How to toughen the weakest link in the security chain

Why SaaS is Vital to Email and Web Security Avoiding the Latest Phishing Attacks Safeguarding Critical Data Intercept Spam & Viruses Seven Steps to Secure and Seamless Field Mobility Backup and Recovery for Microsoft Exchange Server Sign up to receive Security Resource Alerts

January 08, 2003 (Computerworld) -- The guiding tenet of computer security is that an organization's overall security is only as strong as its weakest link. While organizations around the globe routinely employ the use of powerful firewalls, antivirus software and sophisticated intrusion-detection systems to guard precious information assets, they often neglect the most important and vulnerable security component: the human element.

Without a license, we are not allowed to drive a car, fly a plane or practice medicine, yet we are free to surf the Internet and send and receive e-mail. While the use of the Internet doesn't have the same potential for causing harm as flying a plane without a license, the use of the Internet nevertheless has the potential to wreak havoc on an organization's networked PCs. Anyone with access to any part of the system, physically or electronically, is a potential security risk. Security is about trust, and trust is generally considered the weakest link in the security chain.

Social engineering is the science of getting people to comply with your wishes and concentrates on the weakest link of the computer security chain. When it comes to defense against malicious code, social engineering is one factor of virus delivery that's certain to improve over time and become harder to detect.

Because e-mail messages can include file attachments, malicious individuals will send infected files incorporated as attachments with a catchy subject line in the hope that recipients will open them. This was precisely the case with the infamous AnnaKournikova worm, the Melissa virus and the Naked Wife Trojan horse. Using the psychology of temptation, the creators of both AnnaKournikova and Naked Wife enticed a large segment of the Internet population into opening the attachment, thereby activating the virus. Even the famous "I Love You" virus spread rapidly because the e-mail message it was attached to appeared to be a genuine sign of affection from someone the recipient knew.

How to defend the organization

	Douglas Schweitzer is an Internet security specialist with a focus on malicious code. He is the author of Internet Security Made Easy: A Plain English Guide to Protecting Yourself and Your Company Online (Amacom Books, 2001) and Securing the Network from Malicious Code: A Complete Guide to Defending Against Viruses, Worms, and Trojans (John Wiley & Sons, 2002).

Social engineering has employed a number of ways to entice unsuspecting users into opening e-mail attachments, from pornography to phony security warnings and advice. So how do organizations defend against such attacks? The only protection against social engineering attacks is through education of your employees.

Network defenses will certainly be enhanced when employees are motivated (but not scared) to adopt a common-sense approach to security and are trained to recognize possible security problems. This can be accomplished through an awareness and education program. The best training doesn't present IT security as just another policy of the organization, but highlights the consequences of poor security practices. To diminish the risks posed by malicious code, the National Infrastructure Protection Agency offers the following tips to mitigate these types of threats:

1. Close the preview pane of your e-mail program. The preview pane is the feature that shows you the contents of an e-mail before you choose to open it. It's often displayed below the pane that displays a list of e-mails, their titles and time of receipt or transmission.
   
   
   
   


2. Disable the JavaScript and ActiveX features of your Web browser. Java and ActiveX were designed to run more advanced features and to use services or make changes on the computer you are using. Unless these features are explicitly required, it's safer to deactivate them to prevent malicious scripts from infecting or compromising the computer or the network.
   
   
   
   


3. Equip your computer with an antivirus program, maintain the most current version, and select the user options that give you the most protection. There are several different types, not just different brands. Some antivirus programs search for specific file signatures, others monitor a computer program's activity and prohibit viruslike behavior. There are also cost-free scans from vendors via the Internet that can scan your hard drive and removable disks. Ensure that your antivirus program will screen attached files.
   
   
   
   


4. Save attachments to a disk before opening. Do not open the attachment directly from the e-mail program. Save it to a disk, preferably a removable disk, and then scan the disk with an antivirus program.
   
   
   
   


5. Do not open e-mail attachments from strangers, regardless of how enticing the subject line may be. In addition to e-mails containing damaging computer viruses, there could be malicious spam. The spam plays off human curiosity. It may be an e-mail message or a redirection to another Web page. The action is often to solicit donations to organizations claiming to be charities or to barrage computers with pop-up advertising.
   
   
   
   


6. Be suspicious of any unexpected e-mail attachments from someone you do know. It may have been sent without that person's knowledge from an infected machine. The Sircam virus continues to spread by automatically e-mailing itself between users who might expect to hear from each other. Also, someone might have stolen a trusted person's password and might be pretending to be that person.
   
   
   
   


7. Verify suspicious e-mail. In the event you receive e-mail from someone you know that has a suspicious title or attachment, contact the sender or the program coordinator by telephone or send him a new e-mail saying that you want to verify that the questionable e-mail was intended for you.

Sowing the seeds of awareness will lead to employees taking a more proactive stance toward computer security. If the general public had the knowledge, or been instructed to automatically verify the source and content of all e-mail attachments before opening them, viruses like Melissa or Naked Wife wouldn't have been nearly as successful as they were.

Join an online discussion of this column.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

"This company's infrastructure group is running a disaster recovery exercise with a reluctant participant: an IT manager who's notorious as..." Read more... "It's IT Blogwatch: in which Mozilla's Firefox Web browser continues to gain market share, smashing records as it does so...." Read more... Read more Security posts or See all Blogs

Microsoft promises four patches next week Google gives away home-cooked Web application security scanner Expect iPhone, Fourth of July scams, security firm says More top stories...

