Safety net

Despite its numerous benefits, the interactive, feature rich Web 2.0 has brought with it a number of vulnerabilities. Criminals are invading the Web in droves to exploit these and distribute malware on a scale not seen before.

Something as simple as browsing the net has become a risky business as the browser, along with browser plug-ins, have become primary targets for Web criminals looking to disseminate malware. Many companies are still blind to this reality and keep on investing heavily in end-point security, making sure employees do not intentionally or inadvertently bring viruses into the company network through USB storage devices or discs.

However, as has been evidenced in the last few years, users are increasingly being lured into visiting malicious Web sites where their PCs are compromised with malware.

Apart from malicious Web sites set up by criminals, malware is increasingly being hosted on legitimate Web sites, putting users at risk when they visit such sites. Because the malware is hosted on a site that is classified as being safe, URL filtering and site reputation services are rendered useless.

Another trend that stems from this is a phenomenon called Web mail spam. Spammers use Web mail providers such as Yahoo, Hotmail and Gmail to automatically create accounts using Captcha-breaking methods. Deploying spam filters such as IP reputation and message header inspection is hardly adequate because the source and the header are legitimate.

Remaining safe is no longer just a question of avoiding suspicious or lesser-known sites, making browsing the net in our age a riskier affair than it has ever been. The botnet-driven mass Web site attacks we have seen in the last few months will continue to attack legitimate Web sites. Browser vulnerabilities continue to be targeted and, increasingly, third-party plug-ins will be targeted as there is even less chance these will be up to date.

As these attacks become stealthier, organisations need to be more proactive in their approach to security and review their current e-mail and Web security strategies and products to ensure they have protection in place that meets today`s rapidly evolving threat landscape.

Practical steps to follow include:

* Ensure spam filtering systems employ defence - in-depth by using multiple technologies for maximum accuracy and resiliency.
* Take steps to secure Web browsing at the gateway, including URL filtering and the restriction of executable and other content that can be downloaded by users, ideally deploying a Secure Web Gateway solution that is able to actively scan and filter the content users are actually accessing and posting.
* Keep Web browsers, plug-ins and other desktop software meticulously up-to-date as many malicious Web sites target old versions and known vulnerabilities.
* Educate users about the new dangers of e-mail and browsing, and advise them to avoid following links in unsolicited e-mail and be suspicious of unexpected download prompts when browsing.

The Internet is a valuable resource for both individuals and business. It is, therefore, important that the message be communicated that the Internet is not a minefield, and with simple common sense, people should be able to safely surf the net without worries.