 |
 |
|
 |
 |
 |
|
|
|
 |
Feature ArticlesNew communication technologies need your attention ...01/10/2006  With over 250 million Instant Messaging users worldwide, IM continues to grow at Internet speed and is reportedly the fastest growing communications medium of all time. Two of our leading security vendors, Check Point and Websense have highlighted how security solutions are evolving to stay at the forefront of the changing landscape within communication technologies. In the past, when Instant Messaging (IM) usage was in its earlier stages, many organisations were comfortable with simply blocking IM entirely. By not allowing it, IT was able to protect the network and PCs from malware that arrived via file transfer downloads or through ports opened by IM traffic. However, today IM communication demands between co-workers, partners and customers require instant communication, quick collaboration and improved productivity. Therefore, blocking IM is no longer a viable option. Now being widely used in the enterprise to provide communication flexibility and greater work productivity, it has naturally become the target of security attacks, therefore companies using it now face significant security challenges. In addition to the risk of company secrets being divulged, both IM and Peer-2-Peer (P2P) applications also offer additional entry points to your network for intrusions, data theft, denial-of-service attacks, viruses and worms. P2P systems often provide a home for spyware through music-sharing networks such as Kazaa. Both IM and P2P applications are adept at bypassing firewalls using port-scanning and tunneling techniques. None of the popular IM clients offer strong authentication or encryption, so they are vulnerable to account hijacking and eaves dropping for valuable or damaging company information divulged by unwitting employees. Since IM can access ports that remain ‘open’ such as port 80, port 21 and others, Trojan horses can use port-agile IM applications to grant hackers a foothold onto and out of the network without opening any additional ports. In addition, attempts to block IM in the firewall based on the destinations’ IP addresses can be thwarted by IM services changing destination IP addresses and proxy servers on the Internet. With the growing use of IM, spam for IM (or SPIM) is also on the rise. SPIM is the impetus for a number of vulnerabilities including phishing schemes. And since IM applications lack encryption, it leaves sessions vulnerable to hijacking. Attacks taking advantage of IM are not merely hypothetical—they disrupt daily business operations right now. For example, attacks can exploit IM as a vector for worm propagation. Zotob has spread widely, using IM sessions as a method for propagation and wreaking havoc on endpoint PCs. Since March 2005, there have been more than 200 variants of Kelvir, an IM-specific worm that steals buddy-list contacts and spreads when users click malicious links. Another similar worm, Bropia, has been infecting machines when users click on file attachments in messages. SKYPE The growing popularity of Skype Technologies telephony software could soon pose the same kind of security challenges for companies that other P2P software technologies have created in recent years. The Skype program, which uses P2P technology to route phone calls over the Internet, is one of the most popular desktop applications sitting behind firewalls, making the threat vector even more serious. To maintain the productivity associated with IM, organisations cannot just block IM use, instead effective solutions for securing IM usage need to be implemented; solutions that encrypt messages, block dangerous transmissions and ensure IM policy enforcement. Ensuring that malicious URL links, attachments and SPIM do not compromise company resources. Information based crime offers bigger rewards and less risk than crime in the physical world. Their target is information - confidential corporate or personal data - that can be sold for profit or used for fraud or extortion. This trend toward ‘hacking for profit’ has been signalled by respected sources such as the SANS™ Institute (United States), the Serious Organised Crime Agency (United Kingdom) and Websense Security Labs™ (global).The means of these 'crimeware' attacks are myriad: spyware, phishing and pharming scams, bot networks, keylogging and often a blend of multiple attack types. P2P networks, IM and Voice-over-Internet Protocol (VoIP) are also under threat but have yet to gain the IT department's focus on security. The files distributed by these P2P systems can be dangerous sources of infection, with programs such as eDonkey, Kazaa and BitTorrent among the targets, while popular VoIP offerings such as Skype have yet to prove their security is sufficiently hardened for corporate use.The key lesson at the moment is that it is not just operating systems that will require patching in future but applications too, because it is the applications that are now increasingly under attack. The research group Gartner has described IM as 'the sleeping giant of the internet' and predicted that the majority of employees will eventually use it for business or personal communication. Instead of being simply a tool for instant message delivery, IM is now even evolving into a platform that can be a front-end for enterprise applications. At the same time, the level of spam, spyware and phishing in circulation has undermined confidence and trust in the use of traditional