10 security threats to watch for

There are lots of ways business networks can be compromised, and more are developing all the time.
They range from technology exploits to social engineering attacks, and all can compromise corporate data, reputation and the ability to conduct business effectively.

Here are 10 such threats and some suggestions on what to do about them. (For more security help, view a slideshow of 20 useful IT security Web sites.)

1. Virtual host security

Virtualization can help make more efficient use of hardware, but it also creates new security problems. In particular, it allows different virtual hosts to reside in the same physical machine where the traffic between them is difficult to monitor and screen.
The problem is compounded if virtual hosts replicate to other physical machines to meet increased demand for the services they provide. Rules for accessing these machines must accompany them, and this is complex, says Rob Whiteley, an analyst with Forrester Research.

"When you deploy virtualization at scale, it becomes a burden to manage the virtual machines," Whiteley says. Access control is still important in virtual environments, but tools for replicating it are scarce.

Click to see: Chart of 10 security best practices from the NSA

This can cause problems in regulated environments such the Payment Card Industry (PCI), which has standards for handling sensitive customer data. PCI standards specify what types of machines are not allowed to talk to each other.

There are three ways to deal with the problem. First, all traffic can be routed out of the physical hardware that contains virtual machines, scanned and then passed back into the hardware to reach another virtual machine. "That is a huge tax on the I/O system," Whiteley says.

Second, businesses can deploy existing software firewalls such as Check Point"'s on each virtual machine, but deploying, licensing and managing them is difficult because they were designed for real-world firewalling, not virtual world firewalling. "It"'s an operational nightmare," Whiteley says.

Third, businesses can turn to purpose-built products that are designed specifically for virtual environments such as those from Altor Networks, Reflex Security and Stonesoft, he says.