How to toughen the weakest link in the security chain

The guiding tenet of computer security is that an organization's overall security is only as strong as its weakest link. While organizations around the globe routinely employ the use of powerful firewalls, antivirus software and sophisticated intrusion-detection systems to guard precious information assets, they often neglect the most important and vulnerable security component: the human element.

Without a license, we are not allowed to drive a car, fly a plane or practice medicine, yet we are free to surf the Internet and send and receive e-mail. While the use of the Internet doesn't have the same potential for causing harm as flying a plane without a license, the use of the Internet nevertheless has the potential to wreak havoc on an organization's networked PCs. Anyone with access to any part of the system, physically or electronically, is a potential security risk. Security is about trust, and trust is generally considered the weakest link in the security chain.

Social engineering is the science of getting people to comply with your wishes and concentrates on the weakest link of the computer security chain. When it comes to defense against malicious code, social engineering is one factor of virus delivery that's certain to improve over time and become harder to detect.

Because e-mail messages can include file attachments, malicious individuals will send infected files incorporated as attachments with a catchy subject line in the hope that recipients will open them. This was precisely the case with the infamous AnnaKournikova worm, the Melissa virus and the Naked Wife Trojan horse. Using the psychology of temptation, the creators of both AnnaKournikova and Naked Wife enticed a large segment of the Internet population into opening the attachment, thereby activating the virus. Even the famous "I Love You" virus spread rapidly because the e-mail message it was attached to appeared to be a genuine sign of affection from someone the recipient knew.

How to defend the organization

1pixclear.gif
Douglas Schweitzer
1pixclear.gif

Social engineering has employed a number of ways to entice unsuspecting users into opening e-mail attachments, from pornography to phony security warnings and advice. So how do organizations defend against such attacks? The only protection against social engineering attacks is through education of your employees.

Network defenses will certainly be enhanced when employees are motivated (but not scared) to adopt a common-sense approach to security and are trained to recognize possible security problems. This can be accomplished through an awareness and education program. The best training doesn't present IT security as just another policy of the organization, but highlights the consequences of poor security practices. To diminish the risks posed by malicious code, the National Infrastructure Protection Agency offers the following tips to mitigate these types of threats:

  1. Close the preview pane of your e-mail program. The preview pane is the feature that shows you the contents of an e-mail before you choose to open it. It's often displayed below the pane that displays a list of e-mails, their titles and time of receipt or transmission.

  2. Disable the JavaScript and ActiveX features of your Web browser. Java and ActiveX were designed to run more advanced features and to use services or make changes on the computer you are using. Unless these features are explicitly required, it's safer to deactivate them to prevent malicious scripts from infecting or compromising the computer or the network.

  3. Equip your computer with an antivirus program, maintain the most current version, and select the user options that give you the most protection. There are several different types, not just different brands. Some antivirus programs search for specific file signatures, others monitor a computer program's activity and prohibit viruslike behavior. There are also cost-free scans from vendors via the Internet that can scan your hard drive and removable disks. Ensure that your antivirus program will screen attached files.

  4. Save attachments to a disk before opening. Do not open the attachment directly from the e-mail program. Save it to a disk, preferably a removable disk, and then scan the disk with an antivirus program.

  5. Do not open e-mail attachments from strangers, regardless of how enticing the subject line may be. In addition to e-mails containing damaging computer viruses, there could be malicious spam. The spam plays off human curiosity. It may be an e-mail message or a redirection to another Web page. The action is often to solicit donations to organizations claiming to be charities or to barrage computers with pop-up advertising.

  6. Be suspicious of any unexpected e-mail attachments from someone you do know. It may have been sent without that person's knowledge from an infected machine. The Sircam virus continues to spread by automatically e-mailing itself between users who might expect to hear from each other. Also, someone might have stolen a trusted person's password and might be pretending to be that person.

  7. Verify suspicious e-mail. In the event you receive e-mail from someone you know that has a suspicious title or attachment, contact the sender or the program coordinator by telephone or send him a new e-mail saying that you want to verify that the questionable e-mail was intended for you.

Sowing the seeds of awareness will lead to employees taking a more proactive stance toward computer security. If the general public had the knowledge, or been instructed to automatically verify the source and content of all e-mail attachments before opening them, viruses like Melissa or Naked Wife wouldn't have been nearly as successful as they were.

Join an online discussion of this column.

Related:

Copyright © 2003 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon