If you can’t change user behavior, stop the payload…

For some time now, we’ve been hearing about how users often fail to install security updates for known vulnerabilities months, or even years, after a fix is available. As an IT security professional, this blows my mind because such practices create security holes that leave computers, and now corporate networks, susceptible to targeted cyber attacks. However, I am a realist: most users do not really think or care about security until something happens to them directly.
In the article, “Malware Authors Relying on Poor User Updating Practices,” cyber criminals understand this, and are taking advantage of users’ negligence around installing the latest security updates on their PCs. According to Ralf Benzmüller, head of G Data SecurityLabs, cyber crooks are not just targeting current security gaps, they also have their eye on unclosed vulnerabilities that for one reason or another have been disregarded by users.

“Even though an enormous number of program updates are being provided, users should not be fooled into deactivating automatic update functions. Not only does this apply to Java, but it should also apply in general to all browser plug-ins used and all applications installed on the PC.”

Ironically, experts at G Data SecurityLabs also said there has been an increase in the installation of unwanted software such as fake antivirus programs, known as scareware, that trick users into downloading what they believe is extra protection against malware but is really malicious code designed to steal personal data.
The dangerous combination of poor security updating practices and users getting fooled into downloading malware programs on their computers is giving hackers an edge in the cyber crime fight. While security vendors are working on creating more secure applications, I sadly believe that there will always be vulnerable applications in our networks. Because of this, businesses should focus on stopping the payload that is deposited. Once the payload is executed, that’s when the damage is done.
This is another reason to consider application whitelisting solutions. With application whitelisting, it doesn’t matter how the malicious code gets deposited — whether through opening a bad attachment, a drive-by from hitting a bogus website, or a vulnerability — because all unauthorized applications are prevented from running. If you can’t change user behavior, stop the payload.

by JT Keating