e-mail. The irony is that while corporate IT departments have spent huge budgets and many man-hours securing their e-mail systems, most have barely begun to address the risk of virus, worm or malicious code attack through their employees' use of IM. Of particular concern is the use of IM attachments - as they are not screened by network security systems - they can pose a high risk whilst the IM message carrying them can be harmless. Overview of Peer-to-Peer (P2P) file sharing Because of its large user base, P2P networks can offer any ordinary user literally billions of files that are available for download with a simple click of a mouse. Anyone connected to one of these networks can share and download virtually any files in existence, from the latest hot music track and Hollywood blockbuster, to obscure textbooks and rare foreign texts. Best of all most P2P networks, as well as much of their contents, are accessible at no cost. Though P2P file sharing did not hit the limelight until quite recently, it is an old computer concept. Instead of having one dedicated central computer (the server) handling the request and offering its services to all the computers connected to it (the clients); a P2P network allows all the resources to be distributed to every member in the network. Therefore each computer acts both as a client and a server. In a P2P file-sharing network, the files are all contributed by the users of the network in the form of smaller file libraries residing in each user's local computer. The decentralised nature of P2P networks, that makes them resilient and reliable, is also its main drawback from a security point of view. Some issues facing P2P users include: Worms, Trojans, Backdoors and Viruses The biggest viral threat comes from the sharing, unintended or not, of infected files. Some users do not know that they have been infected and they put up their file collection for the world to download. Others intentionally distribute malware, ranging from the casual script kiddie who wants to feel empowered, to a hacker who shares a Trojan to allow him full control over another computer. Fake files Because anyone can share anything, it is very hard sometimes to tell whether the files being downloaded are indeed the authentic files. Media giants offer apparently popular music or films to sniff out copyright violators in an effort to try to protect their products from being distributed illegally online. Anyone who has recently downloaded popular music tracks from Kazaa and the like can tell you just how many bogus files are out there. Spyware/Adware Many P2P clients claim to be free of charge. To subsidise the development cost, some developers partnered up with advertising companies to include spyware and adware in the P2P program. Buggy or improperly configured software Not all P2P clients are made the same. Some are developed by ragtag teams following ad hoc plans, resulting in barely functional, extremely buggy clients that are prone to security breaches. Copyright issues With all the media hype surrounding reports of P2P users being sued by big record companies, one cannot ignore the issue of copyright violations. P2P networks can never be secure unless drastic measures are taken uniformly at the end user level, something that is very unlikely to happen. Due to their decentralised nature, file sharing on a large scale across P2P networks will likely remain a dicey undertaking. However, there are measures that can be adopted to minimise the risks. Research before installing It is always wise to look up a program you are about to install for any security issues; P2P clients are no different. By running a simple search on a reputable search engine like Google with the words spyware, adware or security issues appended to the name of your program can often reveal whether what you are about to install is safe or not. Websites such as Zeropaid.com has extensive reviews of P2P clients and an extremely vibrant and knowledgeable user forum and these sites are likely to expose any issues that might make one think twice before installing. “One survey recently found that while 62% of organisations have secured themselves against potential e-mail threats, protection against IM and P2P systems simply takes a lower priority. In a poll of more than 100 enterprises, only 11% reported having IM solutions in place, compared to 73% with e-mail. 50% of correspondents said they hadn’t even considered an IM solution”. This explosion of IM and P2P file sharing applications at work is a new security challenge, with employees able to easily download such applications free, without detection on the IT department's radar screen. So, it is important for IT managers to understand the business risks associated with the growth of IM and P2P usage. The potential in cutting communications costs by adopting P2P networks using VoIP services, such as Skype, has to be balanced against the security threats posed by an unfamiliar, potentially insecure technology. By November 2005, there had been over 215 million downloads of the free Skype VoIP client. A campaign against the threats offered by Skype has been gaining momentum however, with some analysts calling for companies to adopt an outright ban against its use, labelling it ‘undetectable, untraceable and unauditable’ and even threatening companies' ability to satisfy compliance regulations. The general advice for organisations planning to use Skype is to ensure it is managed with policies and diligence.
