The Web and the growing popularity of Web 2.0 applications will continue to pose a huge threat to both consumers and enterprises, according to security firm Sophos plc.
"We're finding over 15,000 new Web pages being infected every day and 90% of Web threats reside on legitimate hacked sites while, about 1% of all Web searches deliver an infected Web page. So what you've got are these legitimate Web sites, how then do people protect themselves against this?" said Jim Dowling, director of sales for Asia at Sophos.
According to the official, the security threat landscape is changing, making it all the more difficult for IT managers to secure the network and end users. "We used to protect the endpoint at the gateway but what's changed is now you've got Internet access, cloud computing, mobile workers and remote access, USB key and third-party devices being plugged in, a lot more outsourcing so you have contract workers, etc. So, all of a sudden, the whole security game has changed and IT managers now need to look at a lot of different factors in securing their endpoints," Dowling said.
Social networking sites, for one, are proving to be a growing challenge for most IT managers or information security officers because, while some companies use these for their business, some employees use these for purely social reasons, which becomes both a productivity and a security issue.
For his part, Sophos regional sales engineer, Julius Suarez, believes the Web has become a primary vehicle for cyber criminals because they no longer need to "advertise or invite" users, they just hack into legitimate Web sites and they could get thousands or millions of potential victims.
According to Dowling, Web security historically was all about URL filtering and people thought that they were protected with this but since it does not block legitimate sites, people who access hacked legitimate Web sites are still at risk. "There are two sides of it-- the protection for the end user, which entails a good endpoint and a Web security solution; and another part of it are the actual companies that are being attacked, they need to look at how they are designing their Web sites and their databases so they are not vulnerable to hacking and SQL injection attacks," he said.
Spam emails, on the other hand, continue to be a problem, which is becoming both a productivity and a security issue. In general, however, Sophos believes people have learned their lessons about clicking on attachments but Dowling said there are still "enough people to get tricked into doing it, to make these criminals continue to send out these spam."
"Yes, education is helping but there's still a long way to go and if you look at the way these threats go, as people wake up to something, then these criminals find another way to attack you," Dowling noted.
In a report that it released covering Q3 of this year, Sophos found Asia to be the top continent responsible for relaying spam across the globe between July and September 2008. This indicates that the level of security in the continent is not strong enough and the level of taking and keeping computer and security patches updated is not at a level that it should be among consumers. However, for the corporate side, it could indicate that people security policies are not being enforced, said Dowling. "These companies may have good security policies and might have spent money on security products but if their policies are not being enforced then they're wasting their money."
"We see this happening in the Philippines as well; that's why we really want to educate and evangelize even to these users and companies because there's really a big difference between just installing an anti-virus solution and having endpoint and Web protection because if you have just an AV, it might be installed but it might not be enabled or it might be out of date," said Ogie Dy Tabor, regional sales engineer at Sophos.
"The Web will continue to be a security threat, as it is now. In the past, people saw Web security as a luxury and not a necessity; until people start protecting themselves against the Web it will continue to be one of the, if not the, major source of various security threats," said Dowling.
This story, "New Threats Thrive on a Changing Web" was originally published by Computerworld Philippines.