If you or your customers have been hit with a cross site forgery request (CSFR) and blended attacks using PDFs, you aren’t alone. These kinds of attacks and others have been steamrolling organizations with their malicious success. Recently HP's TippingPoint DVLabs, Qualys and SANS got together to put out a report on the top technology attack trends for the first half of 2010, which found that these kinds of attacks are hitting companies more often. Smart companies need to be vigilant to these IT security threats and take the proper measures to reduce the risk. And channel partners and IT solution providers looking to add value to their IT offerings would do well to keep these attack threats in mind and focus on the following eight best practices, as laid out by the report. Here’s how to protect your customers.
of
Move Them To A Whitelisting Model
One reason so many modern attacks are working is because organizations make it possible to download and run arbitrary code on endpoints across their infrastructure.
What The Experts Say: "In some environments with very focused computing tasks, switching to a smartphone model where only vetted and signed executables are allowed to run on the desktop can allow organizations to minimize the chance of infection."
Fine Tune Their Configuration Management
A default deny model is not always possible and takes time to develop—but that doesn't mean an organization should throw up its hands.
What The Experts Say: "As an interim measure to secure against attacks, DVLabs advises implementation of strong and comprehensive configuration management."
Build Security Into Web 2.0 Applications
As services keep moving to the cloud, attackers are increasingly shifting their sights to Web applications, looking for low-hanging vulnerabilities.
What The Experts Say: "Companies need to be very careful about moving more and more functionality onto the Web without ensuring its security."
Set Up Developer Education
Setting up security training for developers who code Web applications—supported by automated testing tools—will greatly diminish risk of attacks on critical applications.
What The Experts Say: "The potential impact of deploying new Web applications is rarely understood. Many times these applications directly access sensitive information, and if compromised, give attackers the means to steal this data quickly and easily."
Have Employees Log Off Websites Before Clicking Untrusted Links
A lot of CSFR attacks know that many users tend to stay logged into important Web sites and leverage that.
What The Experts Say: "In order to help prevent Cross Site Request Forgery attacks, it is important to log off of important websites prior to clicking links in email or on untrustworthy websites."
Patch Religiously
So many attacks today take advantage of well-known vulnerabilities. Automating your client's patching is one of the most effective ways of greatly reducing their risk of attack.
What The Experts Say: "It is more important than ever for organizations to have an accurate inventory of user applications and a defined patch strategy."
Establish A Point Man
Help your client identify one person to take responsibility for keeping up to date on vulnerability announcements and attack trends by subscribing to mailing lists and industry RSS feeds. Or better yet, become that point man for them.
What The Experts Say: "Organizations should designate specific security personnel with the job of monitoring public announcements of new vulnerabilities and widespread attacks."
Monitor For Anomalies
Attackers these days don't just announce themselves. Your customers have got to be on the hunt for unusual network behavior and other clues of attack in order to stop problems before they do real damage.
What The Experts Say: "Organizations should continuously monitor for anomalous and suspicious behavior on their computer systems and networks to detect attacks early on and minimize the damage."
Intel Technology Provider Program
Intel Technology Provider Program (ITP) helps resellers better understand Intel products which power the technology they sell, and enables value-add services such as remote manageability or anti-theft tracking. Learn More
WindowsForDevices.com
WindowsForDevices.com is the comprehensive news site covering Windows embedded technologies. Visitors get news, technical white papers, opinion columns and extensive directories covering the products and companies in the marketplace. Click Here
10 Key Ingredients That Have Made Apple So Successful
10 Reasons RIM`s New CEO Won`t Fix the Company
Eight IT Jobs Skills That Win Six-Figure Salaries
Social Media Best Practices to Land that Dream Job
Channel Executives On The Move: 2012
Why SOPA Is Such A Big Issue
See All Slideshows
