Welcome!

Cloud Security Authors: Liz McMillan, Pat Romanski, Ed Featherston, Elizabeth White, Darren Anstee

Blog Feed Post

How To Deal With Internet Security Threats

Ian Kilpatrick, chairman of IT specialist Wick Hill Group, examines the range of Internet security threats faced by companies today and advises on how to protect against them.

1. INTRODUCTION
How to use the Internet while staying secure has always been a concern for businesses. Over the last couple of years there have been many changes in the Internet threat scenario. Most notably there has been a significant increase in the 'access anywhere/anytime culture' with a growth in social networking, a move to convergence solutions such as VoIP, a major increase in smartphone use, a growth in cloud computing, plus the 'consumerisation' of systems (i.e. the use of personal devices for company data).

2. OVERVIEW OF INTERNET THREATS.
The range of security threats includes

* Malicious threats, such as viruses and other malware

* Fraud threats such as phishing emails, spyware and toll fraud

* Unauthorised access from hacking, data leakage, botnets, unsecured wireless, and user name/password insecurity, etc.

* Operational threats, such as distributed denial of service (DDoS) attacks, attacks on VoIP, the failure of cloud computing suppliers to secure your network, or security risks from remote workers.

* Newer threats such as social networking insecurity, web application threats, smartphone insecurity and poor security for converged voice/data applications on the network

3. HOW TO PROTECT AGAINST INTERNET THREATS
The basics that companies need to protect themselves in today's internet environment include:

Risk assessment/risk management.
A risk assessment should be carried out BEFORE implementing additional aspects of internet use, to identify the risks and determine what, if anything, needs to be done to minimise them. It is important to regularly review all security policies. Recent history has shown that it is less expensive, easier and more efficient to deploy security at the beginning of any project than to try to "backfill" it. Oh yes, and it's more secure!

Staff training
Educated staff are the first and main line of defence. Staff need to be brought on board, where security is concerned. The impetus needs to come from the top and be maintained.

Staying up to date
A basic and key way of staying secure is to make sure you rapidly deploy software updates, such as operating system and browser updates. Make sure too that patches, particularly security patches, are installed as soon as available.

Anti-virus/anti-spyware
As a first line of defence, users should be educated to not open unknown attachments, which are a common source of viruses and spyware, and to be very cautious about clicking on any links.

Anti-virus systems should be behaviour-based and updated automatically in the background. Many anti-virus solutions also incorporate anti-spyware elements, to help cope with problems such as the theft of user names and passwords. Suppliers include Kaspersky Lab, VIPRE Business, Norton, McAfee and Symantec. Anti-spyware suppliers include Barracuda Networks and WebRoot. Free anti-spyware solutions, such as Spybot, are also available.

Firewalls
Firewalls are now almost universally deployed. All messages entering or leaving the network pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.

A huge range of firewalls is available today from companies such as Check Point, Nortel, Nokia and WatchGuard. Firewalls are also available as part of a unified threat management appliance (UTM) or an extensible threat management (XTM) appliance, where a firewall is combined with other security functions, including (in many cases) web application firewalling (WAF), sometimes also known as deep packet inspection (DPI).

Authentication
The best way to prevent unauthorised access is through authentication.

Single factor authentication involves the use of passwords only, ranging from weak to complex. It has a number of insecurities and is highly vulnerable to the same password being used for multiple applications (including social networking), increasing the risk that your business applications security could be breached.

Strong two factor authentication comprises something you know (a password) and something you have (e.g. a hardware token, which can produce a time limited one time password, a soft token (for example a PIN sent to a mobile phone) or a swipe card). Companies including VASCO, RSA and CRYPTOCard provide strong two factor authentication solutions. While there are still risks with this approach, it provides significantly improved security at a comparatively low cost

Biometric authentication, involving personal elements such as fingerprint or iris recognition, is more appropriate for high security applications, such as financial or defence.

Remote user security
Encrypted virtual private networks (VPNs), either IPsec or SSL, are the typical solution for secure branch to head office communications, for communications between companies and third parties such as suppliers, and for secure communications between remote/mobile workers and head office/branches. This should be done, using a minimum of two-factor authentication.

Branch offices can install low-cost remote UTMs which incorporate VPNs and these can be centrally administered, typically by the head office. Companies such as WatchGuard, Check Point and NETASQ provide remote, centrally manageable IPsec and SSL VPN solutions.

Another method of securing remote and mobile users is endpoint security (EPS). Coupled with central management, it can ensure that firewall, anti-virus and security patches are used. A range of solutions is available from companies such as Check Point, GFI Software, Kaspersky Lab and Citrix.

