Web Security

Until a few years ago, the majority of security threats entered the network through email. Today, over 80% of all threats are delivered over the web. The level of sophistication of today’s web threats is such that your employees don’t even need to be visiting inappropriate sites to be exposed to infection; government and brand-name commercial sites are as vulnerable to being poisoned as adult sites. The need for a web security solution should therefore be a primary concern for business owners everywhere, and an important layer of protection. Every PC that connects to the Internet can act as a conduit for web-borne infections.

How the threat has changed;Virus infections were largely perpetrated by teen geeks bent on showing off their programming skills. Today’s web security threats are the work of professional criminals hacking for profit. Organized crime has discovered that online crime is almost untraceable, and there are now online marketplaces where hacks and exploits are offered for sale. This new generation of criminals uses speed and anonymity to their advantage, switching infections on and off at will. Here’s how easy it is to get infected through these new channels:

Web searching:
When you visit a search engine and enter your search criteria, you will usually get a number of results. How can you (or the search engine) know that all of these results are genuine? Unfortunately, neither you nor the search engine can know for sure, when sites are clean one minute and poisoned the next.

Web Surfing:
When you visit a web site, you’ll almost certainly click around and beyond that site, assuming that all the links are genuine. Sadly, there’s no foundation for that assumption either. As noted above, even government and Fortune 500 company sites are not immune.

To secure against these new threats, we need to be concerned with the delivery method used more than the actual threat itself. There are so many different types of threat that the only manageable way to protect against them is to stop them getting onto the PC at all. Here’s a sampling of the kinds of threats being delivered today and why web security is so critical:

Drive by Downloads:
Users typically have no idea if the site they are surfing to is malicious or not. Every day, innocuous web sites are hacked and can start installing malicious code on visitors’ PCs without their knowledge or permission.  This happens even when the user just scans the site, not clicking on anything. A few seconds on the wrong site is all it takes to compromise company data.

Exploits:
Exploits can take the form of any kind of malicious program; the common factor is that they take advantage of a weakness or vulnerability in an operating system, browser, or other web-enabled application. Exploits often attack commonly used programs like media players and document viewers that users have come to trust over the years.

Malware:
As we’ve seen earlier in our journey through the security layers, malware is an umbrella term for viruses, worms, trojans, spyware, adware, crimeware, greyware, exploits, keyloggers, password crackers – any kind of software that’s designed to do damage. Malware is often delivered these days through drive-by downloads, and if a user with administrative privileges visits an infective site, the risk of the malware jumping from the user’s machine across the network increases exponentially.

Cross Site Scripting:
Cross-site scripting is a type of exploit, usually involving ActiveX and Java code, which involves malicious code being silently downloaded onto the user’s machine without their knowledge or permission. Cross-site scripting attacks are usually designed to hijack the user’s PC and redirect it to a malicious site where the user’s data will be stolen, or the PC recruited into a botnet.

Content Filtering and Liability Issues:
Another aspect of web security involves managing the kind of content that users can and cannot access on the business’s computers. A big part of the web security challenge is to keep employees focused on work-related surfing rather than shopping and other leisure pursuits. When employees visit inappropriate sites, they’re not only stealing productivity from your business, they’re also exposing the business to lawsuits. If an employee walks by another’s desk while they have offensive material or images on their screen, since the computer is a company resource,  the company is responsible for the consequences.

The key to effective web security is to provide a solution that protects the business first and allows the employees controlled flexibility in line with the company’s security policy.

Web Security Products and Information for Businesses:

Web Security SaaS Web Demo

Web Security SaaS Trial