spyware labs inc
Spyware â € "Understanding and addressing risks – Part Two
Mitigate risks
The main technologies available to mitigate risks associated with œSpywareâ € € in the business environment are discussed below.
Mitigation Techniques of two levels or in two parts â € "the gateway and desktop level.
Positions Protection
On the desktop or client should include three technologies available to mitigate the risks posed by a € € œSpywareâ. Are personal firewalls, dedicated anti-spyware and anti-traditional desktop virus (AV) tools.
AV
In some ways œSpywareâ ways a virus very similar € €. Are clearly identifiable, can be detected by scanning client computer and are sometimes packaged as a set of files that can be removed to clean the infected system. However, many forms of â € € œSpywareâ not reside on disk as persistent files â € "like the hostile ActiveX and Java applets. motivations, implementation mechanisms and often the elimination a € € œSpywareâ is different, the protocols followed for viruses and worms.
Â
â € € œSpywareâ is also different, since there is no clear definition of what a € € œSpywareâ. Some programs that might be considered œSpywareâ € â € â € "™ € s as the Microsoft Windows Update Notifications â €" is useful to reveal its supervisory capacity, does not disrupt the functioning of the office of impact user productivity, and are distributed by the companies responsible. â € € œSpywareâ by therefore must be classified and identified by the acts performed and the level of risk â € "complicate the detection and elimination, as users must have the election in what is permitted.
Antivirus â € "including Trend Micro, McAfee and Symantec â €" already had a software that is very good for scanning files before execution. The software suite also mature business management and suppliers have support teams in place business customers to manage € ™ needs. However, antivirus companies have been slow to add anti-spyware features to their products. Vendors antivirus programs will, however UPA – Trend Micro acquired the launching of private InterMute in May this year, the first acquisition ever done. In 2004, CA purchased PestPatrol PestPatrol and added to the eTrust range.
Independent reviews and tests have repeatedly shown that AV tools are not as good to catch a € € œSpywareâ and specialized in spyware programs. Although the AV tools detect 99% of May The viruses that number is significantly to perhaps 70% – during the examination € â € œSpywareâ programs.
Using the next AV News desktop tools to protect desktops against a € € œSpywareâ is very attractive for companies. You do not need to implement another agent software on each machine in the office work is not required to follow another â € ~ Consolea € ™. OPERATIONAL AV features and management functions needed by businesses, â € "as â € ~ headless € ™ and centralized reporting. The companies to achieve greater consistency with the rules on fewer suppliers, resulting in savings.
Dedicated Anti-Spyware Programs
There is a growing list of dedicated anti-spyware software offered by vendors, Webroot included (which only raised $ 108million in venture capital financing), Lavasoft and PC Tools. Lavasoft Ad-Aware is the most popular with about 128 million downloads to date. Other notable products include Spybot Search and Destroy, CounterSpy and Spyware Eliminator. Microsoft has also entered the market with Windows Antispyware â € "available for beta download on their website â € "after being acquired Giant Company Software.
Anti-spyware, while you do now more effective to detect and remove spyware that AV products will change in coming quarters. The most dedicated anti-spyware offerings are available for free download for consumers / individual users, not large corporations. Site License is rarely available, for example. Some of the emerging suppliers, including software and BAF Tenebril, companies have deals on their work plans. However, the stability, these are small, lack of business / financial matters in some cases, and generally are not compatible with the equipment and infrastructure in place to deal with large corporate customers.
Orthus believe many anti-independent-spyware cease to exist in the relatively near future and the market for dedicated anti-spyware will not be significant in coming years as established vendors offer integrated AV / anti-/ spyware products personal firewall.
Personal Firewalls
Like AV tools now include some â € € protection available œSpywareâ Many personal firewalls provide a level of protection as well. These include McAfee, Check Point (after the acquisition of Zone Labs in early 2004 and the subsequent release of product integrity) and Internet Security Systems (ISS) with the release of Proventia Desktop March 2005. Sygate follows a trajectory similar to Check Point and ISS.
Personal firewalls are especially recommended for mobile customers are usually taken outside the perimeter Corporate and used to access systems business DSL connections at home and public WLAN access points, which normally direct Internet access is also allowed. Level of protection are also recommended for desktop and mobile customers in small offices where there is little or nothing of the bridge in place and again direct Internet access is available in these places.
Gateway Protection
Desktop Protection is only half the story when it is the protection of € € œSpywareâ. The protection at the gateway is also available.
Blue Coat Systems offers a wide range proxy appliance, along with popular address filtering solutions, to offer a strong defense against a € € œSpywareâ. â € € œSpywareâ often secretly installs via "drive-by" installers, which install a œSpywareâ € € in the background without any interaction the user. Blue Coat this political battle with the anti-spyware checks that inspect, filter and block Web content associated with a software installation œSpywareâ € €. This preventive approach is critical when œSpywareâ € â € â € Web site unknown "yet to be classified as solutions Web filtering – and when there are no known signatures for malware.
Protecting Web gateway integrates a high filtering solution is particularly good in prevention programs on infected systems to send information to a site œSpywareâ € €, mitigate the impact on the productivity of programs advertising, but also the most serious privacy concerns and data leakage associated with more malicious code. URL filtering solutions also offer some protection against infection in the first place, to prevent users from visiting sites known to be infected.
Gateway Solutions integrating forestry in general and reporting functions that can be used to identify infected systems and provide an objective € â € œSpywareâ cleaning periodically. This feature is also useful to focus on portable mobile clients (PCs) which are not protected by personal firewalls that are infected while the outer perimeter of the enterprise.
Recommendations
In the light of previous Orthus show that companies can take the following approach to mitigate the risks posed by today œSpywareâ € €:
- Expand Gateway € € œSpywareâ copy protection to prevent communication systems channel augemented infected with a leading URL filtering solutions.
- Granular reporting capabilities using solutions gateway to identify infected systems and the choice of a dedicated anti-spyware to clean infected systems on a case by case basis / ad hoc.
- not to deploy anti-spyware dedicated through the Office of Population â € "instead of waiting for AV vendors to add powerful anti-spyware software in future versions.
- power systems for office-based branch office remote access to the Internet through the gateway of the company (or gateway anti-spyware protection exists).
- customers to remote and mobile devices in addition to AV, install a personal firewall that is known to increase protection.
educating staff to make them aware of the risks of œSpywareâ € â €, how systems are usually infected and how to close pop
About the Author
Sean Bennett is Commercial Director at Orthus limited (http://www.orthus.com). Orthus is a leading provider of information risk professional services, helping orgnisations globally to measure, minimise and manage the information risks they face. Orthus provide end to end services for clients to comprehensivly address risk in their environments including Insider Threats, addressing issues including data leakage, sabotage and fraud; External Threats (http://www.orthus.com/dr_overview.htm) including wireless security, penetration testing, virtualisation security, vulnerability management and Secure Software Development Life-Cycle; Supply Chain Threats including securing cloud services and data processed by third parties; and Legal and Regulatory challenges including Payment Card Industry (PCI) Data Security Standard (DSS).
Recent Comments