E-Business
Issue No. 27 - February/March
[SECURITY ] …the never-ending story
by David Twiss
By now, any businesses who take IT seriously are using a range of measures to protect themselves from trouble. For us, that means measures like antivirus software with hourly checks for virus signature updates, anti-trojan and anti-spyware software with automatic nightly scans of every PC, a robust firewall with only enough access to allow our business functions and no more, automatically downloading and applying security update to Windows and Office within 24 hours of the release of an update, together with considered security policy and procedures regularly communicated with all staff.
We have thought through the risks and have adopted an integrated multi-faceted approach to mitigating those risks.
However no level of protection is absolute; even bank vaults get broken into.
A special problem for systems connected to the internet is that new attack methods are being developed every day, so being well protected against today’s threats can be cold comfort to a new threat tomorrow.
Disturbing even for security conscious companies is the rise of so called ‘zero-day exploits’. These are exploits that take advantage of a new security vulnerability on the same day that it becomes generally known.
As vendors learn about new vulnerabilities in their products they develop and distribute updates to repair the ‘holes’. Many vendors are somewhat proactive in seeking out vulnerabilities, engaging in-house and out-sourced white-hat — that is friendly — attacks on their products to find existing vulnerabilities and thus help make the products more secure.
In the past it was common for new patches to protect against new exploits to be distributed before many machines had been attached. In such an environment tracking security updates provides reasonable protection.
However the trend in recent years has been towards an increasing density of so-called ‘zero-day exploits’, so while the total number...
