Beat cyber attacks with prudent vigilance

Jonathan Bowers, October 6th 2008, 12:13PM

An article last week about Princeton University research into the sophistication of cyber attacks reminded me just how important it is for online businesses to take their security seriously.

The great strength of the internet is its accessibility but unfortunately the trade off is that this can also be its vulnerability. Providing access to legitimate Web surfers also means potentially providing access to those who would wish to do harm. So it is vitally important for any online business to ensure that they are doing all that they can to protect themselves and their customers from malicious cyber attack.

Most of you reading this blog will probably be thinking that you are totally covered, that you have the right level of protection in place. However, I’m sure that this was what global business giants ING Direct, New York Times and YouTube were thinking as well. According to the research from the Princeton group, all three were found to be vulnerable to attack because of weaknesses in their website coding or configuration.

A common theme to the problems the three websites experienced was data extraction. Cyber attackers were able to obtain important information of visitors to ING Direct, The New York Times and YouTube, which could be later used to obtain further crucial private information.

The realisation that such major organisations can become open to attack is very troubling but by taking the right precautions you can stay ahead of the online criminals.

The first piece of advice in such a situation is always - be proactive. Keep up to date with cyber attack trends and technological developments. Review your security software to ensure it is up-to-date and equipped to deal with new styles of online attack. Old security software is a waste of time.

Second, make sure that access to your website is properly monitored and protected. You obviously have to allow online traffic access through your server portals but procedures can be put in place to block tell-tail unscrupulous originators. Arm yourself with effective zero day protection systems.

Finally, talk to your hosting provider. All good hosting companies have comprehensive security procedures in place to ensure that their clients are fully protected. Make sure that your provider is delivering the protection you need, including appropriate security shields such as Cisco Guard.

It is a constant battle to defend your website from the attacks of online criminals but with proper attention and the right hosting support you can win the fight.

Tags: coding, consumer_confidence, cybercrime, internet, online fraud, phishing, security
# Comment (2 comments)

Lies, damn lies and statistics

Jonathan Bowers, September 15th 2008, 5:42PM

Statistical surveys are interesting not just for the results they show but also for why they show those results. It is often said that stats can be made to support just about any contention depending on the timing, question wording, sample group etc. And I certainly give a lot of credence to such a view.

The UK Government holds to the laughable position of trying to convince us that a crime survey of a cross section of society is a more accurate reflection of crime in the UK than official police figures. No doubt this is because the perceptions of most of those surveyed are favourable to Brown and co. Then there is the SNP holding off on a vote for Scottish independence because they know that right now they would lose. For them timing is everything.

So why am I on about surveys? Well this week a survey from security firm Finjan http://www.safedns.co.uk/news/businesses-now-most-worried-by-cybercrime.html states that online businesses are now more worried about cybercrime leading to data loss than downtime. Don’t get me wrong, cybercrime is a very important issue that we at UKFast take extremely seriously. We use state-of-the-art security and firewall applications to ensure that our clients are totally protected. However, I am surprised that cybercrime would concern online businesses more than downtime.

The potential threat of downtime is at least as serious as cyber attack if online businesses use cheap and unreliable hosting. And downtime can be just as devastating to an internet business as a serious cyber attack. An online business needs to have a reliable online presence. If potential customers cannot access a website they can, and will, go to a rival at the click of their mouse. Then, once they have sampled the online services of the rival, they may never come back.

So we have considered the results, what about why the reasons for them. Firstly, businesses are rightly very concerned about cybercrime and data loss and so many would vote for it as the major concern at any time. However, other crucial factors probably included the spate of recent high profile news stories about UK Government data losses and the fact that the company carrying out the research is an online security specialist.

Online businesses should be serious about protection against cybercrime but they also should be serious about ensuring that downtime doesn’t happen. A dedicated server hosting solution will massively reduce the threat of either problem. For even greater reassurance, a total managed solution offers expert support and monitoring 24/7.

Tags: cybercrime, e-commerce, internet, security, websites
# Comment (0 comments)

Is some hacking justified?

Jonathan Bowers, March 6th 2007, 10:24AM

A former judge in California has been sentenced to 27 months in jail on Internet child abuse charges. The ground breaking thing about the case is that some of the evidence was provided by a Canadian hacker who planted a Trojan Horse on an Internet newsgroup visited by paedophiles that was then downloaded by 66-year-old Ronald C Kline.

In following the case, Sophos ran a poll to see whether the public thought that it was justified to use hacking in this circumstance.

The results of 233 votes show that almost two thirds believe that hacking is unacceptable in any circumstance. I wonder however what the results would be if another website ran the poll. We have to remember that people using the Sophos website are likely to have cyber crime on the mind and this could create a negative bias.

In order to catch a thief you often have to think like a thief and even behave like one. So should the laws be black and white when it comes to hacking. Could there be an acceptable use policy?

Tags: cybercrime, internetlaw
# Comment (2 comments)

A serious spate of security concerns?

Jonathan Bowers, July 25th 2006, 9:46AM

The technology headlines are dominated this week by security issues. Specifically in the UK, the government has produced guidelines to educate on the issue of cyber-bullying while globally the latest Sophos report reveals that Asian spammers are more now prevalent that US spammers for the first time ever.

The anti-virus companies are of course riding high on the reports. Symantec has teamed up with Yahoo to reach more users with its Norton software and Kaspersky labs is adding heat by warning us that malware is getting more sophisticated.

I think it is great that the government sees better technology education as a step to avoiding Internet crimes but I am often dubious when reports come out that are generated by the firms gaining the most from our heightened concerns. Often with no firm statistical evidence we are asked to accept that we are in more danger than ever before.

A quick search shows that we may be moving in this direction - the US Department of Justice is currently creating an extensive Cyber Crime survey to assess the impact on US businesses. It would be nice to see the UK government taking similar steps for the 1,500,000 businesses online in this country, not to mention the millions of home users.

Tags: cybercrime, security, spam
# Comment (0 comments)

How does your bank protect you?

Jonathan Bowers, April 18th 2006, 12:31PM

When you read statements like; "every day at least 400 credit card numbers are sold," it's easy to dismiss it off hand, that is until it happens. Then it feels like a real invasion of privacy, which of course, it is.

When looking for a new bank account or credit card provider, do you ask the provider what they are doing to counteract phishing and cyber crime? I'd imagine the majority of us don't - but soon it will be an obvious question.

But shouldn't it be the banks responsibility to inform us of how our information will be protected online?

There is an interesting post on Greg Hughes' blog about cyber crime targeting banks and what can be done about it. Greg builds anti-phishing software and is also a firm believer in prevention as protection and thinks the banks should communicate better.

I'd certainly prefer a better solution than banks issuing card numbers which are valid for single transactions only, which is actually one muted option.

The problem is that banks see a double edged sword. They refund stolen money but don't investigate, because the cost of investigation will often exceed the initial loss. They are also guarded about their security methods because they don't want to give anything away to the wrong people.

None of this however, builds the confidence of the spender who is between a rock and a hard place when it comes to finding the safest place for their money.

Tags: cybercrime, phishing
# Comment (0 comments)