Badware is getting really bad

StopBadWare.org, an initiative of the Oxford Internet Institute and the Berkman Center for Internet & Society at Harvard Law School, issued a report in early May showing that five Web hosting companies host about a third of Web sites that distribute malware and other malicious content to Web users.

StopBadWare.org analyzed just under 49,300 Web sites and found that iPowerWeb was the worst offender, with 10,834 Web sites that contain malware and other malicious content. IPowerWeb hosts more than 500,000 Web sites, and so their proportion of ‘bad’ sites may actually represent a smaller percentage of their total sites than for some other companies that made the list of worst offenders. As of this writing, I’m not sure what iPowerWeb is doing to remediate the problem, but I am familiar with some significant outages that may be caused by the remediation effort – one site that operates on iPowerWeb’s system with which I’m familiar has been down for more than five days as of this writing.

The StopBadWare.org report points out a couple of important issues for corporate decision makers. First, Web sites represent a major threat vector that many organizations do not yet protect against. Our own research shows that a significant proportion of organizations have not deployed any sort of protection against Web-based threats that can infect a user’s computer simply by visiting a site and taking no action, such as clicking on a link. Although the problem has been around for some time, the StopBadWare.org report serves to underscore the severity and widespread nature of the threat.

Second, even simple Web surfing can create huge problems for organizations of all sizes and it needs to be addressed. It’s critical for any organization – large or small – to deploy technology that can protect a network. These technologies include client-side antispyware tools, hosted Web filtering capabilities, on-premise Web filtering software and appliances, and other capabilities.