* Organizations need to focus more on the critical issue of malware
IronPort recently published a report showing that Trojan horses and system monitors – two of the most serious types of malware – infect one out of every 14 corporate PCs. That means that in an organization of 1,000 desktop PCs, there is an average of 70 computers that represent a major security risk.
The report also showed that PCs in North American organizations have the highest infection rate of this most serious class of malware – almost 10% – and that French desktops have the lowest infection rate. Dwarfing Trojans and system monitors are less serious types of malware, such as adware and tracking cookies, which infect 48% and 77% of PCs, respectively. Here again, PCs in North America have the highest infection rate.
As evidence of just how serious these threats can be, in mid-September Sunbelt Software discovered a serious vulnerability in Internet Explorer that lets criminals install a variety of malware on a PC, including the BigBlue keystroke logger, various types of adware, the Spybot worm and the VXGame Trojan.
In addition to capturing keystrokes that can lead to the loss of passwords, credit card numbers and the like, BigBlue also captures data from instant messaging sessions and e-mail clients, logs the Web sites its victims visit and captures screenshots, Webcam images and sound data for PCs that have these capabilities.
There are two critical issues to consider when it comes to malware. First, and most obviously, is the very serious potential for loss of corporate data if malware somehow infects the PCs in your organization. Losing passwords and confidential data could lead to a serious loss of reputation, financial losses and a host of other critical problems. Second, as IronPort points out in its report, the only way to rid a PC of some types of malware is a complete reinstall of the operating system. That can lead to major disruptions to IT staff and lost employee productivity as they wait for their PCs to be fixed.
Malware is a serious issue that must be addressed alongside viruses, worms, spam and other threats, but one that many organizations focus on less than they should.
