How social engineering threats jump from end-users to corporate networks… and what can stop them

Just when browsers have become more secure from cybercrime, hackers are turning their attentions to the people using them. According to the article, “Microsoft: One in 14 downloads is malicious,” social engineering attacks have blossomed into one of the most preferred criminal tactics to get users to download harmful Trojans. With the rate of about 1 in every 14 programs downloaded by Windows users being some type of malware, Alex Stamos, a founding partner with security consulting firm, Isec Partners, said if attackers can’t get passed tougher browser defenses, they’re adopting new tricks that prey on peoples’ poor decision making.

Today, there are a number of different social engineering techniques that cyber criminals are using to deliver malware to end users, including:

Email from a friend: Users get a message from a friend telling them to view a video. When the link asks to download some required software, they are actually downloading a malicious program.

Spam: Hackers are using unsolicited email spam to send Trojan horses to individuals, hoping to dupe people into downloading fake advertisements that deliver malicious code onto their machines.

Spearphishing: Criminals create a maliciously encoded document that the victim is likely to open such as a follow up from a recent conference or a planning document from a partner organization.

Fake AV warnings: Criminals are hacking into Web pages and popping up fake antivirus warnings designed to look like messages from the operating system. Downloading these will infect a machine.

Malicious websites: Hackers trick search engines into linking to malicious websites that look like they have interesting stories or video about the hottest news topics.

While these threats can be perceived as consumer-related issues, businesses only need to look at this information in regards to “their employees” to understand how social engineering attacks can jump from end-users to corporate networks. The fact is, if an employee is tricked into downloading malware, the infected machine that is connected to a network can put corporate data and systems at risk.

The truth is, we will never be able to control our employees’ online behavior. Nor, is it realistic to train or re-train every employee perfectly. Because of this, the key to preventing malware attacks is to stop the payload from getting on the network. Application whitelisting does this by preventing the execution of any unauthorized application from running on a machine, no matter how the malware is delivered.

By: JT Keating

Cloud security: Protecting critical data is job #1…

Cloud computing has certainly taken its share of hits lately. Last month’s Amazon outage created a lot of chatter and analysis around the reliability and availability of cloud-based services. Despite what pretty much amounts to growing pains for cloud computing, most everyone agrees that businesses will continue pursuing cloud services for the many cost and competitive advantages that the cloud promises.

The one thing that these types of events bring to light is the importance of security with cloud providers. According to the recent article, “Symantec executives caution customers on cloud provider security,” as more and more businesses turn to cloud services, they need to hold their providers to the same security standards that they adhere to because they can still be liable if their data is breached.

Whether an organization’s business assets are on-premise or reside in the cloud, securing critical data needs to be the No. 1 priority. The top challenge is finding an anti-malware solution that protects data without compromising the productivity of their systems. Unfortunately, using traditional antivirus products alone is not the answer. For many companies that continue to rely on antivirus solutions to protect their networks, the challenge remains because of two significant factors.

First, antivirus can’t keep up with the tens of thousands of new malicious software that surfaces every day. With about 55,000 new viruses popping up daily, catching all the “known” malware coming through is impossible with reactive antivirus products. Second, as blacklist-based solutions try to keep up, the constant scanning for threats and downloading signature updates are eroding the overall performance of their systems.

As a result, organizations need a solution that provides maximum endpoint security without reducing system performance. Bouncer by CoreTrace does both. Using application whitelisting technology that doesn’t require file and system scanning or frequent signature updates, Bouncer stops the execution of any unauthorized applications without slowing down the system–in physical or virtual environments. Don’t just take my word for it, check out the Citrix Security Challenge page where the short video, “Maximizing Security & Performance of Citrix XenDesktops with CoreTrace Bouncer” received the most community votes. Even in the cloud, you can have security and performance at the same time.

By: JT Keating

Let’s make systems more secure, rather than blacklisting more efficient…

For the sake of argument, let’s say an anti-malware strategy combining cloud-based malware identification and information sharing capabilities could eliminate the bulk of malware. Even in a perfect world with perfect collaboration, such an approach will fall short of protecting enterprise systems against more sophisticated cyber attacks if it relies heavily on reactive blacklisting technology.

In the article, “IT security industry collaboration could eliminate 90% of malware,” Eugene Kaspersky, co-founder and chief executive of Kaspersky Lab, recently told attendees at Infosecurity Europe 2011 that identifying malware faster would reduce the number of initial infections to the point that it would break the business model of most cyber criminals.

