 | Issue: | Global-ICT 2006 |
| Article no.: | 20 | |
| Topic: | The dice we roll | |
| Author: | Eva Chen | |
| Title: | CEO and Co-founder | |
| Organisation: | Trend Micro | |
| PDF size: | 336KB |
About author
Eva Chen is the CEO and Co-founder of Trend Micro. In the past, she has also served as Chief Technology Officer and as its Executive Vice President. Ms Chen contributed heavily to seven patents, including those pertaining to the detection and removal of viruses in email and on computer networks used in the company’s award-winning anti-virus software. Ms Chen has written numerous articles on the subject of Internet security and, in April 2000, she won the Judges Award from Secure Computing Magazine for her article, Poison Java. She recently received the prestigious Tribute to Women in the Industry, TWIN, award from the YWCA, and was named one of the ten Marketers of the Year by Marketing Computers magazine in 1996. Ms Chen is also a published sci-fi author and used to be a sports journalist. Eva Chen received her MBA and MIS degrees from the University of Dallas, Texas, after earning her Degree in Philosophy from Chiang Chi University in Taipei, Taiwan.
Article abstract
Today, notoriety is no longer enough to drive malware writers; the motivation is now financial gain. New technologies continually provide cyber criminals with new weapons – mass-mailing worms, improved viruses, spear-and-spy-phishing, bots, etc – to work with. To combat today’s cyber-criminals, security companies are working with network equipment manufacturers to build hardware/software solutions. Many businesses lack the know-how to deal with ICT security. Services, similar to guard services for buildings, will increasingly take over these tasks on a contract basis.
Full Article
Responding to change The only constant in today’s threat landscape is change. Indeed, security organisations must seek new ways to protect their customers’ organisations against a shifting threat landscape, forcing them to re-evaluate previously successful strategies. So what is fuelling those changes? Cyber criminals are more determined: Gartner predicts that by 2008, 40 per cent of organisations will be targeted by financially motivated cyber crime. Clearly, these figures indicate that the fame, the notoriety, that used to drive malware writers is no longer enough – the latest forms of malware are inspired by the promise of financial gain. Furthermore, the change is driven by new developments in technology that provides cyber criminals with new tools to work with. For instance, the array of threats now encompasses mass-mailing worms and viruses in addition to new forms of threats such as spear-and-spy-phishing, and bots. These factors present the security industry with a challenge to find new ways to help organisations to fight threats. Beyond anti-virus The first step in meeting the challenge lies in examining the actual changes in the threat landscape. Over the past two years, the prevalence of major threats has given way to so-called silent threats. These are the type of blended threats that are hidden in the system and plague the user’s environment without the user being aware that their computer has been infected. Silent threats range from ‘zombies’, which allow cyber criminals to control the PC for a variety of criminal purposes, to ‘bots’, programmes that gain complete control over the affected computer and simulate human activity. In fact, bots have become so sophisticated that they now account for the exponential rise in spam, with 70-80 per cent of spam now sent by bots. Bots are also generating significant ‘indirect’ financial loss. They account for the sharp increase in click-fraud, an initiative that imitates a legitimate user of a web browser clicking on an online advertisement for the purpose of generating an improper charge per click. Until recently, individuals carried out click fraud, but the advent of bots has changed this by automating these actions. As advertisers launch more cost-per-click, CPC, campaigns, and with online advertising costs on the rise, click fraud has been increasing in frequency. Consequently, an increasing number of marketing budgets are now being deflated by bots. Activities such as key-logging present another kind of silent threat, by recording every key the user presses when using their computer to learn passwords, credit card numbers and other confidential data. Not surprisingly, the traditional scan and clean antivirus approach is challenged by the new threats, calling for a new approach from security vendors. Network as a platform Another answer to meeting the challenge of progressively more determined cyber criminals and increasingly sophisticated malware programmes lies in forming alliances with infrastructure vendors. Increasingly, network infrastructure and security companies are forming alliances to work together. By fighting today’s blended threats from the core infrastructure upwards, protection can be tailored and applied more quickly, providing an infinitely improved starting point for updating and upgrading changing security measures. Since 2003, when network worms first caused networks outages, security companies realised that network infrastructure and security would have to merge. Dominant hardware and software players are starting to enter this space, and we are working with several of them to integrate security technologies into the network, and develop technology with better integration capabilities. Working together this way will enable the network provider to combine their products with the necessary security service. This way network infrastructure and security work together and protect right from the start. Software as a service A study of small-to-medium sized businesses, SMB, demonstrated a high level of awareness of the importance of technology in business life, as well as an increased awareness of its inherent security threats. Whilst technology at work is meant to make business life easier, the survey showed that it actually contributes to people’s angst. Twenty-nine per cent of all respondents admitted they get ‘stressed-out’ when technology doesn’t work. Very few respondents could demonstrate that their staff dealt with IT problems constructively. Almost 65 per cent of respondents said that their staff complained to them about IT problems, whilst only 30 per cent of staff try to fix the problem themselves. Then, too, one in every ten (11 per cent) staff members do nothing at all and just live with the problem – a worry in itself! Lack of resource available to SMBs is another major concern for small-business owners and managers. In fact, 57 per cent of respondents were more concerned about their lack of resources than about contending with a heavy workload (50 per cent). The ability of the IT staff to protect the business was queried in the research as well, and over half of UK respondents who were victims of a spyware attack believed that more could have been done to prevent the attack. The pressure on limited small business IT resources is highlighted by a third of all respondents, who suggested more should be done to protect them, whilst nearly half of respondents highlighted a need for more education about specific threats. A large proportion (85 per cent) of small business respondents said they would like a vendor to advise them of security threats and provide guidance for protecting their business assets. The survey demonstrates that since security has to be part of ‘doing business’, small businesses will typically not have the time and resources to deal with and manage security issues day to day. There will be a need to buy security as a service. A building’s physical security might range from locks to sensor systems linked to a monitor and a guard service. Digital security will, as well, evolve towards the same sort of concept. Investment in outsourced security services and exploration of a managed services provider’s portfolio will soon make the same sort of sense to most businesses that a guard service for a building now does. New threats, as such, cannot be predicted. However, by understanding the digital world and potential threats to it, defences can be improved and threats prevented more effectively. Working together with network providers and offering security as a complete, compact service are all steps towards ensuring businesses can take advantage of the full benefits of the digital world.
