2009 was a banner year for cybercriminals. Many large enterprises reported data theft incidents from their supposedly secure databases. The same fate also befell the smaller companies. They also became victims of hack attacks and virus infections.
2010 will be no better. On the contrary, the security threats may assume more ominous proportions. And, it is only to be expected. As security systems are getting more sophisticated, there is every possibility that cybercriminals will find more complex and innovative ways of keeping pace or staying ahead.
The computer security is one of the most critical areas of Information Technology (IT). With the boom in Web 2.0 and increase in data storage as well as technology-driven businesses, the security concern has increased manifold. David Marcus, Director of Security Research and Communications for McAfee Labs, which has released its 2010 Threat Predictions report, was quoted as saying that cybercriminals tend to move where the people were going for communication needs. And not only has the volume of threats escalated dramatically, the delivery models have become more sophisticated. McAfee has observed a new technique that involves interruption in legitimate transaction to make an unauthorized withdrawal through simultaneous check on the user's transaction limits. The company also predicted that Google's new operating system – Chrome – would be the probable target for online attacks.
Cyber crime has surpassed illegal drug trafficking as a criminal money maker. Every three seconds an identity is stolen. “We cannot ignore the fact that cybercriminals are now destroying lives rather than computers. Today’s online thieves will stop at nothing to steal anything you have got: your money, your identity, even your good name. And their methods are getting more devious and sophisticated every day,” says Gaurav Kanwal, Country Sales Manager – India, Consumer Products & Solutions, Symantec.
In its recent report on 2010 threats, Symantec said that URL shortening services would become the phishers’ best friend. “Because users often have no idea where a shortened URL is actually sending them, phishers are able to disguise links that the average security-conscious user might think twice about clicking on. Symantec is already seeing a trend towards using this tactic to distribute misleading applications and we expect much more to come. Also, in an attempt to evade anti-spam filters through obfuscation, expect spammers to leverage shortened URL shorteners to carry out their own evil deeds,” says Gaurav Kanwal.
As the sales of Mac and smartphones are poised to gain momentum, the company Symantec expects an increase in mobile malware. “Moving forward in 2010, we anticipate security spending to continue to be strong in India and more targeted to also address security risks that come with the deployment of new technologies within enterprises,” said Amuleek Bijral, Country Manager, India & SAARC, RSA Security. Every antivirus lab receives between 20,000 and 30,300 unique and new samples every day. And this number is expected to rise with newer threats. According to an IDG research commissioned by RSA in 2009, it was found that 73 per cent of the top IT security decision-makers surveyed across the globe reported increased usage of virtualization technology, personal consumer mobile devices and social networking platforms at their companies. Among the respondents, more than 65 per cent do not yet have a security strategy in place.
Bijral believes that as the cyber threats are becoming more sophisticated and IT systems more complex, large enterprises will continue to examine ways to improve the performance and responsiveness of IT and security operations. “Taking a more advanced approach to security operations, while also integrating key IT operations functions, better enables organizations to identify and manage incidents and protect valuable information and IT assets. Companies will no longer get by with security deployments in a piecemeal fashion; they will need to look at their IT stacks through a macro lens and develop a holistic security strategy that meets the needs of their organizations and combat cyber warfare effectively,” he added. 99% of the security threats come from the Web, today.
Gareth Williams, Vice-President – Sales (Emerging Markets) at AVG Technologies, says that many of the latest generation of smartphones run applications concurrently, just as the netbooks do. With the applications that have emerged with the explosion of Web 2.0, people have great opportunities to communicate, to shop, to make reservations, and to perform financial transactions any time, any place. At the same time, there are also plenty of opportunities to abuse the trust people place in social networks, giving cybercriminals another opportunity to exploit users for profit. “Security and functionality exist in an inverse relationship. The more functionality a device has, the more insecure it becomes. We can be sure that they will follow the money, and mobile devices being used for banking and purchasing transactions are firmly in their sites,” said Williams.
Highlighting the needs of additional security platform, he says that more thought is being put into designing security into technology. Companies like AVG are working to make sure that additional security is available to protect not only PC users but also users of smartphones and other mobile devices. “The most important developments in the market are those which take protection beyond signature-based anti-malware. Security labs see tens of thousands of new malware samples every day, and it is simply not possible to create detection signatures for each one. So, different detection and protection techniques are being developed, such as white-listing/ blacklisting – which designates specific programs as being “known good” or “known bad” and treated accordingly – and behaviour analysis, sometimes also referred to as heuristics – which uses a process of elimination to determine whether an application is behaving in an appropriate manner and allowing or blocking it, depending on a combination of behavioural characteristics,” he added.