Microsoft trumpets security additions in upcoming IE8 Apple cuts price of high-end SSD MacBook Air by $500 Ultrathin showdown: Apple MacBook Air vs. Lenovo ThinkPad X300 vs. Toshiba Portege R500

This old laptop: Revitalizing an aging notebook on the cheap All it takes is a couple hours and about $125 to breathe new life into an old laptop. Here's how. Bill Gates moves on Is Microsoft's Golden Age over? What are Gates' most memorable quotes? Find out in Computerworld's complete coverage of the end of the Bill Gates era at Microsoft. Five things you should never tell your boss There are some things your CIO definitely doesn't want to hear. Also don't miss the flipside, Five things you should always tell your boss. Hands-On: Firefox 3 fixes what's broke and keeps what's right With its latest version, Mozilla's browser continues to raise the bar for what Web browsers should be. Windows Vista A to Z Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS. More Continuing Coverage After 9/11: Homeland SecurityAsk a Premier 100 IT LeaderBlackBerry Legal BattleData Security BreachesElectronic VotingFirefoxH-1B VisasHP's Boardroom ScandalHandheld DevicesHurricane Katrina AftermathMicrosoft Legal IssuesMicrosoft's VistaOpen SourceRFID TechnologySCO's Linux FightSarbanes-Oxley ActSpamVoice Over IPWi-FiWindows Meta File VulnerabilityWindows XP Service Pack 3 IT Careers 2010 Four years from now, the IT field will be a vastly different place. Will you be ready? More Special Reports Premier 100 IT Leaders 2007 Best in Class2006 Computerworld Horizon Awards2006 Premier 100 IT Leaders2006 Salary Survey2007 Best Places to Work in IT2007 IT Forecast2007 Premier 100 IT Leaders40 Years of ComputerworldASPs, Take TwoBest Places to Work in IT 2003Best Places to Work in IT 2004Best Places to Work in IT 2005Best Places to Work in IT 2006Business Intelligence Home RunsBusiness Intelligence: Smarter BIBusiness Intelligence: The Future of BICRM Goes VerticalCRM: Sober CRMCareer Planning Guide 2005Careers: IT Profession 2010Computerworld Horizon Awards 2005Data Management: Mining for GemsData Management: Taming Data ChaosDevelopment: Hard-Workin' Web SitesDevelopment: New Tools New ChoicesDevelopment: The New World of Application DevelopmentDevelopment: The Web Services TsunamiDevelopment: Web Services HurdlesDisaster Recovery: Preparing for the WorstE-commerce Grows UpE-mail/Groupware: Big DecisionsFaces of Mobile ITForecast 2006Global MobileHardware: Multiple Cores, Multiple ChallengesHardware: On-Demand Un-HypedHardware: The Shape of Things to ComeHorizon Awards: 10 Cool Cutting Edge TechnologiesIT Management: Guide to Managing VendorsIT Management: Navigating Global ITIT Management: Recovery AheadIT Management: The Future of ITIT Management: The Resourceful Project ManagerInnovative Technology Awards 2004Management: Reinventing ITMicrosoft in TransitionMobile/Wireless Leaders and LaggardsMobile/Wireless: The Untethered WorkerMobile/Wireless: Tiny Gadgets, Huge CostsNetwork Management: Taking ControlNetworking: Turbulence Ahead!Networking: VoIP Goes MainstreamOperating Systems: In the Slow LaneOperating Systems: Linux Goes GlobalOperating Systems: Should You Nix Unix?Outsourcing: Offshore Buyer's GuideOutsourcing: Outsourcing DangersPremier 100 IT Leaders 2004 Best in ClassPremier 100 IT Leaders 2005 Best in ClassROI: Do the Math!Salary Survey 2003Salary Survey 2004Salary Survey 2005Security Action PlanSecurity: Compliance HeadachesSecurity: Proactive SecuritySecurity: Risk and RewardSecurity: Tips From Security ProsSouped-up SecurityStorage: Battling ComplexityStorage: Cheap & Secure Data StoresStorage: Stretching Your Storage DollarsStorage: The Lean Storage MachineStorage: The New Rules of StorageStorage: The Ultimate Backup GuideSupply Chain: Missing LinksSupply Chain: RFID Reality CheckThe Business of SecurityWeb 2.0 SecurityWireless: Wireless At Work All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone See your link here

Why SaaS is Vital to Email and Web Security Why SaaS is Vital to Email and Web Security Download this webcast, free, compilments of Webroot Software Go to the webcast  Computerworld Executive Bulletin: Building a Robust Antivirus Defense Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. (Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more. Download this executive briefing  Eliminate SPAM, Gain Productivity Get this white paper now! (Source: MessageLabs) Learn all about the dangers and the costs of spam in all its forms - from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses - and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold. Download this white paper  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. Deploying Virtualized NetWare on Linux Whitepaper Toward More Flexible, Next-Generation Collaboration Solutions Driving Business Success Through Workgroup Choice and Flexibility View more whitepapers

• Microsoft promises four patches next week
• Google gives away home-cooked Web application security scanner
• Expect iPhone, Fourth of July scams, security firm says
• More top stories 

Security Management Zone Security management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones

Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day. New baits

"Security Directions" virtual trade show 2008's Code-Red Security Issues for Protecting the Enterprise Webcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter

In Security Security's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied