    
|
These days, many people use the Web as a natural extension of their day-to-day lives. Whether it is socializing with friends, keeping up with current events, conducting ad hoc research or watching movies, they can't get enough of the Web. We are well aware that the bad guys know this, too.
IT risk managers often preach the standard Web security advice for end users -- don't click haphazardly, uninstall plug-ins, change passwords frequently, use antivirus and so on -- but it never seems to stick. So, it's no surprise that the Web has become the No. 1 source of malware infections. This realization, along with other advancements in technology, has given rise to a flurry of new Web-borne attacks. Fortunately, there are also a number of new opportunities for mitigating risks associated with Web browsing, especially the risk of getting infected by malware.
Here's the thing to remember about malware: It has to be running to be destructive. This means there must be a process in memory using the resident system's CPU to perform its nefarious deeds. With this in mind, it is not hard to realize that the notion of which system the malware resides on becomes crucial to determining the extent of the damage from any infection. Separating that process from other production services can reduce that damage.
Separation -- and its stricter form, isolation -- are long-standing techniques to reduce risk in the realm of technology risk management. The military separates classified from unclassified systems using the "air gap" of separate physical systems or sometimes separate virtual machines. Enterprises have long separated networks using firewalls and other network devices. To achieve Payment Card Industry Data Security Standard, or PCI-DSS, compliance, companies often separate out-of-scope systems at the data level using tokenization.
One means of so-called situational separation is the sandbox. A sandbox is an isolated (usually virtual) environment that confines a computing program or process, limiting or preventing it from interacting with other programs or processes. Sometimes a sandbox is used as a fishbowl of sorts to watch and assess the activity of suspicious software. Other times, it is used in production to run either important functions like online banking apps or, alternatively, the less important, often risky operations that users enjoy. In either or both cases, separating the browser from the operating environment minimizes the impact that any malware infection might have.
Given this history, it should be no surprise to find that separation is useful for browsing the Web securely. An increasingly popular form of separation on the Web is the hosted browser, which typically runs on a completely separate physical system that interacts with the Web on the front end and completes the connection to the user by mirroring the activity to the user's device on the back end. In contrast with secure Web gateways that terminate connections, run some analysis and then forward approved packets in their original form to the end user, hosted browsers transform the content and pass it to the end user via proprietary protocols similar to the remote desktop protocol, or RDP, used for desktop virtualization. Hosted browsers provide benefits similar to those of a sandbox mentioned, though in Web-only form. Right now, they are more of a complement to analytical sandboxes that typically bring more threat research and response capabilities to bear. The benefits are clear: If a malware process only has access to resources on the browser's resident system, separating that system from high-value resources significantly restricts its ability to do harm.
In addition, hosted browsers provide anonymization capabilities by providing a clean browsing environment for every session.
Products that accomplish this include Check Point's WebCheck, Authentic8's SILO, Light Point Security's Light Point Web and Spikes Security's AirGap.
We are at a tipping point with information security where we must recognize that traditional techniques can only go so far in protecting users from Web-borne malware infections. It is time to employ other options for mitigating risk that reduce or eliminate user involvement while still protecting them. Separation models are well understood and the technology is advanced enough to provide this opportunity.
About the author:
Pete Lindstrom is principal of Spire Security, an industry analyst firm addressing challenges in technology risk management and cybersecurity economics. In his 20+ year career, Lindstrom has held other industry analyst positions at Burton Group and Hurwitz Group, as well as enterprise positions as a security architect for Wyeth Pharmaceuticals and an IT auditor for PwC and GMAC Mortgage. Lindstrom honed his finance and technology (and rifleman!) skills in the United States Marine Corps. He is a frequent speaker and writer on information security topics and is a director of the International Systems Security Association (ISSA). He has a finance degree from the University of Notre Dame.
|
|
|
|
The Yale University Astronomy
Department is pleased to invite applications for the first annual Hoffleit
Undergradate Astronomy Research Scholarship. This program serves as an
opportunity for keen undergraduates in STEM fields with a strong interest in
pursuing astronomy to spend 6-8 weeks performing astronomy research in with
Yale rearchers.
Research topics cover a wide range, from the characterization and discovery of exoplanets, the study of the Sun and stars, to the origin and evolution of small and large galaxies. Yale’s astronomy department is located in New Haven, CT, near historic downtown and the East Rock neighborhood. New Haven is a vibrant city in the summertime; home to the Arts and Ideas festival, many cafes and restaurants. The undergraduate students will be housed together in the beautiful campus residential colleges where they will have the opportunity to interact with undergraduate scholars from other departments.
The program encourages undergraduates from all nationalities to apply, particularly, those with a strong desire to continue to graduate school.
To apply or find out more, visit http://www.astro.yale.edu/vlg8/hoffleitfellowship.html
And direct any questions to valerie.robalino@yale.edu Subject: Hoffleit Queries
The deadline for applications is 15th February 2014 and offers will be made by March 1st. ]]>|
|
The
University of Pittsburgh Models of Infectious Disease Agent Study
(MIDAS) National Center of Excellence summer
research opportunity in computational modeling and simulation of infectious diseases.
Through this ten-week Summer Research Program, participants will gain an appreciation of major research questions being raised at the intersection of public health, biological science, and computer technology and become acclimated to the rigors of scientific research and graduate education.
|
|