Indian buyer's guide to antispyware

By Anil Patrick | Jun 22, 2009

0 comments

Facebook

LinkedIn

Digg

As most Indian CIOs will readily attest, an antispyware strategy is not an easy task, considering spyware's ever-evolving nature. Many attackers use "blended attacks" that involve sending a spam email containing a link to an infected site. "Antimalware defenders try to block access to malware sites, but these sites keep moving, and in any case the attackers rely heavily on corrupting legitimate websites, making it difficult to rely on the reputation of a website in deciding whether to allow access," says Graham Titterington, principal analyst, Ovum.

So, what exactly constitutes spyware, and as a CIO, how do you go about buying an antispyware solution for the Indian business?

Understanding spyware

The generally accepted definition of spyware, also known as privacy-invasive software or potentially unwanted application (PUA), is any form of software that monitors a user's actions without his explicit consent. Spyware started out as a covert way to monitor user behaviour but has now taken largely criminal proportions.

Today, many spyware programs perform nefarious activity such as installing unwanted applications, stealing sensitive user information such as credit card details, hogging organizational bandwidth, relaying spam, changing network/client security settings and even assuming control of infected computers to launch distributed denial-of-service attacks.

Hindrances to spyware detection

Spyware detection and removal is difficult with the existing antivirus and antispyware solutions. When it comes to spyware detection, the traditional approaches rely mainly on detecting the code of known malware samples, aka "signatures". The underlying premises in these solutions are not in sync with the changing business and threat environment.

As Nugyal explains, the signature-based antispyware solution does not account for aspects such as dissolving the perimeter -- nor does it consider proliferation of alternate networks such as Wi-Fi, dial-up, infrared, Bluetooth and WiMax. "These solutions prove insufficient when dealing with aspects such as mass-scale bot infections and complex root kits. Today, social engineering through Web 2.0 vectors is highly evolved and difficult to detect. Yet another difficulty is the very quick hopping of C&C, phishing and suspect sites to new IPs," says Nugyal.

0 comments

Facebook

LinkedIn

Digg