Enterprises Accept Malware As Cost of Doing Business

A new study from Osterman Research and M86 found that 49% of businesses acknowledged security breaches in their network, and accepted them as a cost of doing business. 78% experienced a breach in the last 12 months. It's surprising given each of these breaches has an associated cost. Over half estimated the cost of a breach to be up to $50,000.

With costs like that it makes sense to look at the security infrastructure and make sure you're protecting end-users from malware, phishing, and targeted attacks where possible. The secure web gateway or web proxy is just one component in this protection, but definitely one you should have in place if you're looking to protect end-users from malware in today's web driven world.

Web 2.0 Controls

The latest in web security seems to be what some vendors call Web 2.0 controls, and others call social networking control. Before the new controls, most security companies just offered the basic block and allow of specific categories like "Social Networking", and some even offered the slightly more advanced blocking of sites that match two categories, for example blocking sites classified as both "Social Networking" and "Games", in order to prevent employees from playing "Farmville" and "Mafia Wars" while still being able to use Facebook.

But the new controls are even more advanced, allowing you to prevent uploads to social networking sites, posting to social networking sites, etc. The benefit here, is sort of a read-only capability with social networking sites. Employees can view, but they can't share any information to a social networking site. It's a big change from just block and allow.

Both Blue Coat and Ironport have these types of controls in their latest software. These capabilities give IT admins the ability to allow social networking without having to worry about data leakage, additional wasted time on games on social networking sites, and users spending the day updating their Facebook pages.

Gartner Risk and Security Conference

Next week at the Gaylord National Harbor Hotel in Washington, D.C., from June 19-22, 2011 is the Gartner Risk and Security conference. It's a great conference if you're an organization and looking to hear the latest on risk and security, and to visit some of the leading vendors recommended by Gartner, including of course secure web proxy vendors.

Users Ignore Malware Warnings

As an IT admin you're all too familiar with the type of user who gets a warning that they're visiting a malicious site, about to open a malicious executable, or read spam email, but they do it anyway, overriding the security of their system. Some of them even have to enter a password to override their security settings, and yet they do it anyway, and sure enough they infect themselves with a virus or malware.

The folks over at Blue Coat wrote a recent article on their Security blog talking about an new phishing attack, that basically had no information at all in the attack with the exception of a single link (the email basically had no subject, from, or text other than the link), and sure enough some users of their home security product, K9 went ahead and overrode the settings to visit the link and were infected.

Examples like these are good reminders why we don't depend on our end-users to maintain their own security, or make sure their security is up to date. It's why a secure web gateway or web proxy maintained by an IT department is so important, and also why you don't give your users the admin password.

Security Considerations for IPv6

PC World ran an article last week on the security concerns around transitioning to IPv6. It's a relevant topic with World IPv6 day coming this week, and with the runout of IPv4 address space.

Number one on their list of concerns was security when translating between IPv4 and IPv6, and the concern that a transaction that starts out securely in one or the other technology might open itself up to being attacked when translated to the to other technology.

That's when it's important to consider technology that actually proxies IPv4 traffic to IPv6 rather than bridges the traffic. A proxy of course terminates the traffic and creates a completely new secure transaction to the destination. In addition as the proxy is a security device and should already have security implemented, compared with a device like a switch that's acting as a translation device.

No matter how you integrate IPv6, you'll want to make sure your remember security as part of the deployment scenario.

Malware Up, Spam Down

McAfee's latest quarterly security report is showing an large increase in the amount of malware, along with a decrease in the amount of spam. The first quarter included six million unique samples of recorded malware, the most ever reported in a Q1 report by McAfee.

Spam is reported to be at its lowest levels in years, but cybercriminals have made up for the lack of spam with the increase not only in malware, but in platforms that are targeted, including Macs and Android operating systems.

The report is a good reminder that email security isn't the only application level security needed in an organization. Web security is as important if not more important in today's web based world.