With the growth of remote working, managing the remote worker network securely has become increasingly difficult and costly. To complicate matters, many employees are using their own PCs, laptops and smartphones to link to the company.

This carries a significant risk of these devices being infected by spyware, etc. and introduced to the network. Additionally, data on them could be unprotected. Coupled with this, there is the high cost of providing, supporting, patching and managing company supplied devices.

One solution is for the employer to give the employee an allowance to buy their own PC or laptop and to supply them with a secure, hardware encrypted flash drive with embedded security software.

This creates a secure tunnel, stronger than an SSL VPN, between the remote worker's PC and the applications on the home network. File transfer between the PC hosting the flash drive, and the corporate network, is strictly controlled. The use of applications and programmes too is subject to the applied security policy.

These types of solutions essentially provide a secure, virtual environment, irrespective of the security status of the users PC/Laptop. They include solutions from Check Point (Abra) and IronKey, as well as the different approach of virtual desktop infrastructure (VDI) from Citrix and VMware.

Smartphone growth presents another remote access security risk. Staff are increasingly using them to retrieve email and use other applications on the move.

But they remain largely unprotected and have the potential to put the whole network at risk through unauthorised access, particularly as they are so easily lost or stolen. Wi-Fi roaming out of the office, creates a number of security risks, including the risk of identity and security credentials being lost or stolen.

Because of the dangers, smartphones should be treated just like PCs, when it comes to securing them.

A lot can be done through carrying out a number of simple preventative actions. For example, use the PIN function to secure the phone, install data wiping facilities, employ time-out policies, and install GPS tracking so the phone can be located if stolen. Authentication to the network from smartphones is essential.

Specific smartphone security solutions are also available from suppliers such as Kaspersky Lab, Sipera, CRYPTOCard and Check Point.

Wireless security
The use of wireless has grown significantly in the last few years and is now endemic, with smartphones increasingly being used to connect to wireless.

Authentication is absolutely crucial in this environment and strong two factor authentication should be used for access to all confidential internal data, from wireless pcs, laptops and smartphones. Sensitive data should not be held on a smartphone or wireless laptops, unless encrypted.

IPSec or SSL encrypted VPNs should be used for all wireless communications between head office and remote locations, such as branch offices, mobile users or home workers.

When employees leave a company, and their access to wireless hasn't been managed, then the risk of them causing problems through unauthorised access is significantly increased.

Wi-Fi roaming and Bluetooth are other risks, with many users leaving their devices Wi-Fi roaming and Bluetooth-enabled. This leaves them vulnerable to attacks resulting in access to the devices and the company network, particularly if authentication is not strong enough.

If your organisation is using unencrypted wireless in the office, all the information held on your network can be at risk. If your existing solution supports WPA2 or even the discredited WEP encryption, switch it on (it will have arrived with the default off). It is a good idea to encrypt all relevant confidential files, data, internal e-mails and network attached storage (NAS).

Wireless security providers include companies such as Aruba Networks, Check Point, Ruckus, SonicWall, and WatchGuard.

Encryption (including laptop and smartphone encryption)
The easiest and most effective way of stopping sensitive and critical data being read by unauthorised personnel or outsiders is to encrypt it.

Loss or theft of data stored on laptops or smartphones is a particular problem.
However, this can be easily and inexpensively protected using comparatively low-cost encryption software for laptops from companies such as Pointsec, Utimaco and PGP, and specific mobile security software for smartphones.

The use of unified encryption management (UEM) means encryption can be easily managed across all data risk areas including desktops, laptops, PDAs, USB sticks, mobile phones and other removable media.

* Converged systems security
Security convergence is different from normal data security, because the link between phone systems and the Internet makes both voice and data more vulnerable to problems such as toll fraud and the total loss of both voice and data communications, if VoIP is hacked. However, there are security products available specifically tailored for a unified communications (UC) environment. These include solutions from Sipera, Panasonic and Samsung.

* Cloud computing/hosted systems security
If you put your network into the cloud or use hosted systems, then you are making someone else responsible for your security and need to ask your supplier a number of questions. These could include:

- what security and authentication procedures are in place for remote staff access?
- how is data secured against leakage?
- what protection is there against DDoS attacks?
- how can you guarantee your staff won't access my company's data?
- what is the service level agreement for availability and what is the recourse if it is breached?
- in what jurisdiction is my data held and stored?

4. MULTI FUNCTIONAL SOLUTIONS

UTMs
Unified threat management systems (UTMs) are designed to provide a range of security solutions in a single appliance, reducing costs and simplifying the whole process of security systems management and installation. The minimum requirement for a UTM is a firewall, VPN, anti-virus and intrusion detection/prevention. Some UTMs may also provide anti-spam, web content inspection spyware protection, centralised management, monitoring, and logging capabilities.