Each year, cybercriminals, who have largely succeeded in duping the unsuspecting user, are investing in sophisticated and automated ways to run their operations. “It can be safely predicted that in 2010 the threat environment will witness higher volumes of web threats and be even more transient, agile and organized. Internet security threats that AVG expects to have significant impact on users in 2010 include more diverse, automatically generated malware. The bad guys still want your money, identity and/or resources; cybercriminals in the cloud; highly transient web threats; exploitation of major events, news and gossip; emerging nations go online with poor security; and global economic crisis impacts security,” added Williams.
“RSA is geared with solutions to ensure infrastructure security in such challenging times to drive business momentum in 2010. To manage identity in cloud or virtualized environment, RSA leverages its strong Authentication capabilities, multi-factor authentication, One-time passwords, federated identity management, Access Manager and Adaptive Authentication,” said Bijral. Company’s Transaction Monitoring system goes beyond assuring the identity of users logging in by authenticating the transactions they perform to boost online security, reduce fraud and mitigate the risks of advanced threats, based strongly on the RSA eFraudNetwork service – a cross-institution, collaborative online fraud network dedicated to sharing and disseminating information on fraudulent activity. To manage context aware authorization with fine-grained entitlements and authorization administration based on intelligent central policy management, RSA Entitlements Policy Manager protects resources even beyond web applications.
Owing to the benefits cloud computing and virtualization offer consumers and businesses, it is likely that adoption rates will rise. A tough economy is also driving companies globally to adopt more cost-effective measures and pursue efficiency. With the expansion of cloud computing capabilities, services, and offerings, it is hardly surprising that the popular platform will also become a favourite target for cyber thugs. According to Amit Nath Country Manager, Trend Micro India and SAARC, new attack vectors will arise for virtualized/cloud environments.
The new AVG 9.0 product suite has many added features, which will be making the software faster, safer and easier to use that include high-performance scanner and quick-installation process for new customers. In addition, AVG 9.0 combines traditional signature-based detection with the newest behavioural, in-the-cloud, and white-listing technologies in one integrated solution. “AVG LinkScanner gives users an additional real-time layer of protection in addition to their existing security software. It works by looking beyond the web page a user is currently viewing to analyze the safety of the pages linked to that page. This means that, for the first time, users can truly know whether it is safe to click on a link at the only time that matters – when they are about to click that link. AVG Data Protection is a different kind of protection that goes way beyond typical identity theft prevention software,” said Williams.
Trend Micro claims that social networking third-party applications will be targeted. “The increasing use of social networking sites will likely give cause to new tacks on old threat methods. Already, social networks are heavily targeted by cybercriminals. Going into 2010, it is likely that social networks will continue to be the target of cybercriminals,” says Amit Nath.
“With the popularity of social networking sites poised for another year of unprecedented growth, expect to see fraud being leveraged against site users to grow. In the same vein, expect owners of these sites to create more proactive measures to address these threats,” says Symantec. “As this occurs, and as these sites more readily provide third-party developer access to their APIs, attackers will likely turn to vulnerabilities in third-party applications for users’ social networking accounts, just as we have seen attackers leverage browser plug-ins more as Web browsers themselves become more secure,” added Gaurav Kanwal.
2009 saw the release of Microsoft’s latest operating system, Windows 7. Though the Redmond giant has played up the safety of it, Trend Micro believes that it will cause security issues for some companies. “Windows 7 will have an impact since it is less secure than Vista in the default configuration,” says Amit Nath.
Channel Challenges
As awareness of the need for IT security increases with great rapidity, the customers are demanding security solutions. But what is more pertinent to note is that they hardly seem to be aware of what exactly they want. This leaves it up to the channel partners and resellers to play an important role in providing the right solutions. And, this merits a serious security know-how in the channel. “At Symantec, we place extremely strong emphasis on educating and empowering our channel with information and knowledge about today’s Internet threats, and the security technologies that will protect consumers against them,” says Gaurav Kanwal. He adds, “Because most of Norton’s users approach our channel partners directly for counsel, it is critical that we work with our partners closely to ensure they understand the security landscape as well as the differences between traditional security models and new technologies such as reputation. This will allow our partners to provide sound recommendations to their customers so that the solutions they purchase will add immense value to their online safety.”
