Security A 21st Century Concern

Security A 21st Century Concern

Security is of major concern in today’s world as the world has become increasingly complex and easily accessible, especially via the internet and email. One of the most important issues facing people regarding security today is in regards to computers. Most of the security issues in relation to computer viruses and worms, Trojan horses, and the like, are geared predominantly to the PC consumer market.

Ranging from running adware to hijacking browsers, infecting computers with malware and spyware programs that run massive spam emails, act as servers, completely overtake computers, steal personal information including social security and identity numbers, personal residence information, age, demographics, as well as credit card and banking information, to running pornographic material and ads, the amount and variety of spyware and adware threats that pose security issues to computers, have compounded in the last few years, exploding the increase of security violations.

One of the most prevalent penetrators through computer firewalls and security systems, is the computer worm. Defined in the Oxford dictionary as a self-replicating program able to propagate itself across network, typically having a detrimental effect. Computer worms primarily replicate on networks, but they represent a subclass of computer viruses. With the wide variety of computer worms and viruses, researchers differ on the exact definitions of computer worms.

The network-oriented infection strategy is indeed a primary difference between viruses and computer worms. Moreover, worms usually do not need to infect files but propagate as standalone programs. Additionally, several worms can take control of remote systems without any help from the users, usually exploiting a vulnerability or set of vulnerabilities.

Each computer worm has a few essential components, such as the target locator and the infection propagator modules, as well as a few other non-essential modules, such as the remote control, update interface, life-cycle manager, and payload routines. The worm needs to be able to find new targets to spread rapidly on the network. Most worms search your system to discover e-mail addresses and simply send copies of themselves to such addresses, a highly convenient system for attackers looking to break into a corporate firewall. Most corporations typically need to allow e-mail messages across the corporate firewalls, thereby allowing an easy penetration point for the worm. Many worms deploy techniques to scan the network for nodes on the IP level and even “fingerprint” the remote system to check whether such a system might be vulnerable.

Another important component of a worm is remote control using a communication module. Without such a module, the worm’s author cannot control the worm network by sending control messages to the worm copies. An update or plug-in interface is an important feature of advanced worms to update the worm’s code on an already-compromised system.

The attacker is interested in changing the behavior of the worm and even sending new infection strategies to as many compromised nodes as possible. The quick introduction of new infection vectors is especially dangerous. Many worms have bugs in their life-cycle manager component and continue to run without ever stopping.

The Challange – Security Vs. Mobility

The Challange – Security Vs. Mobility

The overwhelming increase in the mobility of the corporate workforce and the availability of wireless internet connections in airports, hotels, and coffee houses, creates an unbearable challenge to IT managers. Whenever employees, travelling with their laptops, connect to a hotel hotspot, they are in fact connecting their corporate computers to an unsecured network, shared by hundreds of guests. This innocent connection jeopardizes sensitive data and can bring back security threats into the corporate network when returned to the office. For this reason, IT managers have adopted rigid security policies, creating a conflict between the need for security and the productivity of the mobile workforce. For example, some organizations consider the returning laptops as “infected”. The infected laptops are completely formatted and cleaned. Some allow dial-up connections-only (no Wi-Fi), while others go further to completely prohibit the connection of laptops to the Internet outside the corporate network.
This unbearable conflict between security and mobility can only be solved if the mobile force is equipped with the same level of security as they have inside the corporate network. To understand what this means, we should examine the level of security that is maintained inside the corporate networks.

Corporate Network – Two Lines of Defense

Corporate users enjoy higher security levels inside the corporate network because they operate behind two lines of defense. The first line of defense, is a set of robust security appliances, installed at the IT center and exclusively controlled by the IT department. It is largely based on a comprehensive set of IT security appliances running secured and hardened OS, with Firewall, IDS, IPS, Anti Virus, Anti Spyware,
Anti Spam and Content filtering. The second line is based on the Personal FW and Anti Virus software installed on end-user’s computers.
The first line of defense completely isolates the user at the physical and logical layers.
Unlike PCs, these appliances are equipped with a Hardened operating systems that do not have security holes, “back-doors”, or unsecured layers. They are designed for a single purpose, to provide security.
The first line of defense provides the following advantages:
– Mobile code is not run – content arriving from the internet is not executed on these appliances it just goes or does not go through into the network. It makes it more difficult to attack as the mobile code delivered by the hackers does not run on the appliances.
Cannot be uninstalled – Security attacks often start by targeting the security software, while trying to uninstall it or stop its activity.
Software-based security solutions, as any software program includes an uninstall option that can be targeted. In contrast, the hardware-based security appliances cannot be uninstalled as they are hard coded into the hardware.
– Non-writable Memory – Hardware-based solutions manage the memory in a restricted and controlled manner. The security appliances can prohibit access to its memory, providing greater protection against attacks on the security mechanism.
– Controlled by IT personnel – The security appliances are controlled by IT, who constantly maintains the highest security policies and updates.
– Performance – The security appliances are optimized for maximum security and operate independently from computers in the network, not degrading the performance of the desktops or consuming their resources.
Consequently, the corporate PCs reside in a secured environment. If the security is breached, at least the damage stops at the gateway. The first line of defense prevents threats from entering the corporate network. While the second line serves as a precaution and help defend against threats that may have already entered the network (e.g. emails). But the real problem starts when the corporate PCs go in and out of this secured environment. Outside the corporate network they are at the frontline with no first line of defense. The problem intensifies as they return, bypassing the first line of defense as they enter the network. These laptops can be considered as the greatest threat because they unknowingly infiltrate security threats
into the supposedly safe network.