Organizations Need 'Security 3.3' to Protect Themselves and Their Employees, Says Security Expert

DUBAI, UAE, January 06, 2011 (Press-News.org) In the battle against cybercrime, there is one indisputable fact: the bad guys are working harder, faster and smarter than the average web user. These organized criminal operations have an astonishing grasp of online human behavior and know how to use social engineering tactics and Web 2.0 technologies to lure users to malware. While users have become more aware of hoaxes and scams sent through email, they are still far too trusting of content sent from a "friend" or familiar organization on a social networking site. This new threat environment leverages Web 2.0 technologies and is far more advanced than today's users and the current defenses they are using, which means a whole new security approach is needed.

User 1.0 and Web 2.0 vs. Malware 3.2

Although email threats still exist, email is no longer the primary delivery vehicle for malware. There are two reasons for this: First, email security solutions have improved greatly. But more important, users have learned not to open suspicious attachments or click on URLs included in email from anonymous sources.

While the online community overall has become more aware of email scams, most people are still at the User 1.0 level when confronted with new web-based threats. For instance, many users still exercise poor security habits, such as assigning the same username and password to multiple online accounts. With the widespread adoption of Web 2.0 technologies, bad guys have a new way to bait users and distribute malware. In fact, these technologies have contributed to an acceleration of the threat lifecycle, allowing bad guys to quickly create, launch and evolve web threats to stay ahead of the defenses. If users are at version 1.0 and web technologies are at version 2.0 then, malware has advanced to version 3.2. And organizations need security 3.3 to protect themselves and their employees.

Social networking: A cybercriminal's dream

Social networking sites that leverage Web 2.0 technologies have become such popular targets for cybercrime for several reasons:

- It's where the users are. To be effective, cybercriminals go where they can find the most victims — and today, that means social networking sites. The number of Facebook users alone surpassed 500 million in 2010. And that number only continues to grow. In fact, today, more users have social networking accounts than webmail accounts.

- They can exploit trust. While the same user won't open an email from someone they don't know, they will "friend" people they don't know in real life and click on a URL sent from someone within their network. This blind trust is a golden opportunity for bad guys that just need to acquire login credentials to reach all "friends" of the victim. This trust is key to spreading malware through social networks.

- Social networking is no longer just social. It's now a common communication tool for businesses of all sizes. In fact, 70% of small and medium-sized businesses rely on Facebook, LinkedIn, YouTube and other social media for essential business services such as customer communication, training videos and content distribution. But in 2010, 30% of all small and medium-sized businesses were infected with malware spread through social networks — a strong indication that traditional firewall and desktop anti-virus protection is no longer adequate to block these threats.

Is there such a thing as safe social networking?

Yes. But you need more than the average security portfolio to achieve it. Safe social networking against the backdrop of the new threat environment requires an aggressive security strategy that goes beyond firewalls and desktop anti-virus. Here are a few key rules to keep in mind to take your security solution to version3.3 and stay ahead of the cybercriminals.

Three Requirements for Security 3.3

First: Proactive web filtering is critical.

The vast majority of today's attacks use the web to host malware. These schemes drive users to infected URLs through a variety of routes, including manipulated search engine results, spam and social networking recommendations or "likes." Comprehensive Web filtering provides a front line of defense to block links, scripts and other techniques that either trick users with fake offers ("Update Your Video Player" or "Your Computer Is At Risk") or automatically cause the computer to connect to a malware source, botnet or spyware "phone-home" site that collects stolen login credentials, user information and other sensitive data.

By identifying the URLs of "phone-home" sites, comprehensive web filtering also enables you to identify and clean compromised systems before the attack spreads. In other words, web filtering helps increase your visibility into the various sources of malware and phishing attacks and protect your network and users from those attacks.

Second: Move at the speed of malware.

Real-time threats require real-time security. But traditional security solutions, including desktop AV and firewalls, is simply no match for today's complex, fast-moving blended threats — some of which can change in as little as two hours. So if your security approach relies on users to download and install the latest security updates, you're already at risk of attack.

Cloud-connected communities have emerged as the most effective way to quickly identify and block malicious threats in real time. Communities draw on the intelligence of millions of worldwide users through real time URL requests, so as soon as one member encounters a threat, everyone in the community is notified and automatically protected from that threat. Instead of fighting billions of web threats alone, community members benefit from the safety in numbers and on-demand via the cloud security intelligence.

To keep pace with a rapidly evolving threat landscape, the defenses in cloud-connected communities can be seamlessly expanded to protect against the new and emerging threats. These defenses can be available to users without requiring manual downloads or updates, ensuring business have the latest protection at all times.

In addition to cloud security and web filtering, security best practices dictate the need for malware scanning at the web gateway. Large enterprises have used this strategy for a while, but these solutions have been price prohibitive for SMBs. The good news is that affordable, enterprise-class solutions are now coming on the market.

Third: Don't expect end users to be security experts.

End users, no matter how security conscious, are the number-one security risk in any organization, so don't leave the security of your business data up to them. While user education is important, you have to ensure your employees are protected, wherever they work, at any time. Social engineering tactics that entice people to download malware through the latest celebrity or disaster videos, cheap goods, online pharmaceuticals and more will continue to evolve as today's scams become less effective. Remember: malware will always try to be two giant steps ahead of your users. It's up to you to ensure a user's poor judgment doesn't put your business at risk.

Why is all this necessary?

As more businesses like yours adopt social networking for communication purposes, the lines between business and personal use will continue to blur. To ensure your business can benefit from Web 2.0 technologies without exposing them to the risk of malware 3.2, you need a security 3.3 strategy in place. A security approach that combines a cloud-based intelligence community with real-time web filtering and malware scanning at the gateway is critical to maximizing the business benefits of social networking while minimizing the security risks.

About Blue Coat Systems
Blue Coat Systems is the technology leader in Application Delivery Networking. Blue Coat offers an Application Delivery Network Infrastructure that provides the visibility, acceleration and security required to optimize and secure the flow of information to any user, on any network, anywhere. This application intelligence enables enterprises to tightly align network investments with business requirements, speed decision making and secure business applications for long-term competitive advantage. Blue Coat also offers service provider solutions for managed security and WAN optimization, as well as carrier-grade caching solutions to save on bandwidth and boost the end-user Web experience. For additional information, please visit http://www.bluecoat.com.

FORWARD LOOKING STATEMENTS: The statements contained in this press release that are not purely historical are forward-looking statements, including statements regarding Blue Coat Systems' expectations, beliefs, intentions or strategies regarding the future, and including statements regarding the capabilities and expected performance of Blue Coat Systems' products. All forward-looking statements included in this press release are based upon information available to Blue Coat Systems as of the date hereof, and Blue Coat Systems assumes no obligation to update any such forward-looking statements. Forward-looking statements involve risks and uncertainties, which could cause actual results to differ materially from those projected. These and other risks relating to Blue Coat Systems' business are set forth in the Securities and Exchange Commission reports filed by Blue Coat Systems, including but not limited to the risks described in the most recent reports on Form 10-K and Form 10-Q, particularly under the heading "Risk Factors."

Blue Coat, ProxySG and the Blue Coat logo are registered trademarks or trademarks of Blue Coat Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document are the property of their respective owners.

For more information, please contact:

Manal Abi Rafeh
Regional Marketing Manager ME & Turkey
Blue Coat Systems ME
Telephone: +971 4 3911620
Fax: +971 4 3911635
Email: manal.abirafeh@bluecoat.com

Media Contact:
Colin Saldanha
PR Consultant
PROCRE8
Dubai - UAE
GSM: +971 (50) 6400762
Email: colin@procre8.biz