A clear and present danger

When it was widely reported in June that the Sydney Opera House’s website contained malicious code designed to harvest ticket buyer’s bank account details it made a big splash in the media. It is also the perfect illustration of the security situation facing IT managers and resellers in 2007. Think back, when was the last time that a major virus or worm outbreak hit the headlines? It has literally been years since Melissa, Slammer, Blaster, I Love You and Nimda sent corporate networks into meltdown and brought organisations all over the globe to their knees.

There has been a quantum shift in the security risks and concerns facing today’s networks. Hackers are no longer disaffected university students in the game for kudos from their peers or trying to make a statement to the world at large; organised crime has realised that there is a lot of money to be made from hacking, phishing and identity theft. As a result of this shift in emphasis AusCERT said the number of cyber attacks has actually reduced slightly over recent years but the average amount of money each successful attack costs organisations has increased. And malware such as phishing sites, Trojans and other forms of website-based malicious code have become the dominant means of attack.

Adding to the challenge, the changing ways we are working means that securing the network is harder than ever for resellers, systems integrators and security professionals. Contractors and consultants, telecommuters, travelling executives and other road warriors have all pushed the perimeter of the network out to the point where for a multinational company it’s the whole world. And that’s not to mention the increasingly common practice of exposing parts of the network – such as the extranet or inventory system – to business partners.

These trends have all been happening for a while but over recent months a new threat has been added to the list – social networking sites. Studies have shown that many workers access sites such as Facebook, MySpace and to a lesser extent YouTube from office computers. These sites are often havens for malicious code and a lot of people, seemingly oblivious to the dangers of identity theft, post large amounts of personal information on them.

When it comes to network security, IBRS analyst James Turner, believes that there will be continued emphasis on enabling, but it’s going to be different for every company according to their business environment. “There’s a constant tussle with security, and that’s the balance between confidentiality, integrity and availability. That play is different for every single firm looking at it.”

One way that the balance between confidentiality, integrity and availability is playing itself out is the tension between perimeter and internal network security. Trend Micro’s premium services manager, Australia and New Zealand, Adam Biviano, said the idea of a perimeter is blurring which necessitates a rethink in emphasis. “What do you define as your work perimeter? Half of Trend’s workforce is mobile, these individuals roam the country using their laptops in all sorts of places, airport terminals, home networks, Starbucks etc. which are far from trusted entities, so while protecting the perimeter is a sound idea, it’s becoming far more complex.”

a and clear collaboration danger networking present