Subscribe to our e-mail newsletters
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Finance
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
More E-Mail Newsletters 
Computerworld 2007Subscribe to Computerworld
40 years of the most authoritative source of news and information for IT leaders.

How to toughen the weakest link in the security chain

Douglas Schweitzer   Today’s Top Stories    or  Other Security Stories  
 

Sign up to receive Security Resource Alerts

January 08, 2003 (Computerworld) -- The guiding tenet of computer security is that an organization's overall security is only as strong as its weakest link. While organizations around the globe routinely employ the use of powerful firewalls, antivirus software and sophisticated intrusion-detection systems to guard precious information assets, they often neglect the most important and vulnerable security component: the human element.

Without a license, we are not allowed to drive a car, fly a plane or practice medicine, yet we are free to surf the Internet and send and receive e-mail. While the use of the Internet doesn't have the same potential for causing harm as flying a plane without a license, the use of the Internet nevertheless has the potential to wreak havoc on an organization's networked PCs. Anyone with access to any part of the system, physically or electronically, is a potential security risk. Security is about trust, and trust is generally considered the weakest link in the security chain.


Social engineering is the science of getting people to comply with your wishes and concentrates on the weakest link of the computer security chain. When it comes to defense against malicious code, social engineering is one factor of virus delivery that's certain to improve over time and become harder to detect.


Because e-mail messages can include file attachments, malicious individuals will send infected files incorporated as attachments with a catchy subject line in the hope that recipients will open them. This was precisely the case with the infamous AnnaKournikova worm, the Melissa virus and the Naked Wife Trojan horse. Using the psychology of temptation, the creators of both AnnaKournikova and Naked Wife enticed a large segment of the Internet population into opening the attachment, thereby activating the virus. Even the famous "I Love You" virus spread rapidly because the e-mail message it was attached to appeared to be a genuine sign of affection from someone the recipient knew.


How to defend the organization











Douglas Schweitzer

Social engineering has employed a number of ways to entice unsuspecting users into opening e-mail attachments, from pornography to phony security warnings and advice. So how do organizations defend against such attacks? The only protection against social engineering attacks is through education of your employees.


Network defenses will certainly be enhanced when employees are motivated (but not scared) to adopt a common-sense approach to security and are trained to recognize possible security problems. This can be accomplished through an awareness and education program. The best training doesn't present IT security as just another policy of the organization, but highlights the consequences of poor security practices. To diminish the risks posed by malicious code, the National Infrastructure Protection Agency offers the following tips to mitigate these types of threats:



  1. Close the preview pane of your e-mail program. The preview pane is the feature that shows you the contents of an e-mail before you choose to open it. It's often displayed below the pane that displays a list of e-mails, their titles and time of receipt or transmission.




  2. Disable the JavaScript and ActiveX features of your Web browser. Java and ActiveX were designed to run more advanced features and to use services or make changes on the computer you are using. Unless these features are explicitly required, it's safer to deactivate them to prevent malicious scripts from infecting or compromising the computer or the network.




  3. Equip your computer with an antivirus program, maintain the most current version, and select the user options that give you the most protection. There are several different types, not just different brands. Some antivirus programs search for specific file signatures, others monitor a computer program's activity and prohibit viruslike behavior. There are also cost-free scans from vendors via the Internet that can scan your hard drive and removable disks. Ensure that your antivirus program will screen attached files.




  4. Save attachments to a disk before opening. Do not open the attachment directly from the e-mail program. Save it to a disk, preferably a removable disk, and then scan the disk with an antivirus program.




  5. Do not open e-mail attachments from strangers, regardless of how enticing the subject line may be. In addition to e-mails containing damaging computer viruses, there could be malicious spam. The spam plays off human curiosity. It may be an e-mail message or a redirection to another Web page. The action is often to solicit donations to organizations claiming to be charities or to barrage computers with pop-up advertising.




  6. Be suspicious of any unexpected e-mail attachments from someone you do know. It may have been sent without that person's knowledge from an infected machine. The Sircam virus continues to spread by automatically e-mailing itself between users who might expect to hear from each other. Also, someone might have stolen a trusted person's password and might be pretending to be that person.




  7. Verify suspicious e-mail. In the event you receive e-mail from someone you know that has a suspicious title or attachment, contact the sender or the program coordinator by telephone or send him a new e-mail saying that you want to verify that the questionable e-mail was intended for you.

Sowing the seeds of awareness will lead to employees taking a more proactive stance toward computer security. If the general public had the knowledge, or been instructed to automatically verify the source and content of all e-mail attachments before opening them, viruses like Melissa or Naked Wife wouldn't have been nearly as successful as they were.

Join an online discussion of this column.





Print this Story Send Us Feedback E-mail this Story Digg! Digg this Story Slashdot this Story
"This company's infrastructure group is running a disaster recovery exercise with a reluctant participant: an IT manager who's notorious as..." Read more...
"It's IT Blogwatch: in which Mozilla's Firefox Web browser continues to gain market share, smashing records as it does so...." Read more...
Read more Security posts or See all Blogs
Microsoft promises four patches next week
Google gives away home-cooked Web application security scanner
Expect iPhone, Fourth of July scams, security firm says
More top stories...
Microsoft trumpets security additions in upcoming IE8
Apple cuts price of high-end SSD MacBook Air by $500
Ultrathin showdown: Apple MacBook Air vs. Lenovo ThinkPad X300 vs. Toshiba Portege R500
All it takes is a couple hours and about $125 to breathe new life into an old laptop. Here's how.
Is Microsoft's Golden Age over? What are Gates' most memorable quotes? Find out in Computerworld's complete coverage of the end of the Bill Gates era at Microsoft.
There are some things your CIO definitely doesn't want to hear. Also don't miss the flipside, Five things you should always tell your boss.
With its latest version, Mozilla's browser continues to raise the bar for what Web browsers should be.
Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS.
Four years from now, the IT field will be a vastly different place. Will you be ready?
All Zones
Application Performance Zone
Business Continuity Zone
Data Center Management Zone
Enterprise-Class Security Zone
The File Data Management Zone
Grid Computing on Windows Zone
Security Management Zone
ITIL Best Practices Zone
The SAS Zone
Storage Virtualization Zone
Business Intelligence and Analytics Zone

Ads by TechWords

See your link here
Why SaaS is Vital to Email and Web Security
Why SaaS is Vital to Email and Web Security
Download this webcast, free, compilments of Webroot Software
Go to the webcast 
Computerworld Executive Bulletin: Building a Robust Antivirus Defense
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
(Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more.
Download this executive briefing download
Eliminate SPAM, Gain Productivity
Get this white paper now!
(Source: MessageLabs) Learn all about the dangers and the costs of spam in all its forms - from stock-touting to spreadsheet. Also, understand the drawbacks of traditional hardware- and software-based defenses - and the unique benefits of MessageLabs multi-layered, managed Anti-Spam solution; as illustrated by a real-world case study where MessageLabs stopped spam cold.
Download this white paper go
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Deploying Virtualized NetWare on Linux Whitepaper
Toward More Flexible, Next-Generation Collaboration Solutions
Driving Business Success Through Workgroup Choice and Flexibility
View more whitepapers