“Education and awareness are the two basic steps. Partners should become strategic in their approach and enhance their skills and gain good knowledge of the products and solutions that they sell,” says RSA. He adds, “RSA will continue to work closely with its partners and this year we are focussed on developing an enhanced SecurWorld Program that would strengthen partner skills that in turn will help them go to the market with the right tools to meet their customer requirements.”
As the market in India continues to grow, AVG will continue to focus on developing technologies and solutions that will pre-empt the growing sophistication of cybercrime. Of utmost importance is to keep abreast of the latest trends in the cybercrime landscape and educate oneself of the latest technologies being developed and sold. This is especially so in a market like India, where consumers rely heavily on recommendations and will seek advice from resellers. Thus, resellers need to be well-versed about security products and solutions. “Recognizing this, we will also further fortify our training programme as we believe that it is of utmost importance to educate our channel partners so that they are well-prepared to address the queries of the discerning customer,” says Gareth Williams.
Amit Nath
Country Manager, Trend Micro India and SAARC
Trend Micro 2010 Security Predictions
• No global outbreaks, but localized and targeted attacks.
• It is all about money, so cybercrime will not go away.
• Windows 7 will have an impact since it is less secure than Vista in the default configuration.
• Risk mitigation is not as viable an option anymore—even with alternative browsers/alternative operating systems (OSs).
• Malware is changing its shape—every few hours.
• Drive-by infections are the norm—one Web visit is enough to get infected.
• New attack vectors will arise for virtualized/cloud environments.
• Bots cannot be stopped anymore, and will be around forever.
• Company/social networks will continue to be shaken by data breaches.
Gaurav Kanwal
Country Sales Manager – India, Consumer Products & Solutions, Symantec
Symantec Top Security Trends in 2010
• Antivirus is Not Enough
• Social Engineering as the Primary Attack Vector
• Rogue Security Software Vendors escalate Their Efforts
• Social Networking Third-Party Applications will be the Target of Fraud
• Fast Flux Botnets Increase
• URL Shortening Services become the Phisher’s Best Friend
• As Spammers adapt, Spam Volumes will continue to Fluctuate
• Specialized Malware
• CAPTCHA Technology will Improve
• Instant Messaging Spam
• Non-English Spam will Increase
Gareth Williams
Vice-President – Sales, Emerging Markets, AVG Technologies
AVG
Education and awareness are the two basic steps. Partners should become strategic in their approach and enhance their skills and gain good knowledge of the products and solutions that they sell. RSA will continue to work closely with its partners and this year we are focussed on developing an enhanced SecurWorld Program that would strengthen partner skills that, in turn, will help them go to the market with the right tools to meet their customer requirements.
The single biggest trend for all antivirus programs in 2010 is trying to figure out how to deal with the massive numbers of malware programs produced each day. Every antivirus lab gets between 20,000 and 30,300 unique and new samples every day, with just a few hundred being released into the Wild each. Most are just what we call zoo, or collection, samples. They are produced by cyber-criminals to hide the Wild samples that will be released each day. You see, most antivirus products are signature scanners, which means that they are very good at detecting malware that they know about, but not so good at new stuff. Today’s sophisticated cyber-criminals know that all scanners will add a signature for all samples eventually, but it’ll take them a couple of weeks, and in the mean time, they’ve changed the actual released code every day. This means they have a constant sliding window of a week to ten days where they cannot be detected by most scanners, and therefore a week to ten days to infect victims.
The most important developments in the market are those which take protection beyond signature-based anti-malware. With security labs see tens of thousands of new malware samples every day, and it’s simply not possible to create detection signatures for each one. So different detection and protection techniques are being developed, such as white-listing /blacklisting – which designates specific programs as being “known good” or “known bad” and treated accordingly – and behavior analysis, sometimes also referred to as heuristics – which uses a process of elimination to determine whether an application is behaving in an appropriate manner and allowing or blocking it, depending on a combination of behavioral characteristics.
A really good antivirus program will have a dedicated web-scanning layer, as 99% of today’s threats come from the web, plus a behavior layer, backed up by a traditional, but excellent antivirus scanner, to find anything that slips through the first two layers.
