eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
The news from Symantec that acyber-attacker used an off-the-shelf Trojan called PoisonIvy to extract intellectual property fromU.S. chemical and defense industries as reported by eWEEK‘s Fahmida Rashid is more depressing than anything else.
The ease with which the hacker, named “Covert Grove” by Symantec, used crude social engineering to get employees at his target companies to open infected emails is equally disheartening. One has to wonder if the affected companies have learned anything about security over the last 20 years and if they have, whether they’ve done anything at all to train their employees.
The PoisonIvy Trojan is a well-known piece of malware that can’t infect a computer on its own. It requires someone to run the program and that the program be given administrative rights. To accomplish this, the Trojan is embedded in an email that usually tells the user that it’s a security update. In the example provided by Symantec, the email is signed by the “Department of Security.”
While PoisonIvy is designed to attack Windows machines, the same social engineering will work just as effectively inattacks on Linux or Macintosh computers if someone were to decide to attack companies using those computers. While I was told on no uncertain terms that Macintosh computers are immune to malware when I wrote that story last week, the fact is they’re not. The PoisonIvy Trojan requires the same user actions as Tsunami, and it works in very much the same way.
For any of these Trojans to work, what’s required are users who are not paying attention to what they’re getting in their email, and then clicking on the right button and filling in the information to provide administrator access, if they don’t already have it. This perfect combination of events points to a lack of proper security consciousness in the companies involved and poor or lazy IT practices when implementing computers for employees.
I almost hate to go through this again, because it’s clear that for these Trojans to have infected the companies they did, the security staff and the IT department weren’t doing their jobs. It’s also clear that the employees weren’t trained in even the most basic of security measures. So let’s go through them again. I’ll try to use short words and simple sentences so maybe this time it will penetrate.
C-Level Executives Must Take Responsibility for IT Security
First: No one should open an email attachment if they don’t know exactly what it is first. If a company sends out updates by email (which they shouldn’t) it should be a standard, easy to recognize format. Employees should not be allowed to install updates on their own.
Second: Employees should never be given administrative access to their computers. They should never be allowed to install software, including updates and applications, on their computers. Ever.
Third: The update process must be centrally managed. There are two reasons for this. One, it ensures that all updates work with the standard configurations of your company’s computers. Second, it keeps the employees from installing updates, including malware, but also updates that could break local custom software.
Fourth: Your company should disable USB ports on computers for all functions except things such as keyboards and mice. There is software available that will allow you to do this, and it keeps malware that’s transmitted by USB memory sticks from working.
Fifth: All employees who use computers in your company must be trained to recognize social engineering emails, phishing emails and other attempts to insert malware on computers. They should be given a contact in the IT department that will be a real person handling security. If there’s one attack, there are surely others.
Sixth: Security software needs to be installed and working on all devices, including mobile devices, it must be kept updated, and it must be set so users can’t disable it. Yes, it means a performance hit that some users won’t like. Those who complain about it should be told to get over it. Any performance hit pales in comparison to the productivity loss of having to recover your network from a malware attack.
Seventh: If you don’t already have C-level executive buy-in, then get it. Using the example of the chemical companies and their stolen intellectual property should be enough. But if it’s not, explain about the criminal penalties and the business risk if protected information is targeted by a Trojan in the network. Fines might not get the CEO’s attention, but the prospect of jail time might.
What’s so sad is that these steps have been known for years. There’s nothing new here, and there’s no excuse for failing to take them except for poor training, poor motivation, laziness or C-level executives too dumb to protect their companies. You probably can’t do anything about that last problem, except maybe find another company that’s run by people who care about security.