Security 101:  Secure Your Data And Systems

Part 5: Viruses, Spam, Spyware/Adware and Phishing

All these are types of "malware" that can infect your systems to cause all sorts of mischief. We all hate the fact that these nuisances exist. However, tools are available to let just about anyone protect their systems reasonably well for a reasonable cost, and today, it is essential to protect yourself to reduce your vulnerability.

We'll cover a little about each of these below, but remember this is just a brief overview, not a comprehensive study of what each threat is about and how to stop it. If you're concerned about these types of threats and aren't sure you're protected, please let us know and we can help.


Viruses


We all know viruses are little programs that can infect systems and can cause various sorts of damage. The effects of viruses can range from the merely inconvenient to the severe - in worst cases, your personal or company data can be compromised or destroyed, and your systems can be rendered unusable.

The number of viruses out there is still increasing exponentially, but they are not usually as much of a risk as they were just a couple of years ago, due to the improvements in anti-virus software and the fact that most people are now running such software. However, diligence is still required on everyone's part

Every computer user today really MUST do the following:

Safeguarding Against Virus Infections

  • Purchase anti-virus software, use it, and keep it up to date
  • Be suspicious of e-mails from people you don't know, and don't open anything you don't trust. If it's important, they'll let you know.
  • Set your e-mail client to view e-mails as text only
  • If you suspect an e-mail is spam or contains a virus, hold your SHIFT key and delete it. This bypasses your "deleted items" folder and permanently removes the message and attachments
  • Don't send jokes, chain letters & similar messages on - they're not only a huge waster of time & Internet bandwidth, but they commonly contain malicious code as well. This is one of those times where if you're not part of the solution, you're part of the problem.



Spam


Spam is that annoying advertising that you get advertising all sorts of "personal care" products, cheap (likely bootlegged or fake) software, pharmaceuticals and the like. Other examples of spam include the infamous "Nigerian scam" e-mails which have proliferated. Remember, if it seems too good to be true....

Those ones are annoying, but the ones pushing pornographic content are offensive to many, and could conceivably cost your company money in claims for negligence if you don't take reasonable steps to protect your employees from it.

As well, spam can cost you huge amounts of money when your staff spends 10-15 minutes EACH, every morning just removing the spam.

While there is no silver bullet that stops all the spam and lets all legitimate e-mail through, you can protect your company from spam reasonably well by starting with the following tips (which you should pass on to your staff as well):

Safeguarding Against Spam

  • NEVER reply to spam messages by replying or clicking on the "unsubscribe" link. That just tells them they've got a live e-mail address, and they'll be selling it to other spammers today
  • Install spam-filtering software or hardware, or we can sign you up with the highest-rated spam filtering service available today for pennies a day
  • If you use Microsoft Outlook as your e-mail program, get a recent version and use the reasonably-capable spam / junk mail filter built in
  • Remove real e-mail addresses from your website and replace them with general ones you can replace every once in a while (like info@mycompany.com instead of a specific person). This reduces the chances of spammers picking up your e-mail address online using automated "bots" that search the web for them



Spyware / Adware


Spyware and Adware are a comparatively new challenge to most companies, but they're getting worse by the month. In 2004, spyware was a comparatively minor risk factor for most companies. Now, it's become even more of a problem than viruses.

At its simplest, spyware is a program that you inadvertently download and install from websites which are designed to a) collect and relay information about your web surfing or other more personal data (e.g., credit cards) to a third party, or b) to feed unwanted advertising to you as you surf the web.

This is more dangerous than it sounds, because you could compromise your personal or your company's data quite easily, and at the least, it will slow down your staff from doing their jobs - and could even make their PC unusable.

The most common types of sites that push spyware onto your systems are file-sharing & music sites (Kazaa and its ilk), shopping sites, and of course, pornographic sites, but other common sources include many children's content sites as well - sadly, children are targeted because they just don't know any better.

Spyware can be quite costly, time-consuming and complicated to remove, in part because the people who produce it are getting sneakier by the week, and in part because there's so much of it.

In the most severe cases, it may be necessary to format the hard drive and reinstall Windows - and this means there's a real potential for data loss.

Removing spyware could involve software like Spybot, Ad-Aware, SpywareBlaster, HiJackThis, etc., as well as a lot of very detailed manual editing of your systems' registry and other files. It's expensive. It's time-consuming. And it can put your data at very serious risk.

Here's a very brief list of what you can do:

Dealing With Spyware

  • Teach your staff that as soon as they start seeing odd behaviour (their browser suddenly has a new home page, ads keep popping up, etc.), they should report it immediately. The sooner we address it, the simpler and cheaper it is to repair
  • Although certain browsing habits are more likely to incur spyware (like illegitimate shopping sites, a lot of porn sites, music download sites like Kazaa and Grokster, etc.), there's usually no way to say for sure how a user got this spyware, so let's all just leave that question aside and get on with fixing it. If your staff thinks you're going to fire them for non-work-related surfing, they won't tell you there's a problem and it'll just get worse. However, this IS a time to remind employees that the Internet connection is paid for by the company, and therefore its use is for company business.
  • If the problem is chronic and friendly reminders haven't worked, it may be time for a formal Internet Usage Policy, which we can help you with. Beyond that, there's all kinds of technological tools available, though they tend to be expensive and a bit of a "big-stick" approach
  • Use up-to-date software (operating system, browser, e-mail software)



Phishing


Phishing is a very new take on an old concept: If you pretend that you're authorized and ask people for personal information, they'll provide it.

The most common form of phishing is when you receive a fake e-mail that APPEARS to be from someone legit (like e-bay, Paypal or your bank) and asks you to click a link there, go to their site and confirm your credentials - usually a credit card number or bank account information. The phishers then use that data to rack up charges on your card or take money from your bank, or for identity theft.

Here are a couple of things you can do to protect yourself from phishing attacks:

Common Sense Tips To Avoid Phishing Attacks

  • Remember that no legitimate company like a bank or government is ever going to ask for personal information by e-mail
  • If you receive a mail that looks anything like this, be VERY suspicious - it's almost certainly a fake, and if you provide the requested info, all the spammers will have it within hours (actually, seconds)
  • There are a few emerging software tools that try to combat phishing (Internet Explorer 7 has a phishing filter, for example), but to this point they're pretty simplistic. The best defense to date is your diligence and common sense


The Bottom Line

Other threats abound

So there you have it. A few of the more obvious threats described, and a few strategies to begin combating them. Obviously there are all sorts of other threats out there too - we can't hope to cover them all here. However, a lot of diligence and common sense can go a long way towards taking back control.


Call us today for a security review

If you would like to learn how you can cost-effectively control your company's risk from these types of threats, please contact us today, and we'll work with you to review your existing security procedures and identify areas that you could or should improve. When your business is at stake, security's something we all need to take seriously.