Sumit Mukhija
National Sales Manager, Data Centre
Cisco India & SAARC
Cisco
Annual Security Report 2010:
According to the survey conducted by Cisco, annual Security Report 2010, enterprises are increasingly looking at social media platforms to access and share information. The increasing trust on social networks such as Facebook, Twitter, Orkut, Linkedin and the usage of advanced devices such as mobiles, iPhones and Blackberries have changed the paradigm of secure environments. The migration from the “traditional office environment” where work happens behind fortified network walls is intensifying each day.
As a result, software vendors are also updating their security solutions. Cisco, Microsoft, Oracle and Adobe whose products have been a victim of security attacks have all released updates to patch more than 100 vulnerabilities on their respective products.
According to Cisco research, the number of vulnerabilities and threats remained relatively consistent in 2009 compared to previous years, but the exploit and attack threat levels increased by 57 per cent. We believe that 2010 will continue to expose the social media network as a potential area of security risk for most enterprises. The social networking trend shows no signs of slowing, especially as more businesses start using these sites, users join multiple communities based on their various interests, and more people worldwide gain Internet access. Thus, it is likely that social networks will be gaining the membership of many more cybercriminals in the year ahead.
In the year ahead, it is also expected that businesses will be embracing the concept of the borderless enterprise as they look to new approaches and emerging technologies, such as virtualization and data center optimization. The Zeus Trojan is estimated to have infected 3.6 million computers as of October 2009; the newer Clampi Trojan is estimated to have infected hundreds of thousands of computers. Cisco Security Intelligence Operations (SIO) is an advanced security infrastructure that enables the highest level of security and threat detection and prevention for Cisco customers.
Security is surely not an off-the-shelf product which you can buy. Taking an end-to-end security approach helps information security managers build reasonable confidence on their security strategy and deployments. This is an opportunity for partners as they get access to an end-to-end security solution portfolio with Cisco, which addresses the needs of an SMB customer, a large enterprise, or a service provider network. Partners would need to be able to offer and implement integrated solutions where they can offer end-point security, application security, content security, security operations management and configuration & change management and policy enforcement solutions with their experts in the field. Add-on expert services would also be appreciated by customers – an area that partners can look to for additional services revenue.
Cisco’s Partner Enablement Tools make it easier for Cisco partners to more effectively sell, deliver and support Cisco technologies and solutions by focused tools, training, selling & marketing offerings to help scale the channel to effectively support Cisco growth, promote absorption of new technologies and develop increased productivity through focussed offerings.
Amuleek Bijral
Country Manager, India & SAARC, RSA Security
RSA 2010 Security Predictions:
1. Infection intensifies: The rate of malware infection of personal computers was ten times higher during 2009 compared to 2008. We project infection rates to further grow in 2010 as cybercriminals scale up their attacks and adapt to emerging defences. Drive-by-download (taking over legitimate websites; routing visitors to an infection server) will continue to be a primary infection method, but social engineering attacks (e.g. spamming a victim’s entire social network “friend list” with links to infection servers) will intensify.
2. Trojans will become corporate-aware: Today, Trojans designed for financial fraud already record a massive amount of enterprise data siphoning off infected PCs. In 2010, we project that the Trojan operators will become more corporate-aware, and build specific triggers for recording sensitive corporate data, files and emails for future trade.
3. Penetrating enterprise via employee resources: Already, thousands of Fortune 500, government and bank employees are infected with financial Trojans that targeted them as consumers. In 2010, we expect hackers attacking the enterprise to begin using remote PCs infected with Trojans as a preferred way to penetrate the enterprise.
4. Corporate Web 2.0 based social engineering attacks: The enterprise develops web 2.0 functionality in order to support a growing internal demand, but this makes them an easier target for social engineering attacks that are combined with malware. We predict that cybercriminals will use web 2.0 applications for various objectives such as collecting corporate data, infecting multiple PCs within the network, and stealing employees’ private information in order to do identity theft.
5. Corporate becomes Dark-Cloud-Aware: While the Dark Cloud becomes more corporate-aware, CISOs will seek to gain better visibility into the Dark Cloud of Cyber crime infrastructure and feed information such as stolen access credentials and compromised endpoints directly into their back-end monitoring systems.
