Malware numbers down but don’t celebrate just yet
By Davey Winder in Editorial
Posted in Data Protection, Blog, Security on
That would appear to be the conclusion of a new survey carried out on behalf of the Department for Business, Enterprise and Regulatory Reform, the early results of which have been released today. Although we will have to wait until next week for the full survey to be revealed at InfoSecurity Europe, the results seem both encouraging and worrying at the same time.
The 2008 Information Security Breaches Survey suggests that the number of UK companies reporting malware infection is actually down by as much as 60% when compared to just 24 months ago. This can be, fair enough, partly accounted for by improved anti-virus controls but at the same time we are told that two-thirds of the companies affected said that malware was responsible for their worst information security breaches.
One thing is clear, and that is the nature of the malware threat is certainly changing. The people writing the malware itself are increasingly sophisticated in their methods, especially when it comes to concealing their activities.
Still, on the happy happy side of the fence the survey does appear to be suggesting that malware is causing less damage than in the past, much less damage. The early figures that have been leaked out have a mere 14% of UK companies reporting a malware infection last year. That’s down from 35% two years ago, and it would appear that there are three main reasons for this:
- Corporate anti-virus defences have significantly improved with 95% of companies scanning incoming emails for viruses and 98% having software installed to scan for spyware.
- Most minor infections are no longer considered security breaches but as ‘events’ dealt with by routine controls.
- Malware itself is now just the first stage in enabling more lucrative attacks by hackers rather than infection being an end in itself. Which means it tries harder to remain undetected.
And on the not so happy side? Well, we are warned that despite the lower levels of infection, it’s a mistake to assume the malware threat is over. Chris Potter, a partner with PricewaterhouseCoopers LLP, who led the survey commented: “If there is one area of security where UK plc has really got the message, it’s virus protection. Only a tiny minority of companies don’t take this area seriously. The message from this survey is clear - if you haven’t got anti-virus and anti-spyware software, you’re way outside the benchmark. But, there remain some serious challenges. Companies now seem to be slower to install operating system patches than they were in 2006. Delaying patches can leave systems vulnerable to attack. On the other hand, rolling out patches instantly, without testing them first, can lead to systems instability. It’s important that companies strike the right balance here - risk assessment is essential.” While Dr. Guy Bunker, Chief Scientist at Symantec Corporation, one of the consortium members responsible for the survey, added: “While the results of the survey are encouraging, it’s clear that the battle between malware writers and companies continues unabated. Our recent research shows that there are over a thousand new malicious threats appearing each day. The battle is still on, it’s just changed from being obvious and high-profile to silent and obscure but is just as lethal. The motivation of malware writers has changed. Law enforcement in this area has improved around the world. As a result, the kudos derived from writing a disruptive worm to gain notoriety is outweighed by the personal consequences. Motivated by the money involved, organised crime is employing malware writers to write ’stealthy’ code that seeks to obtain confidential information or open security holes which can be exploited for financial gain.”
Rated: 100% (1 votes)
Loading ...Make a comment
Tag cloud
Archives
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
Most commented posts
- Cuil frozen out: market share drops to next to nothing
20 comments
- Windows XP: the invincible OS
- Gatecrashing the WiFi hotspot party
- The 24 year old software that is still going strong
- Home workers are sick
- Big Brother Apple
- Spear phishing Catch 22 for Salesforce.com
- Dumbest phisher in history revealed
- Is BT misleading consumers with Option 2 broadband?
- Why ecommerce fails
Highest Rated Blog Posts
- Why ecommerce fails (100%)
- Betting on Hubdub technology (100%)
- Chinese whispers as government implicated in UK hack attacks (100%)
- Crimeware toolkit targets 10,000 trusted sites (100%)
- Black Hat risk to migrating VMs (100%)
- Tough on cyber crime, tough on the causes of cyber crime (100%)
- Firefox 3, Beta 4, Enhancements 900, Tested 5 (100%)
- Slowly slowly catchee Government IT monkey (100%)
- Who needs another set of web standards? (100%)
- The 6.5 billion quid hello (100%)