Alliance Technologies

Description

"Hey Josh, where've you been?", I hear you all asking. Over the last several months, you might have noticed a suspicious absence of security folks from the wider blogging world. The reason for this is pretty much "Sorry, been busy", which I know isn't much of an excuse. So here's the deal. Security is hard. Its always been technically complex, but recent events have combined to create something of a perfect storm. We like to divide the world into "good guys" and "bad guys". In the past, it's been a fairly even fight. However, with the global economic recession resulting in staff cuts, there are fewer good guys. Of course, with small budgets, there have been cuts on the technology side as well. At the same time, advances in malware technology have given the attackers some extremely impressive tools. These advances have been made possible due to unprecedented cooperation within multiple groups of organized crime. So here we are, a reduced set of security practitioners trying to help businesses maximize security benefit for the dollar against a massive global network of highly skilled and highly paid criminals who are writing highly complex malware that goes far, far beyond your old school phishing attack with key logger. This post is going to focus on a specific type of financial attack. Odds are, if you're reading this, you're more interested in protection than the technical stuff, so we'll break tradition and leap straight into that. If you're interested in hearing more about what this particular malware can do, there are technical links at the bottom of this post. For now, know that it's a highly complex piece of financial malware which exists to steal money in any way it can. It runs on all versions of Windows and most common browsers. It'll come in via email, web, PDF files, USB or any way that the attackers come up with. Small businesses and nonprofits are being targeted because they tend to have weak controls, but CEOs and CFOs are also being targeted as they tend to have to more to lose. Protections: Within the industry, we often talk of security tradeoffs. Basically, there are costs to reducing risk... and these often go beyond mere dollars. My ultimate goal as a security consultant is to help a business make the appropriate decisions and balance security expenditure against the possible benefits. The following advice is what I believe to be true for most businesses, but please keep in mind that your particular business may have different requirements. To keep things simple, here are five technical and five financial recommendations. T1) Use a dedicated system for financial transactions. Yes, it's expensive, but a lot less expensive than having your money stolen. If you use the same computer to transfer money that you use to play Mafia Wars on Facebook, you're just asking for trouble. If you're using a shared system that's not locked down, you might as well just cut the attacker a check... it'd save time. T2) Use a dedicated firewall. Put a firewall between the dedicated financial workstation and both the Internet and internal network. Set it to use NAT and allow no traffic to flow from the Internet to the workstation.

Products & services

Similar companies nearby