Although we have long since known about the virility of email threats and
viruses, this year continues to supply heavily evolved and critically
destructive email attacks.
According to Symantec's semi-annual Internet Security Threat Report,
which was released this past September, between January 1 and June 30 of
this year, a record-breaking 1,862 new vulnerabilities were documented --
97 percent of them weighing in at moderate to high severity.
Adding to our problems, the time between vendor vulnerability disclosure
and the release of an exploit decreased from 6.4 days to 6.0. On average, 54 days passed between a vulnerabilitys appearance and the release of a patch to fix it.
Doing the math, that means approximately 48 days went idly by between the
exploitation of a vulnerability and the means with which to fix it.
It's not surprising that hackers are quickly devising exploits although
the large window of vulnerability makes it much easier for them. With all
that extra time, they're creating myriad versions of attacks and
experimenting with speed and voracity.
It's difficult to get ahead when ''known'' vulnerabilities mean that
they're known to the bad guys, as well. Common knowledge gives the
hackers a map to more attack points, while the IT department gets the
burden of prioritizing multiple top-tier crises.
The concept of layered security is academic by now. We routinely utilize
an army of solutions working in concert to protect our communication
networks, such as intrusion detection and prevention, spam filters,
anti-spyware tools, authentication, anti-virus, company rules,
regulations and user education. Despite the fortress we've built, we've
failed to adequately fill the gaps and the attacks keep seeping in.
''Some parts of our system have three layers of protection,'' says Brett
McKeachnie, director of Infrastructure Operations for Utah Valley State
College (UVSC) in Orem, Utah. ''Even then, we've found that there are
things that can get by all three layers. The threats that are out there
are so diverse that it's beyond the capability of one vendor and one
solution to protect us,''
UVSC has 3,000 faculty and staff email users, with an average daily email
volume of 50,000 to 100,000 messages. The IT department needed a way to
reduce the slowdowns caused by virus storms, where servers are inundated
by virus-laden emails. UVSC chose to deploy Lindon, Utah-based Avinti
Inc.'s iSolation Server to augment their existing anti-virus solution.
''If you're concerned about security, you have to have multiple layers,''
McKeachnie explains. ''When we started using Avinti iSolation Server, we
didn't know how many viruses were getting through. It was a wake-up call.
When school is in full session, we see anywhere between 1,000 viruses on
slow days to 17,000 one particular day, getting caught up in our email
protection.''
Developed as an augmentative tool, the iSolation Server is best
implemented as part of a layered email security strategy that integrates
anti-virus, anti-spam and anti-spyware solutions from other security
vendors. UVSC uses Novell GroupWise for its faculty and staff email
system, SpamAssassin's anti-spam technology and the iSolation Server to
augment Guinevere, a GroupWare-specific anti-virus solution.
Adding to the Layers?
As an industry, we may have accepted that layered protection is the best
course of action, but when the layers are legacy solutions that the
attacks have long since outsmarted, it becomes a question of how much
more we should add. IT administrators at some large companies say nothing
else is necessary when their existing anti-virus solution is catching all
the known attacks on the network.
In terms of security, a reactive response is rarely the most advantageous
approach to a problem. As a short-term solution, many top-tier
organizations are patching what they've already got. This would be
perfect if we knew every pattern and signature yet to be created, but the
reality is that security and attacks are both evolutionary and fluid.
''While the email security challenges companies face today have evolved
from a decade ago, or even a year ago, the email security technology
entrusted to protect businesses and consumers has failed to keep pace
with the threats,'' says Terry Dickson, CEO of Avinti, a provider of
email outbreak protection.
In June and July of 2005, The UK government's National Infrastructure
Security Co-ordination Centre noted a series of attacks identified as
targeted Trojans that were infiltrating companies via email. The
built-from-scratch malware has a much higher chance of defeating
anti-virus products and remaining under the radar long enough to create
extensive security breaches. The malicious nature of the Trojans is such
that even if you report the malware to anti-virus suppliers and receive
updates, the attacker already may have compromised other systems, and
subsequent detection of the original malware will no longer be of help.
''The issue of whether or not to augment existing security is something
the market has grappled with since the advent of virus protection,'' says
Curtis Tirrell, a vice president at Avinti. ''The number one line of
defense in protecting email communications is to know what you have. AV
does that by examining known patterns and specific elements of incoming
malware and stops it in your environment. The reality is, sometimes
malware gets missed because of its sophistication and its placement in
the window of vulnerability.''
Prepared for Increased Attacks?
This year's 10th Annual CSI/FBI Computer Crime and Security Survey found
that for the 690 participating companies, unauthorized access to the
networks has greatly increased and the loss from theft of proprietary
data per head has doubled .
Ironically, at the June, 2005 CSO Interchange in Chicago nearly 100
percent of the participant CSOs said they were well-prepared to handle
spam, worms, viruses, DoS attacks, and hacker attacks.
''Large enterprises have a specific investment in security systems and
they're doing whatever they can to tweak what they've got. I think most
companies will say, 'What we've got now is not perfect, but it's working,
stable, and we're going to stick with it,'' says Peter Firstbrook,
program director for Gartner, Inc., an industry analyst firm based in
Stamford, Conn. ''I certainly wouldn't tell people to wholesale replace
their solutions, but augmenting with new technologies that don't detract
from what they have is definitely a good idea.
''Let me put it this way, if your email security vendor is not evolving
with the threatscape, then you definitely should be looking at
alternatives and installing new hardware,'' says Firstbrook.
We have come to accept that enterprise security is a formula based on
budgets and acceptable levels of risk but if history teaches us anything,
we know that we'll never be able to call the race 'won'. The biggest
threat we face is our own complacency and the idea that our current
levels of protection are likely good enough.
IE 7
Firefox 2.0
