10 security Threats to Watch Out

1: Social networking as an avenue of attack

Social networking has experienced a boom in popularity over the last few years. It’s now finding its way from the home into the workplace and up the generational ladder from the young folks into the mainstream. It’s a great way to stay in touch in a mobile society, and it can be a good tool for making business contacts and disseminating information to groups. However, popular social networking sites have been the target of attacks and scammers. Many people let their hair down when posting on these sites and share much more personal data (and even company data) than they should.

As Steve Riley pointed out in his recent talk on attack progressions at the 2009 MVP Summit, today’s young professionals are growing up with social networking, and they expect to have it available to them at work just as older employees expect to be able to use their office telephones for reasonable, limited personal calls.

2: More attacks on the integrity of the data

Another point Steve made in his presentation is that “First they came for bandwidth; now they want to make a difference.” In the past, many attackers were looking for a free ride on your Internet connection. Then the nature of attacks progressed. Instead of the network being the target, it was the data. The next step was stealing data, but step after that is even more insidious: the malicious modification of data.

This can result in catastrophic consequences: personal, financial, or even physical. If a hacker changed the information in a message to your spouse, it could harm your marriage. If the change were to a message to your boss, you might lose your job. Changing information on a reputable Web site regarding a company’s financial state could cause its stock prices to drop. A change to electronic medication orders on a hospital network could result in a patient’s death.

3: Attacks on mobile devices

Laptop computers have presented a known security risk for many years. Today, we are more mobile than ever, carrying important data around with us not just when we go on business trips but every day, everywhere we go, on smart phones that are really just small handheld computers. These devices have important business and personal e-mail, text messages, documents, contact information and personal information stored on them. Many of them have 8 or 16 GB of internal storage and you can add another 32 GB on a micro SD card. That’s much more storage space than the typical desktop computer had in the 1990s.

4: Virtualization

Virtualized environments are becoming commonplace in the business world. Server consolidation is a popular use of virtualization technologies. Desktop virtualization, application virtualization, presentation virtualization — all of these provide ways to save money, save space, and increase convenience for users and IT administrators alike. If it’s properly deployed, virtualization can even increase security — but that’s a big “if.” Virtualization makes security more complicated because it introduces another layer that must be secured. In essence, you now have to worry about two attack surfaces: the virtual machine and the physical machine on which it runs. And when you have multiple VMs running on a hypervisor, a compromise of the hypervisor could compromise all of those machines.

Another virtualization-related threat was demonstrated by the infamous Blue Pill VM rootkit. Hyperjacking is a form of attack by which the attacker installs a rogue hypervisor to take complete control of a server, and VM jumping/Guest hopping exploits hypervisor vulnerabilities to gain access to one host from another.

5: Cloud computing

If virtualization was last year’s buzzword, this year it’s all about “the Cloud.” The uncertain economy and tight budgets have companies looking for ways to lower operating costs, and outsourcing e-mail, data storage, application delivery, and more to cloud providers can present some attractive potential savings. Microsoft, IBM, Google, Amazon, and other major companies are investing millions in cloud services.

Cloud advocates envision a day when we’ll all use inexpensive terminals to access our resources that are located someplace “out there.” But when your data is “out there,” how can you be sure that it’s protected from everyone else “out there?” In fact, the biggest obstacle to moving to the cloud, for many companies and individuals, is the security question. IDC recently surveyed 244 IT executives and CIOs about their attitudes toward cloud services, and 74.6% said security is the biggest challenge for the cloud computing model.

7: Third-party applications

Microsoft has put tremendous effort into securing the Windows operating system and its popular productivity applications, such as Microsoft Office. Linux and Mac receive regular security updates. As operating systems become more and more secure, attackers will focus less on OS exploits and more on application exploits. The major Web browsers are routinely updated to patch security vulnerabilities. But the vendors of many third-party applications are less security-aware.

8: Side effects of green computing

Green computing is all the rage today, and saving energy is certainly a good thing — but as with beneficial medications, there can be unexpected and unwanted side effects. Recycling computer components, for instance, can expose sensitive data to strangers if you don’t ensure that hard drives have really been wiped cleaning.

On the other hand, such green initiatives as powering down systems that aren’t in use can actually enhance security, since a computer that’s turned off isn’t exposed to the network and isn’t accessible 24/7.

9: IP convergence

Convergence is the name of the game today, and we are seeing a melding of different technologies on the IP network. With our phones, cable TV boxes, Blu-ray players, game consoles, and even our washing machines connected to the network, we’re able to do things we never even imagined a decade ago. But all of those devices on an Internet-connected network present myriad “ways in” for an attacker that didn’t exist when only our computers used IP.

We can only hope that the manufacturers of all these devices put security at the forefront; otherwise, we may see a rash of new malware targeting vulnerabilities in our entertainment devices and household appliances.

10: Overconfidence

Perhaps the greatest threat to the security of our networks, whether at work or at home, is overconfidence in our security solutions. Many home users believe that as long as they have a firewall and antivirus installed, they don’t have to worry about security. Businesses tend to put too much faith in the latest and greatest security solutions. For example, there is an assumption that biometric authentication is infallible and undefeatable — but it can be compromised in various ways, and when it is, the legitimate user it was meant to protect becomes the victim. If the system shows that your fingerprint was used to log on, you may be presumed guilty, and an investigation might not even be deemed necessary.

For More Info visit:http://blogs.techrepublic.com.com/10things/?p=602

McAfee Announces Comprehensive Virtualised Server Security Suite

Virtualisation gives organizations the ability to consolidate servers to share physical resources including processors, memory, and disk space. Companies are quickly adopting virtualisation to increase infrastructure utilisation, reduce hardware cost, improve operational efficiencies and simplify deployment.

McAfee Inc. has announced McAfee Total Protection for Virtualisation, which extends security across virtual and physical environments. McAfee provides customised protection for virtual environments including online and offline virtual machines, so that enterprises can safely benefit from the full potential of virtualisation technology.

“Over the next five years, more than half of server workloads will be virtualised, but awareness of server virtualisation risks remains low,” said Gartner Fellow and Vice President, Neil MacDonald. “Security must be incorporated into virtual systems from their inception -- not addressed later as an afterthought.”

McAfee Total Protection for Virtualisation delivers:-

• Stronger Protection - comprehensive, layered protection for all virtual machines against malware, rootkits, spyware, bots, spam, zero-day threats, vulnerabilities, data loss, data exposure, and more
• Lower Costs – single management console and automatic updates reduce time and resources required for secure virtualisation management for improved operational efficiencies
• Simplified Compliance – automated compliance reports and integration with McAfee and third-party compliance tools enable better compliance for virtual environments

McAfee Total Protection for Virtualisation is a comprehensive virtualised server security suite that includes the following core components:-

• McAfee VirusScan Enterprise and McAfee VirusScan Enterprise for Linux - continuous on-access scanning for superior protection from viruses, worms, and other malicious code
• McAfee VirusScan Enterprise for Offline Virtual Images - first and only security solution to scan, clean, and update offline virtual machines without bringing them online
• McAfee AntiSpyware Enterprise - unique on-access scanning to identify, proactively block, and safely eliminate spyware and other potentially unwanted programs
• McAfee Host Intrusion Prevention for server - combines signature and behavioral IPS protection, firewall, and application control to stop known and zero-day attacks.
• McAfee ePolicy Orchestrator - centralised management console is the only integrated security and risk management platform for both physical and virtual environments.

Total Protection for Virtualisation will be available in Q4. Pricing is per physical server host, and covers all virtual machines deployed on that server.

Source:securitypark.co.uk/security_article262060.html