Porn-Surfing Execs Infecting Corporate Networks With Malware 151
wiredmikey writes "According to a recent survey of malware analysts at U.S. enterprises, 40% of the time a device used by a member the senior leadership team became infected with malware was due to executives visiting a pornographic website. The study, from ThreatTrack Security, also found that nearly six in 10 of the malware analysts have investigated or addressed a data breach that was never disclosed by their company. When asked to identify the most difficult aspects of defending their companies' networks from advanced malware, 67% said the complexity of malware is a chief factor; 67% said the volume of malware attacks; and 58% cited the ineffectiveness of anti-malware solutions."
Solution (Score:5, Interesting)
and 58% cited the ineffectiveness of anti-malware solutions."
So the majority of experts agree the existing solutions are ineffective. And yet the solution remains the same: Buy more of it.
OS Design failure (Score:3, Interesting)
So, none of this mentions the lack of a proper security design in the Operating System. When someone says run a program, it let it use this much ram, this much cpu, and this folder.... that should be it.
But no existing commodity OS lets you do that, does it? Until capability based security becomes the norm, this will never be fixed, and information security jobs will flourish.
Re:It's good to be the king. (Score:5, Interesting)
It's good to be the king. -- Mel Brooks, "History of the World pt 1"
Agreed. I'm one of the fortunate ones - my boss actually follows the rules, but I've worked in places where the boss is exempt from basic network security. One was a small business where the boss 'pays the bills', so he got to 'make the rules'.
When his customer database was deleted he fired his IT guy in a fit of anger. He lost a lot of money in a wrongful dismissal settlement, and lost all of his business. It might have been the IT guy who did it - but the lawyers obviously felt that 'I don't need a slow virus scanner' was more likely the cause. Or at least, reasonable doubt.
Re:malware and porn (Score:5, Interesting)
You don't think executives don't NEED those super important "power bars", do you?
And of course execs have admin privs on their PC. They don't know what to do with it, they don't know why they got it, but don't you dare even suggesting taking it from him!
Even as the CISO you get shouted down at the management meeting when you suggest something outrageous like that. What cheek! Those dumb techdroids having higher privileges on his PC than the CEO!
Yeah, we had a good laugh.
Re:It's good to be the king. (Score:5, Interesting)
"Why do we need backups, we have it all here, right? So why do you want to have it there, too? Do you want to steal our customers?"
I was actually asked that once.