XTMs
Extensible threat management systems (XTMs) are a development of UTMs, which combine fast throughput with advanced networking features to handle high-volume traffic. They are suitable for 50-10,000 or more users.

Popular UTM and XTM solutions include those from WatchGuard, Check Point, Fortinet, Barracuda Networks and NetASQ.

Web Application Firewalling (WAF)
Web application firewalls apply rules to HTTP (essentially web server and browser) conversations. This is sometimes also known as deep packet inspection (DPI). Dedicated devices are available such as SecureSphere from Imperva, ModSecurity (open source) and the Barracuda Web Site Firewall. WAF is also included in many UTM and XTM solutions.

A variety of other multi-functional solutions, incorporating various security product mixes, is also available from companies such as Kaspersky Lab, Symantec, McAfee and Computer Associates.

5. CONCLUSION
The latest important IT security concerns include the increasing amount and variety of remote access, and the growing use of converged systems such as VoIP and smartphones. However, these and other ongoing security risks such as malware, fraud and data leakage, can all be adequately protected against with a strong commitment to security and the deployment of appropriate solutions.

Links

* www.wickhill.com
* arubanetworks.com
* barracudanetworks.com
* http://www.ca.com/gb/default.aspx
* checkpoint.com
* cryptocard.com
* fortinet.com
* imperva.com
* ironkey.com
* kaspersky.co.uk
* mcafee.com
* modsecurity.org
* netasq.com
* nokia.co.uk
* Nortel.com
* panasonic.co.uk
* rsa.com
* ruckuswirelessuk.co.uk
* http://www.safer-networking.org/index2.html
* samsung.com
* Sipera.com
* sonicwall.com
* http://www.sunbeltsoftware.com/documents/vipre-business-why-customers-love-vipre-business.pdf
* symantec.com
* utimaco.com
* vasco.com
* vmware.com
* watchguard.co.uk
* webroot.co.uk

THE AUTHOR
Ian Kilpatrick is chairman of Wick Hill Group plc, specialists in secure IP infrastructure solutions for e-business. Ian has been involved with the Group for more than 30 years. Wick Hill is an international organisation supplying most of the Time Top 1000 companies through a network of accredited resellers. Contact www.wickhill.com, 01483 227600.

Ian looks at computing from a business point-of-view and his approach reflects his philosophy that business benefits and ease-of-use are key factors in IT. He has had numerous articles published in the UK and overseas press, as well as being a regular speaker at IT conferences.

ENDS

For further press information, please contact Annabelle Brown on 01326 318212, email [email protected]. For reader queries, please contact Wick Hill on 01483 227600, web www.wickhill.com.

Read the original blog entry...

More Stories By RealWire News Distribution

RealWire is a global news release distribution service specialising in the online media. The RealWire approach focuses on delivering relevant content to the receivers of our client's news releases. As we know that it is only through delivering relevance, that influence can ever be achieved.

