Threat Protection Best Practices

CUNA’s E-Scan Website
August 5, 2010 | COMMENTS

It bears repeating—corporate networks face a barrage of threats, ranging from malware to accidental data loss. Users' endpoints receive the brunt of these attacks, and if they're not properly protected they can serve as a threat portal to the entire network. The following five best practices, provided by security software firm Sophos, offer tips to help you protect your endpoints and your network.

1. Control outbound as well as inbound content.

Data loss can be accidental or malicious. Human error, carelessness, or a lack of data security can lead to data loss, such as sending an e-mail attachment containing personally identifiable information to an unauthorized recipient. Most companies' firewalls are set up to block incoming traffic, but data is sent off network on common ports such as IRC, SMTP, and HTTP.

Stop accidental data loss by scanning content for sensitive information sent by e-mail or instant message, or saved on storage devices with automatic rules. Set up a file-matching rule that specifies an action based on the name or type of file a user is attempting to access or transfer. Set up a content rule that contains data definitions and specifies the action taken if a user attempts to transfer data that matches those definitions. Upon detection you may wish to alert the user to the sensitive content and ask whether the action is appropriate.

2. To protect against malware, block access to Web ports and scan traffic.

Sophos reports one new Web page infected every 4.5 seconds, making the Web the number-one vector of attack. Taking advantage of infrastructure vulnerabilities, attackers inject malicious code into legitimate Web sites. This malware then uses social engineering or browser vulnerabilities to infect visitors with the intention of stealing data, installing more malicious code, or silently recruiting the host system into a botnet.

Use real-time predictive malware filtering technology to scan all Web traffic, and identify both known and emerging zero-day malware. Use content-based filtering technology to analyze Web traffic to determine the true file type of content coming back from a Web site. Allow or disallow that traffic based on corporate policy.

3. Educate users about the dangers and safe use of social networking sites.

Social networking sites like Facebook and Twitter have become popular playgrounds for attackers who recognize users' tendency to instill a high level of trust in the sites and to share too much personal information. As a result, malware and data theft are presenting serious problems to users. During 2009, Sophos found a 70% rise in proportion of firms encountering spam and malware attacks via social networks.

Encourage employees and members to use social networking sites with the same level of caution they've learned to use with other Web applications. If your credit union allows the use of social media sites consider drafting a policy on handling information and using these tools. Users should also become familiar with and use the sites' privacy settings.

4. Encrypt sensitive data in use, at rest, and in motion.

Encryption is an integral technology to protect your organization's sensitive data. If a threat bypasses your antivirus, firewall, or other controls, personally identifiable

information is vulnerable. Data that's encrypted, however, is likely to be unreadable if it falls into the wrong hands.

Encrypt data on end user devices (smartphones and laptops), when it's sent over the network, and when it's stored. Provide passwords or exchange keys on a case-by-case basis among groups or individuals who require job-related access. Proper encryption also provides a “safe harbor” from data-breach disclosure regulations

5. Restrict use of removable storage devices.

Vulnerabilities are exacerbated by the ability to launch unauthorized software from removable storage devices like USB keys, CDs, and DVDs. Malware, like the Conficker worm, is becoming a major issue as these devices serve as vehicles for distribution. Of course, data can also be taken outside of an organization on these devices, and many recent high-profile incidents confirm how easily they can be lost.

Disable the auto-run functionality for these drives or remove them entirely from users' machines.

This article originally appeared on CUNA's E-Scan Online Research & Advice Portal. Reprinted with permission.