10 security threats to watch for

There are lots of ways business networks can be compromised, and more are developing all the time.
They range from technology exploits to social engineering attacks, and all can compromise corporate data, reputation and the ability to conduct business effectively.

Here are 10 such threats and some suggestions on what to do about them. (For more security help, view a slideshow of 20 useful IT security Web sites.)

1. Virtual host security

Virtualization can help make more efficient use of hardware, but it also creates new security problems. In particular, it allows different virtual hosts to reside in the same physical machine where the traffic between them is difficult to monitor and screen.
The problem is compounded if virtual hosts replicate to other physical machines to meet increased demand for the services they provide. Rules for accessing these machines must accompany them, and this is complex, says Rob Whiteley, an analyst with Forrester Research.

"When you deploy virtualization at scale, it becomes a burden to manage the virtual machines," Whiteley says. Access control is still important in virtual environments, but tools for replicating it are scarce.

Click to see: Chart of 10 security best practices from the NSA

This can cause problems in regulated environments such the Payment Card Industry (PCI), which has standards for handling sensitive customer data. PCI standards specify what types of machines are not allowed to talk to each other.

There are three ways to deal with the problem. First, all traffic can be routed out of the physical hardware that contains virtual machines, scanned and then passed back into the hardware to reach another virtual machine. "That is a huge tax on the I/O system," Whiteley says.

Second, businesses can deploy existing software firewalls such as Check Point"'s on each virtual machine, but deploying, licensing and managing them is difficult because they were designed for real-world firewalling, not virtual world firewalling. "It"'s an operational nightmare," Whiteley says.

Third, businesses can turn to purpose-built products that are designed specifically for virtual environments such as those from Altor Networks, Reflex Security and Stonesoft, he says.

Features to look for: whether the products scale well; whether the license structure is affordable; whether policies follow new images of virtual machines.

Another way to address the problem is involving network staff in server virtualization projects. This insures that traditional security measures that would be considered if physical servers were being added for virtual machines.

2. Protecting the virtual machine monitor (hypervisor)

If the software that keeps track of multiple virtual machines on a single hardware platform is compromised, so are all the virtual machines it tends. "There are no known threats, so there are no known remedies, but it"'s only a matter of time before someone hacks a hypervisor," Whiteley says.

Networks need to defend the hardware with firewalls and intrusion-protection systems (IPS) to keep known threats away from the hypervisor if possible. As for specific threats against the hypervisor, it is uncertain what products will work.

As a rule, seek embedded hypervisors that ship with server hardware because they generally occupy a smaller footprint, making them more difficult to break. The less code involved, the fewer places there are to find vulnerabilities.

3. Botnets

Botnets — millions of machines co-opted to do the bidding of a command and control center — have the potential to take down networks via coordinated attacks. Bot software is becoming more sophisticated, changing its form to be less detectable on zombie systems it takes over and with the potential to morph slave machines into command servers.

When they attack, bots can paralyze networks via denial-of-service (DoS) attacks, but businesses can take steps against the threat through agreements with their ISPs, says Greg Young, an analyst with Gartner. They have a better chance of recognizing traffic patterns that indicate botnets in use and of blocking them before they affect customer networks.
Users should also take steps to protect themselves against DoS attacks that botnets can generate within an organization. Using IPSs for networks and individual machines can help mitigate the impact of zombie machines that generate high volumes of traffic as bot zombies, Young says. (Compare Network Intrusion Prevention Systems.)

"There"'s no silver bullet," he says, but points to start-ups such as Damballa as focusing solely on bot detection and mitigation as a place to begin.

4. Targeted attacks

Because this is a broad category, it is the most difficult to defend against, Young says. These attacks are custom designed for individual businesses or employees of companies in an effort to gain access to valuable resources.
They may combine a number of techniques such as phishing, exploiting application or Web vulnerabilities and use of bots.

"One common element is they manipulate you to take action yourself [such as clicking on a bogus URL] in order to work," he says.

These attacks are most often launched for economic gain, which can range from stealing personal data for resale, compromising intellectual property or holding a business for ransom by demonstrating the ability to take down the corporate network. In the latter case, businesses may decide to pay ransom because it is less expensive than network failure.
The steps that businesses can take are a collection of best practices such as human resource screening to defend against disgruntled employees, service protection contracts with carriers to fend off DoS assaults, and employee education about social engineering ploys that could get them to compromise the network. 

5. Attacks via gaming and virtual reality sites

Attackers have developed exploits in multiplayer games that can take over a player"'s machine when the image of a malicious player crosses the screen, says Ed Skoudis, security consultant with Inteleguardians. This can take the form of bot-like control of the target machine, he says.

The exploit could also be used in virtual reality markets such as Second Life where participants can carry on transactions. "That attack vector is very fruitful," Skoudis says.

6. Browser threats

Public Web sites that are vulnerable to attacks can be seeded with malicious code that in turn attacks or takes over control of machines that connect to the site. This has the potential to undermine the networks that these machines are associated with, Skoudis says.