Message encryption - uses 3DES encryption to ensure the privacy of message content.Harmful content filtering - inspects user text in messages and strips out either executable links or all URL links, based on IT’s configuration. It also inspects the messaging protocol for file attachments and can strip out all attachments or the ones based on IT-specified extensions.Unsolicited communication blocking - compares contact names, captured from buddy lists at log in, with those of incoming messages. To prevent SPIM, a message will be blocked if there is no matching contact name.Service and feature usage controls - easily enables or disables IM controls via checkboxes. Features such as blocking audio, video and file transfers are included. IT can also configure which IM services are allowed and the level of access.
Symantec IM Manager seamlessly manages, secures, logs and archives corporate IM traffic with certified support for public and enterprise IM networks, including granular policy enforcement and security controls for files, audio, video, VoIP, application sharing and other real-time communication capabilities. Symantec IM Manager secures corporate networks against external threats such as IM viruses, worms and malware through usage of real-time content filtering, worm and virus signature detection, behaviour based threat protection and file based anti-virus scanning. It also provides organisations with the tools to enforce content and regulatory compliance policies for all aspects of IM use, including the ability to selectively log messages based on user attributes, selectively insert message disclaimers and integrate directly with enterprise retention and discovery solutions.
CA Message Manager IM Link (IM Link), an add-on module for CA Message Manager Archive, is designed to intelligently process IM message logs delivered by CA's IM partner interfaces. IM Link is transparent to the user, requiring no desktop software and no alternation to the user's IM identity. IM Link integrates seamlessly with CA Message Manager modules and addresses regulatory compliance with regards to the archival of IM, as well as providing a knowledge repository of these real-time communications for use in electronic discovery.
Captures transcripts of all IM conversations Uses Natural Language Processing to contextually scan all IM conversations Provides statistical usage reports Archives data to virtually any storage device.  Websense Web Security Suite protects against IM security risks, spyware, malicious mobile code and phishing and pharming attacks, alongside blocking spyware and keylogger backchannel communications from reaching their host servers. In addition, only Websense Web Security Suite offers the Websense Web Protection Services that help protect organisations’ websites, brands and web servers.
Proactively discovers web security threats Protects against web security threats before they reach the desktop Stops resident spyware and keyloggers from doing damage Blocks malicious HTTP traffic on all ports Swiftly alerts when websites or brands are under attack and reports web server vulnerabilities.
Live Communications Server 2005 delivers IM and presence as part of a scalable, enterprise grade solution offering enhanced security, seamless integration with other Microsoft products and an extensible, industry standard development platform. Organisations can realise cost savings and improved business efficiencies, increased individual productivity and enhanced intellectual property protection with this easy-to-manage, highly available solution. Collaborate with business partners and other organisations as easily as co-workers while protecting sensitive business information. By providing encrypted and optionally logged transactions between public IM data centers and Live Communications Server internal users, organisations can more securely and effectively connect information workers to the most popular public IM services (MSN, AOL, and Yahoo!).
Trend Micro™ IM Security for Microsoft™ Office Live Communications Server (LCS) delivers advanced protection from malicious code and inappropriate content. IM Security for LCS can be centrally managed and administered and runs with minimal performance impact to LCS. Incident-based archives support quick and easy searches for content violations. Complete with instant notification through LCS and comprehensive real-time reporting, IM Security helps administrators deploy and maintain a virus-free IM environment with secure content. Trend Micro IM Security blocks viruses and inappropriate content by securing IM traffic travelling through LCS. Administrators also can monitor usage and control messages between groups of internal users, as well as block traffic between users—all with minimal impact on LCS system performance.
The MessageLabs Enterprise Instant Messenger (EIM) Service is designed to optimise corporate IM use. The service eliminates risks and concerns arising from traditional IM and file sharing offerings by providing secure communications, sophisticated administrative features, the ability to map existing enterprise hierarchical structures, IM logging capabilities and interoperability with other consumer messaging networks. The EIM service has an enterprise class secure EIM client (a Professional Online Desktop - POD) that is installed simply by downloading it to a user’s desktop or ‘pushed’ to the user base using Microsoft Installer (MSI) technology. Administration and configuration of the service is easily managed via a web-based administration and reporting tool. Once enabled, users have the ability to securely chat and exchange files with other users, safely federate with users of leading consumer networks outside of the MessageLabs enterprise IM network such as AOL, MSN and Yahoo!. Administrators also have the ability to monitor use of IM through an extensive reports tool available in an easy to use web-based portal.
|
T: 01628 403 403
|
