts from infecting or compromising the computer or the network.
- Equip your computer with an anti-virus program, maintain the most current version, and select the user options that give you the most protection. There are several different types, not just different brands. Some anti-virus programs search for specific file "signatures," others monitor a computer program’s activity and prohibit virus-like behavior. There are also cost-free scans from vendors via the Internet that can scan your hard drive and removable disks. Ensure that your anti-virus program will screen attached files.
- Save attachments to a disk before opening. Do not open the attachment directly from the e-mail program. Save it to a disk, preferably a removable disk, and then scan the disk with an anti-virus program.
- Do not open e-mail attachments from strangers, regardless of how enticing the subject line may be. In addition to e-mails containing damaging computer viruses, there has been malicious spam. The spam plays off human curiosity. It may be an e-mail message or a redirection to another web page. The action is often to solicit donations to organizations claiming to be charities, or barraging computers with pop-up advertising.
- Be suspicious of any unexpected e-mail attachments from someone you do know. It may have been sent without that person’s knowledge from an infected machine. The Sircam virus continues to spread by automatically e-mailing itself between users who expect to communicate. Also, someone might have stolen a trusted person’s password and is pretending to be that trusted person.
- Verify suspicious e-mail. In the event you receive e-mail from someone you know, that has a suspicious title or attachment, contact the sender or the program coordinator by telephone or send them a new e-mail asking them to verify that they did intend to send you that e-mail.
Sowing the seeds of awareness will lead to employees taking a more proactive stance toward computer security. Had the general public had the knowledge, or been instructed to automatically verify the source and content of all e-mail attachments before opening them, viruses like Melissa or Naked Wife would not have been nearly as successful as they were.
About the Author
Douglas is a Certified Internet Webmaster Associate, and he holds A+, Network+, and i-Net+ certifications from the Computing Technology Industry Association. He has appeared as an Internet security guest speaker on several radio shows, including KYW Philadelphia, as well as on Something You Should Know and Computer Talk America, two nationally syndicated radio shows. He is also the author of Incident Response: Computer Forensics Toolkit, Securing the Network from Malicious Code: A Complete Guide to Defending Against Viruses, Worms, and Trojans and Internet Security Made Easy: A Plain-English Guide to Protecting Yourself and Your Company Online.
|
|
