How to avoid the top 5 Internet security holes

By Markus Hennig, Chief Technology Officer, Astaro | Mar 15, 2011

1 comments

Digg

 Email

 Print

The meteoric rise of the Internet in Asia spells higher risks of online security threats. Employees may not fully understand the vulnerabilities online and unknowingly trigger unwanted security breaches, leaving enterprises with a high cost of repairing and replacing systems. To educate enterprises on the threats they are likely to face and should avoid, we have compiled a list detailing the five most serious internet security holes:

1. Browser vulnerabilities

No provider is immune to the security holes that keep appearing in web browsers. A recent example is the CSS bug that affected Internet Explorer versions 6, 7, and 8 (CVE-2010-3962). This bug targets the computers in a two-stage attack: First, the user follows an e-mail link to a web page containing malicious code. This code is then run without the user realizing it and automatically installs a trojan on the computer. The user does not need to click the mouse; simply visiting the website is enough.

The only way companies can protect themselves fully from this is to refrain from using any browsers with current known security holes for as long as they remain unpatched.

2. Vulnerabilities in Adobe PDF Reader, Flash, Java

The ubiquity of tools and programs such as Adobe PDF Reader, Flash, and Java makes them highly vulnerable to attack. Although they do frequently show security holes, most providers are quick to provide patches.

However, companies then have to make sure these patches are installed on all computers - which are where they often fall down. Either the IT departments are not aware of the patches, are unable to install them, or bemoan the fact that the update failed. In this case, if an employee visits a page with embedded Flash videos that launch automatically, malicious code can then be run automatically in the background.

With the user being completely unaware of it, a trojan will infiltrate the computer unnoticed, making it part of a botnet. While there are only a few Windows exploits, for instance, there is a vast number in Adobe, Java, and Flash. Flash and Java, in particular, have become veritable malware disseminators over the past few months, providing the perfect access point for trojans lurking in the background of colorful websites, which then bypass all virus scanners to become permanently ensconced on the computer.

Private users should therefore never use these programs and companies should employ standard procedures or policies prohibiting their use. To prevent attacks via Flash, companies can use Flash blockers (a browser plug-in) to prevent videos from being played automatically.

1 comments

Digg

 Email

 Print