@ThingsExpo Stories
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...
Adobe is changing the world though digital experiences. Adobe helps customers develop and deliver high-impact experiences that differentiate brands, build loyalty, and drive revenue across every screen, including smartphones, computers, tablets and TVs. Adobe content solutions are used daily by millions of companies worldwide-from publishers and broadcasters, to enterprises, marketing agencies and household-name brands. Building on its established design leadership, Adobe enables customers not o...
Why do your mobile transformations need to happen today? Mobile is the strategy that enterprise transformation centers on to drive customer engagement. In his general session at @ThingsExpo, Roger Woods, Director, Mobile Product & Strategy – Adobe Marketing Cloud, covered key IoT and mobile trends that are forcing mobile transformation, key components of a solid mobile strategy and explored how brands are effectively driving mobile change throughout the enterprise.
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lea...
What are the new priorities for the connected business? First: businesses need to think differently about the types of connections they will need to make – these span well beyond the traditional app to app into more modern forms of integration including SaaS integrations, mobile integrations, APIs, device integration and Big Data integration. It’s important these are unified together vs. doing them all piecemeal. Second, these types of connections need to be simple to design, adapt and configure...
Just over a week ago I received a long and loud sustained applause for a presentation I delivered at this year’s Cloud Expo in Santa Clara. I was extremely pleased with the turnout and had some very good conversations with many of the attendees. Over the next few days I had many more meaningful conversations and was not only happy with the results but also learned a few new things. Here is everything I learned in those three days distilled into three short points.
What happens when the different parts of a vehicle become smarter than the vehicle itself? As we move toward the era of smart everything, hundreds of entities in a vehicle that communicate with each other, the vehicle and external systems create a need for identity orchestration so that all entities work as a conglomerate. Much like an orchestra without a conductor, without the ability to secure, control, and connect the link between a vehicle’s head unit, devices, and systems and to manage the ...
24Notion is full-service global creative digital marketing, technology and lifestyle agency that combines strategic ideas with customized tactical execution. With a broad understand of the art of traditional marketing, new media, communications and social influence, 24Notion uniquely understands how to connect your brand strategy with the right consumer. 24Notion ranked #12 on Corporate Social Responsibility - Book of List.
The Jevons Paradox suggests that when technological advances increase efficiency of a resource, it results in an overall increase in consumption. Writing on the increased use of coal as a result of technological improvements, 19th-century economist William Stanley Jevons found that these improvements led to the development of new ways to utilize coal. In his session at 19th Cloud Expo, Mark Thiele, Chief Strategy Officer for Apcera, will compare the Jevons Paradox to modern-day enterprise IT, e...
Major trends and emerging technologies – from virtual reality and IoT, to Big Data and algorithms – are helping organizations innovate in the digital era. However, to create real business value, IT must think beyond the ‘what’ of digital transformation to the ‘how’ to harness emerging trends, innovation and disruption. Architecture is the key that underpins and ties all these efforts together. In the digital age, it’s important to invest in architecture, extend the enterprise footprint to the cl...
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management solutions, helping companies worldwide activate their data to drive more value and business insight and to transform moder...
SYS-CON Events has announced today that Roger Strukhoff has been named conference chair of Cloud Expo and @ThingsExpo 2016 Silicon Valley. The 19th Cloud Expo and 6th @ThingsExpo will take place on November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. "The Internet of Things brings trillions of dollars of opportunity to developers and enterprise IT, no matter how you measure it," stated Roger Strukhoff. "More importantly, it leverages the power of devices and the Interne...
What does it look like when you have access to cloud infrastructure and platform under the same roof? Let’s talk about the different layers of Technology as a Service: who cares, what runs where, and how does it all fit together. In his session at 18th Cloud Expo, Phil Jackson, Lead Technology Evangelist at SoftLayer, an IBM company, spoke about the picture being painted by IBM Cloud and how the tools being crafted can help fill the gaps in your IT infrastructure.
Digital innovation is the next big wave of business transformation based on digital technologies of which IoT and Big Data are key components, For example: Business boundary innovation is a challenge to excavate third-party business value using IoT and BigData, like Nest Business structure innovation may propose re-building business structure from scratch, as Uber does in the taxicab industry The social model innovation is also a big challenge to the new social architecture with the design fr...
Data is an unusual currency; it is not restricted by the same transactional limitations as money or people. In fact, the more that you leverage your data across multiple business use cases, the more valuable it becomes to the organization. And the same can be said about the organization’s analytics. In his session at 19th Cloud Expo, Bill Schmarzo, CTO for the Big Data Practice at EMC, will introduce a methodology for capturing, enriching and sharing data (and analytics) across the organizati...
DevOps at Cloud Expo, taking place Nov 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 19th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long dev...
IoT offers a value of almost $4 trillion to the manufacturing industry through platforms that can improve margins, optimize operations & drive high performance work teams. By using IoT technologies as a foundation, manufacturing customers are integrating worker safety with manufacturing systems, driving deep collaboration and utilizing analytics to exponentially increased per-unit margins. However, as Benoit Lheureux, the VP for Research at Gartner points out, “IoT project implementers often ...
SYS-CON Events announced today that Bsquare has been named “Silver Sponsor” of SYS-CON's @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. For more than two decades, Bsquare has helped its customers extract business value from a broad array of physical assets by making them intelligent, connecting them, and using the data they generate to optimize business processes.
Businesses are struggling to manage the information flow and interactions between all of these new devices and things jumping on their network, and the apps and IT systems they control. The data businesses gather is only helpful if they can do something with it. In his session at @ThingsExpo, Chris Witeck, Principal Technology Strategist at Citrix, will discuss how different the impact of IoT will be for large businesses, expanding how IoT will allow large organizations to make their legacy ap...
Video experiences should be unique and exciting! But that doesn’t mean you need to patch all the pieces yourself. Users demand rich and engaging experiences and new ways to connect with you. But creating robust video applications at scale can be complicated, time-consuming and expensive. In his session at @ThingsExpo, Zohar Babin, Vice President of Platform, Ecosystem and Community at Kaltura, will discuss how VPaaS enables you to move fast, creating scalable video experiences that reach your ...