“The number of initial infections will be so low that it will cost cybercriminals more to develop the malware than they are able to recoup.”

In all due respect to Mr. Kaspersky, there are two things that we take exception to in this article.


First, even in the best possible scenario where all the crowd-sourcing came together perfectly, you’re stopping 90% of nuisance, known malware. This kind of reactive approach is no solution for protecting our systems from the truly advanced, sophisticated targeted threats that are becoming the norm today.

Second, Mr. Kaspersky mentions whitelisting, but he uses the term inaccurately–in the same way most incumbent blacklisting providers do. True application whitelisting solutions enforce a whitelist of approved applications, thereby preventing the execution of all other applications (including zero day malware, etc.). Incumbant blacklisting providers like Mr. Kaspersky, in an attempt to protect their revenue streams and compete against other blacklisting solutions, have bastardized the term whitelisting as a way to make blacklist scans more efficient. They are mangling the term to describe a process wherein the performance impact of blacklist scans are reduced because “whitelisted” (“known good”) files do not need to be included in blacklist scans. This does not make endpoints more secure, it makes blacklisting more efficient.

Instead of relying on reactive approaches to stop the vast majority of nuisance malware, application whitelisting solutions proactively prevent all unapproved code from running on a system–including new or unknown malware that remains under the radar of reactive, information sharing approaches.

By: JT Keating

How Much Protection Do My Documents Need?

I recently had an opportunity to watch race car driving live at Infineon Raceway in Sonoma. If you’re a car enthusiast like me, nothing is more exciting than seeing hot sports cars driving fast on a track. Drivers are continually trying to outmaneuver each other to gain position and push their own driving abilities to the limit.

Equally interesting was the experience of watching drivers suit up and prep their cars before each race. This ritual had me thinking about the safety equipment drivers use to ensure a safe experience on the track. They wear helmets, gloves, neck braces, and fire-retardant suits, socks, and shoes. Their cars have roll cages to prevent the passenger compartment from getting crushed in the event of a rollover accident.


Race Car Driver – Adam Huff

Just as race car drivers need to be concerned about safety on the track, organizations also need to be concerned about the security and confidentiality of the information they share. But not all safety equipment or, in this case, collaboration solutions are created equal.

Some collaboration solutions focus entirely on ease of use rather than security. It is like driving a car without a seat-belt. This might be adequate most of the time, but you don’t want your organizations’ 10-K ending up on CNBC before the official quarterly announcement is made. We wear seat-belts every day because we never know when we’ll be in an accident. Likewise, your organization needs to securely share information on an on-going basis because you never know when you’ll need that security.

Other collaboration solutions created like Fort Knox are built for specific file sharing use cases. These might be an option for negotiating billion dollar deals where money is no object, but not for organizations looking to deploy secure collaboration solutions across enterprise. Using this type of solution is like driving a Volvo along a quiet 25 mph two-lane country road with a racing helmet and harness.

And lastly, some collaboration applications contain both the ease-of-use internal and external users’ need, while giving the enterprise organization the protection it requires. Accellion offers organizations the ability to securely share files with people across corporate boundaries, while ensuring enterprise security and compliance. Accellion is like driving a zippy, yet safe Acura TL or a BMW 328i with a regular seat-belt. You have the peace of mind that comes from knowing that your information is being shared securely.

Posted by Nina Seth:
Nina is Product Marketing Manager at Accellion.

If a tree falls in a forest, and no one hears it, does it make a sound?

If a tree falls in a forest, and no one hears it, does it make a sound?  Or the file sharing equivalent – if an employee uses a free personal file sharing account, and IT doesn’t know about it, does it still present a security risk?  You bet it does.



This week’s CIO UK article entitled CIOs: Break security rules to make them better raises an important point that IT needs to get involved with the applications and devices that employees are bringing into the workplace in order to improve security.

IT experimentation with consumer oriented services lets IT see the type of services that employees are looking for but also gives IT firsthand knowledge and experience of the alarming security implications.
Anyone who has signed up for a free dropbox type of account knows how convenient it is for syncing files.  At the same time anyone with a sense of information security gets this niggling feeling that something isn’t quite right about the ease of moving files out of the organization.

