15 Foolish High Tech Stories

Network World chose to honor April Fools Day with a story around 15 "foolish" stories that have occurred over the last year. Some interesting tidbits include the rise of fake security programs going from 2,500 to close 10,000 this year and the rise in online scams to take advantage of the government's stimulus program.

Both of these are good reminders to keep an eye on corporate security and an eye on what your end-users are downloading from the internet into the corporate network. The secure web gateway remains the best defense against malicious intent.

April 1st, April Fools

With April 1 coming soon, there's plenty to worry about if you're a security administrator. First off there's plenty of articles already floating around the internet, worrying about what the Conflicker worm will do on April 1st. The experts still aren't quite certain what, if anything Conflicker might do when it activates its payload. With that uncertainty, and the usual glut of viruses and practical jokes that occur on April Fools Day, the typical security administrator should have no lack of things to worry about.

As a part-time administrator myself (I do still manage all my home systems, and the systems of family members, even if I don't currently manage a corporate network), it still amazes me when one of my end-users asks me why a web page is being blocked. I'm amazed because the software I have installed on their system (the free K9 software from Blue Coat), says specifically why (spyware or malware source, or illegal/questionable) they are being blocked, yet the typical end-user wants to go to that site anyway (since it came up in a search of what they were looking for). With April 1st coming around the corner, I'll have to redouble my resolve to keep blocking bad websites. The corporate admin should never lose their resolve to keep their security in place.

Melissa virus turning 10 ... (age of the stripper unknown)

We celebrate a notorious anniversary this week, it's the 10th anniversary of the Melissa virus, one of the more well-known email viruses. Some of the comments on the Network World article on the anniversary, include disbelief that it's been 10 years already since the outbreak of Melissa. It does seem like it was only yesterday that IT admins were cleaning up the mess left from Melissa. This anniversary is a good reminder for all admins to keep vigilant and review the current security measures in place for for any traffic that goes to or comes from the internet.

China becoming the world's malware factory

It's not a surprise to anyone already working in the security industry, but a lot of malware and viruses come from or are hosted in China. A new article in Network World this week highlighted this fact.

With China's economy cooling down, some of the country's IT professionals are turning to cybercrime, according to a Beijing-based security expert.

Speaking at the CanSecWest security conference last week, Wei Zhao, CEO of Knownsec, a Beijing security company, said that while many Chinese workers may be feeling hard times, business is still booming in the country's cybercrime industry. "As the stock market dropped like a stone, a lot of IT professionals lost lots of money on the stock market," he said. "So sometimes they sell 0days," he said, referring to previously unknown software bugs.

This increase in cybercrime should be a concern to any IT administrator. The job of security is difficult enough without the addition of more hackers intent on bringing malware to our end-users. And hackers are finding more ways to target end-users. Just look at this quote below from Network World.

Hackers have had a lot of success launching widespread 0 day attacks against programs like RealPlayer and Adobe Flash, but they have also hit local Chinese programs, including Xunlei, QQ and UUSee.

Need I say any more?

Today's Cloud: Garbage; Tomorrow's?: Insanely Great

Paul Murphy chose to highlight in his blog this week the topic of cloud computing. He's got a very negative view of it since the recent Gmail failures highlight that any cloud service, even run by a well-known and resourceful company can fail. It goes back to that fundamental belief that if you don't have control over the service, you're subject to random outages that can cause your organization significant dollars. The Gmail incident was sobering in that the outage was for a rather extended time period, making the incident all that more costly for anyone depending on it. It's a good reminder why we use appliances, and why IT departments tend to manage their own servers and services like proxies and web gateways.

There is one spectacular piece that Paul Murphy links to in his blog and that's this 8 minute video of a speech of some new technology that's being worked on at MIT. It's not really related to this blog (only peripherally), but it is phenomenal and well worth the time spent to view it.

Hacked page hauls estimated at $10,000 a day

A new study out from Finjan estimates that embedded URLs on compromised webpages is netting a huge haul of cash for hackers.

The attackers had compromised a series of pages which were then embedded with lists of popular search terms collected from services such as Google Trends or current news items. The same pages were then injected with obfuscated code that redirected to the attack page, which used fake alert boxes to convince the user to download and purchase the bogus security software for $50 (£34).

We've talked about compromised webpages on this blog before, and it's important to remember even well-known and trusted sites can be compromised. That's why it's important to make sure your end-users are browsing the web safely through a secure web gateway or proxy that has embedded URL blocking (that way they can get to the content they need without having to block the entire page), and scanning for malware and viruses. Equally important is real-time rating of URLs since risky sites are added daily to the world wide web.

The Gartner Phenomenon

It's not unusual for larger enterprises to use Gartner's opinions on IT products to help influence their purchasing decision. In the proxy world, Gartner publishes a Magic Quadrant for Secure Web Gateway, which covers web security devices, of which most are proxies.

For those unfamiliar with the Magic Quadrant, the idea is that each product/company gets put into one of four corners; "leaders", "challengers", "visionaries", and "niche players". In general most companies look to try to get into the "leaders" quadrant, and as far to the right and as far up as possible.

Typically if a company is in the "leaders" quadrant, that means they not only have significant market share, but they are also driving product direction and have a completeness of vision. If a company is in the "challengers" quadrant, they have market share, but typically it appears they don't have as much vision in driving new features in the product category. In the "visionaries" quadrant, the company tends not to have the market share, but has the vision and understanding of the product category. "Niche players" is the category for companies that don't have an overall market share or vision, and may play only in one small part of the market.

Companies change positions in the Magic Quadrant from year to year, so it's always interesting to see if they've gained market share and if they've somehow improved their vision. While the Magic Quadrant can help you make a decision on a product, it always pays to also make your own evaluation when choosing a product or solution.