security problems associated with the web

Evaluate the most significant security problems associated with the web. First, explain which threats are most significant and why. Next, discuss how identifying these potential threats can assist in the creation of an effective plan to mitigate these threats.

1. Malicious Internet content

Content like malware, worms and Trojans are easily picked up while surfing the Internet. Some sites will use drive-by downloads to install malicious content without you even being aware it ishappening. The vast majority of IT security threats are due to malicious content, accounting for 66% of global attacks annually, according to Kaspersky.

Solution: While a good anti-virus does play an important role in filtering this malicious content, it isoften not enough. If any malicious content finds its way onto your system it can disable your anti-virus and cut you off from online help. Stopping the content before it gains access to your system isessential. This can be done by blocking malware at the email gateway and scanning all incoming web traffic for malicious code.

2. Physical system attack

Straight-up system hacking is another IT security risk on the rise, as cybercriminals and sovereign nations profit from stolen corporate data. These attacks are based on finding a weakness in network access points and exploiting it. Once in your network hackers can then stage wider attacks or simply monitor and gather useful and profitable information.

Solution: To minimise the chance of these types of IT security threats businesses must ensure that all software, including operating systems and drivers, are patched and up-to-date. Even if you are using a patched and up-to-date version of Internet Explorer you may still be vulnerable to an outdated version of Adobe Flash, for example.

3. Distributed Denial of Service (DDoS) attacks

Once a trivial annoyance, DDoS attacks are now much larger in scale and cause massive disruption, leading to financial losses and reputation damage. These IT security threats work by flooding your online services with fake requests from compromised systems across the globe. This flood of traffic means that legitimate users cannot use your web services, meaning lost sales.

Solution: There are plenty of DIY solutions to DDoS attacks, but they will be limited in effectiveness by your ability to restrict the right packets of information – a tricky task. However, more sophisticated solutions, like Cloud DDoS mitigation, can help ‘scrub’ the incoming data before itreaches your system, helping to overcome the majority of successful DDoS attacks.

4.    Recycled threats

Many IT security threats are simply recycled to take advantage of lax policies, procedures and staff awareness. While a particular IT security threat may have been the hot topic of a year ago, many staff may have forgotten all about them by now, returning to their risky habits.

Solution: Keep staff regularly updated about the key IT security threats facing your company and remind them of the potential result if they let good habits slip – loss of account control and data loss, for example.

5. ‘Next Generation’ IT security threats

A spate of next generation IT security threats loom on the horizon, threats that are ‘sandbox aware’, for example, and are therefore able to bypass security software. IT security software uses sandboxed files to run various programs and monitor them for any malicious code. However, there have been several recent examples of malware detecting if it is running in a sandbox and ‘playing dead’ until itreaches a live target, effectively bypassing the sandbox security control.

Solution: Quite simply, do not rely on sandboxing as a silver bullet for negating IT security threats. Yes, it will certainly help to uncover many stealthy attacks and used alongside a good anti-virus itwill do a good job of protecting your system. That said, at the end of the day you cannot rely on itcompletely.