So if employees are using free personal file sharing accounts for enterprise use and IT doesn’t know about it, does it create a data security and compliance risk?  You bet it does.  In fact an informal survey of IT folks indicates that in most organizations IT does know that employees are using a variety of free personal  file sharing apps.

So what’s a good approach for IT to deal with this?  A good first step would be to signup for a free file sharing account and see firsthand not only how easy it is to use but also how easy it is to abuse.  Then make it a priority to deploy an enterprise solution for secure file sharing that makes everyone happy.  Let us suggest Accellion.

Posted by Paula Skokowski:
Paula is the Chief Marketing Officer at Accellion.

PCI Compliance Enhanced: ATC Omega Adds Wireless Intrusion Detection & Prevention

St. Louis-based Data Security and PCI Compliance firm Partners with AirTight Networks, the Leading WIPS Solution Provider

Ellisville, MO - February 28, 2011 - With the PCI Security Standards Council placing more emphasis on wireless intrusion detection and prevention, the industry-leading solution, Omega by American Technology Corporation, is ahead of the pack. The company has partnered with AirTight® Networks, a global leader in wireless intrusion prevention (WIPS) products and services, to provide its customers with enhanced network security.

"Wireless intrusion is a real threat to a retail chain and it needs to be monitored continuously. With integration of the AirTight Cloud ServicesTM and Omega, customers can monitor all alerts from a single console. The biggest challenge for a retailer is to manage a widely distributed infrastructure for PCI compliance," said Shekar Swamy, ATC's president. "There is simply no other solution like this available on the marketplace today which allows administrators to monitor and manage network security policy, including wireless, through a single pane of glass and minimize the need to learn multiple technologies. That's why we're so excited to offer our Omega clients wireless intrusion detection/prevention (WIPS) service through this strategic alliance."

"AirTight Network's Cloud based WIDS/WIPS allows us to complete our spectrum of services to manage the entire PCI compliance process," Swamy continued. "All other capabilities of Omega, such as automated file integrity monitoring, real-time monitoring, anti-virus, logging, 2-FA based remote control, and reporting make it possible for large and small retailers to achieve total compliance. The hosted OmegaSecureTM solution option and the installed OmegaManagerTM system now both deliver wireless intrusion detection/prevention as an option."

"ATC's approach to technology for its customers is a perfect match for AirTight - that is to provide the enterprise with solutions that deploy easily and deliver quickly on their promises," said Jack Torgow, Vice President of Sales for AirTight. "Both AirTight and ATC provide solutions that are clearly designed to address the budget and personnel constraints of the retail industry and automate of as many tasks as possible, making it simple to meet and maintain PCI compliance."

About ATC


ATC and its Omega solutions help businesses achieve PCI compliance -- and maintain that compliance even as the standards evolve. Omega solutions are used by Quick Serve Restaurants, convenience store chains, independent operators and specialty retail chains. Omega solutions are offered in both hosted and installed options, each providing clients the convenience of managing every aspect of PCI compliance within one console. To learn more call (636) 557-7777 or visit www.omegasecure.com.

About AirTight Networks


AirTight Networks is the global leader in wireless security and compliance solutions. AirTight's patented technology protects enterprises from the growing problem of Wi-Fi security threats, while allowing organizations to better manage their WLAN environment and comply with emerging wireless compliance standards (i.e. PCI). The Company's award-winning SpectraGuard wireless intrusion prevention solution (WIPS) family provides enterprise security and compliance professionals with unparalleled capabilities to accurately detect, classify, block and locate all Wi-Fi security threats, while helping network operations staff to quickly monitor and troubleshoot WLAN performance issues. AirTight's pioneering Cloud Services family of cloud-hosted subscription services delivers the world's first and only "No Capex" multitenant WIPS, PCI wireless compliance and controller-less WLAN access solutions all in a single device. 

AirTight's award-winning solutions are used by customers globally in the government, financial, retail, hospitality, telecom, technology, manufacturing, transportation, healthcare and education sectors AirTight owns the seminal patents for wireless intrusion prevention technology with 23 U.S. and international patents granted to date (UK, Australia Japan) and more than 20 additional patents pending. AirTight Networks is a privately held company based in Mountain View, CA.

Media Contacts:
Della Lowe - 
AirTight Networks
Tel: +1 (650) 934 8191
della.lowe@airtightnetworks.com