Last month I kicked off a post focusing on the top endpoint security stories in the past month. This month brought a number of endpoint security events ranging from the latest Microsoft zero-day vulnerabilities without a fix to botnet and phishing news. The theme of the month is that both individuals and corporations are simply losing the battle against online criminals when it comes to desktop security.
- Sept 1, 2009 – IIS FTP flaw announced with exploit code
Microsoft kicked off the month by confirming the publication of exploit code for the IIS FTP vulnerability that could allow remote code execution on affected systems. The vulnerability affected systems running the IIS web server and was particular dangerous to FTP servers that had anonymous accounts for uploads. Continue reading this post…
I’m here this week in Boston, MA attending the IANS 2009 New England Information Security Forum. It’s a great, interactive conference of security professionals sharing their experiences and observations of the current environment for enterprise security. Here are my thoughts from Wednesday’s sessions.
The IANS founders kicked things off with some into “keynote” observations.
- Signs of economic recovery may bode well in the fight against crimeware. According to the founders (I am not sure I completely agree yet) economic indicators (using the Dow and NASDAQ) show that we are back to where we were this time last year. The founders made a point that a tough economy is correlated to an increase in crimeware. Continue reading this post…
Anti-virus simply isn’t effective anymore at providing desktop security. We have posted on this topic quite a bit recently, but it seems to have an endless supply of new information and postings that support the growing trend away from reactive, signature dependent anti-virus.
Consider the recent post from long-time industry expert, Robin Bloor, titled The Beginning of the End For AntiVirus. Robin has been a long time advocate of moving away from a clearly broken anti-virus technology and moving toward a more proactive solution that can solve the problem of zero day threats and root kits. He had this to say about the growth of whitelisting and the fall of AV in his article: Continue reading this post…
This week we published a research report conducted on our behalf by Dimensional Research titled “Anti-Virus and Anti-Malware: A survey of IT Professionals.” The results are illuminating. It is clear that dissatisfaction with existing desktop security is at an all time high, but that people feel locked into a solution without alternatives.
Last week, I highlighted Gartner Group Analyst, John Pescatore’s call to start over again on desktop security and it appears that the over 200 IT professionals that we surveyed agreed. 52% of the respondents to our survey indicated that they were considering discontinuing blacklist anti-virus all together. Given their lack of faith in its effectiveness and their concern over the performance impact of an increasingly bloated application, it should be no surprise.
We will be talking about these and many other trends in a webinar next week presenting the details of the survey. I hope that you are able to join us and begin participating in the discussion of how to start over on desktop security.
Last week Microsoft issued an advisory on a new vulnerability with the IIS FTP service. This vulnerability already has a published exploit and can result in allowing the attacker to execute unauthorized code on the target. Details of the vulnerability are available at the US-CERT website. If you have an anonymous account on your ftp server then you are especially at risk because no theft of credentials would be needed to execute this exploit.
To me the key to this issue is that a fix won’t be included in today’s Microsoft security patch release. There simply wasn’t enough time to identify, code and test the patch before it was released. Microsoft complained that the security researcher didn’t report the vulnerability responsibly. While this may be true, it certainly highlights the weakness of a desktop security plan that relies on patching and antivirus signatures. Continue reading this post…