How Small Businesses
Can Tackle Big Viruses
By Patricia Fusco
Over the past week, a series of viruses — most recently
one known as Sobig-F — have infected e-mail systems worldwide,
resulting in millions of unwanted messages. To help small businesses
thwart future outbreaks of looming virus variants, SmallBusinessComputing
gathered advice from several industry experts.
Joe Hartman, Trend Micro director of anti-virus research for North
America, said there isn't a whole lot of difference between small
businesses and large corporations when it comes to protecting their
assets from worms, viruses and spam.
"Small businesses don't look very different from large corporations,"
Hartman said they all need protection at the gateway level and a
firewall, as well as software updates at the desktop."
Unfortunately, smaller businesses usually don't spend as much time
or money on IT security. Large corporations typically have dedicated
staff specifically tasked with protecting their networks, but smaller
businesses usually only have one system administrator, if that,
responsible for all aspects of networking and business communications.
Consequently, smaller businesses can't respond to threats as quickly
as large corporations, so worms and viruses tend to create more
mayhem with smaller networking systems.
Annie Chen, Trend Micro small business and consumer product manager,
said the company's goal is to develop products that are easy for
small business and home office users to install and implement —
putting small business networks on level ground with large corporations.
"We consider small businesses as those that connect 50 users
or less," Chen explained. "Medium-sized businesses connect
50 to 250 users, and large businesses connect more than 250 users.
It's important that our products help all businesses be able to
get help on the spot and isolate infected PCs when a worm or virus
strikes."
Hartman said network administrators need to make sure that their
systems are up to date with the latest patches when a new worm or
virus strikes.
"The most important thing is to make sure patches are updated
to prevent viruses from infecting PCs in the first place,"
Hartman said. "Also, make sure there's a desktop application
available to run automatic removal programs on infected PCs."
Toward this end, Trend Micro provides a free desktop scanner service
over the Internet. The application automatically removes viruses
from infected PCs. As of last week Wednesday, Trend Micro's scanners
had detected and removed 150,000 Sobig-F virus-infected files. The
virus spread at a record pace. According to Hartman, the good news
is that the faster a virus spreads, the sooner it disappears.
"Typically, the faster a virus comes on, the faster it disappears,"
Hartman said. The media helps because people know about major outbreaks
faster and users can get protection faster."
Live Fast, Die Young
Sobig-F seems to have lived a short, but destructive, life. The
virus, which was creating chaos throughout IT departments most of
last week, seems to have petered out over the weekend. Experts say
that this particular strain of strain of virus was the fastest spreading
seen to date.
America Online saw e-mail traffic nearly quadruple last Wednesday,
according to AOL spokesman Nicholas Graham. AOL scans e-mail attachments
at the gateway, checking for viruses. On an average day, Graham
said AOL scans approximately 11 million attachments. On Wednesday,
the staff scanned 40.5 million e-mail attachments and found 23.7
million were infected with viruses. Of those, 23.2 million were
infected with Sobig-F.
To help put the threat from Sobig-F in perspective, Symantec Security
recorded 4,516 submissions per day of the Klez.H virus at its peak
in April. At the outbreak of the BugBea.B worm in June, Symantec
reported 4,812 submissions per day. When BadTRans appeared in December
2001, Symantec received 3,709 submissions per day at its peak, which
evaporated into the ether seven days after it was discovered.
"While Blaster and Welchia primarily impacted large enterprises,
Sobig.F is predominately affecting consumers and small businesses,"
said Vincent Weafer, senior director, Symantec Security Response.
"Computer users should be reminded of computer security best
practices and should not open attachments unless they are expecting
them."
More Worms in the Works?
Security experts agree that the Sobig-F assault seems to have peaked
Wednesday afternoon, when the worm accounted for at least 70 percent
of all e-mail flowing around the world. But new variations of the
fast-spreading worm are said to be in the works.
Sobig-F is designed to die out on Sep. 10. That's leading many
analysts to suspect that the next variant will hit on Sep. 11 or
soon after. And if the looming variant builds on the malicious success
of Sobig-F, the damage done could be far worse than what most PC
users experienced last week.
Anti-virus software maker Central Command cautions PC users that
when particular conditions are met, the Sobig-F worm will attempt
to download additional components of the attackers choice. The pre-configured
conditions include performing tests to determine if the current
day is Friday or Sunday between the hours of 19:00 (7PM) and 22:00
(10PM) UTC time. When these conditions are met, the worm might attempt
to retrieve further instructions that may include downloading and
executing a backdoor hacker program. Backdoors can allow someone
will malicious intent to gain full control of the infected computer.
"The virus author(s) of Sobig-F have developed a predictable
pattern of releasing new variants soon after the current version
de-activates itself," said Steven Sundermeier, Central Command
vice-president of products and services. "If the past repeats
itself we could be looking at a newly constructed creation shortly
after September 10th. A potential risk is that the massive army
created by the Sobig-F worm could be used to launch an all out attack
on large Internet infrastructures, for example, by means of a Distributed
Denial of Service attack (DdoS)."
In the Meantime
While the security experts continue to monitor all the potential
uses for creating such a large arsenal of controlled systems, they
highly recommend developing safe computing practices when handling
e-mail attachments to prevent future widespread infections.
Chris Neal, Sage research director, said the most effective way
to stop malicious viruses is to spread user knowledge as fast as
the worm.
"An IT manager can put a great security policy on paper, but
if there's no enforcement of the policy the next virus will slip
through the cracks," Neal said. "IT managers want software
makers to develop technologies that take users out of the process
providing a centrally controlled IT system that allows for fixes
to be pushed to end users."
But no such system exists at this time. Trend Micro's Hartman warns,
"viruses like Sobig-F are not going to go away. Hackers will
continue to look for security holes in software to launch new exploits
and software makers will continue to patch the holes." Chen
added that it's just like the flu season. "We offer flu shots,
but some people still get the flu," she said.
For now, the most effective way to stop malicious worms and viruses
is to spread user knowledge as fast as the worm. The most up-to-date
anti-virus protection is worthless if one user opens up an infected
e-mail packet.
Trend Micro offers a safe computing guide that can help businesses
of all shapes and sizes educate users about protecting their PCs
from worms and viruses. Small businesses might not have the IT staffing
to set up world-class security systems, but they can commit to educating
employees about e-mail threats.
The steps to protect small business PCs are simple and available
online — as long as you make certain to download or purchase
software from trusted, reputable sources. Install anti-virus programs
on PCs and keep them up to date. Get the latest patches and updates
for your operating system and servers and use them. Teach employees
to never automatically open e-mail attachments, and make backups
of important files.
End user knowledge, in tandem with keeping patches current and
desktop anti-virus programs up to date, offers everyone —
home offices, small business and large corporations alike —
the best of line of defense available against viral outbreaks like
Sobig-F.
Source: http://www.smallbusinesscomputing.com/webmaster/article.php/3067891
|
