Establishing Digital Trust: Don't Sacrifice Security for Convenience
The UK has risen from the 8th most attacked country worldwide in February 2002 to the rank of 2nd one year later, and Italy has moved up from the 14th position to 4th, while France's ranking plunged from 4th to 16th. Furthermore, the verifiable and successful digital attacks against the U.S. remain at an all time high of 43,802 with the UK at 7,516, Italy at 4,945 and France at 2,920.
"There is an emerging correlation between digital attacks and physical terrorism," said DK Matai, executive chairman of mi2g. "We had noticed a sharp rise in digital attacks against Australia before the Bali bombings and against Italy before the arrests of terrorists from Morocco and Pakistan. Although the hackers and terrorists may not be part of a single command and control structure yet, they do appear to share a common ideology."
Despite the proliferation of digital attacks against the U.S., there were no new entries to the list of "Dirty Dozen" viruses, compiled by Central Command, Inc. Worm/Klez.E once again topped the charts, and Worm/Badtrans.B made a re-entry, first appearing on the list in November 2001.Steven Sundermeier, product manager at Central Command, Inc., comments: "Unforutnately, the biggest new virus stir this month was created for an Internet worm that was never seen outside a virus lab, the so-called Catherine Zeta Jones [W32/Igloo.B] worm."
According to Central Command, the worm utilizes the file-sharing program Kazaa to spread, copying itself on the infected machine under a long list of filenames including Britney Spears, Shakira and Pamela Anderson.
|February 2003 Dirty Dozen|
|1.||Worm/Klez.E (incl. G variant)||34.3 percent|
|Note: The table represents the most prevalent viruses for February 2003, number one being the most frequent.|
|Source: Central Command|
In addition to the increases in digital attacks, the UK has made itself susceptible to security breaches as NTA Monitor finds that customer data has been exposed to a number of e-commerce flaws.
The research, conducted from October 2002 to January 2003, revealed that Web server flaws, poor authentication mechanisms and faulty log-out facilities are the most widespread problems, with most flaws caused by relatively basic mistakes. From the total number of risks discovered, 4 percent were high-risk, 23 percent were medium risk, 39 percent were low risk and 34 percent were informational. NTA Monitor's evaluations indicated that:
- Half of all customers tested had one or more high-risk vulnerabilities
- Two-thirds had four or more medium risk vulnerabilities
- Two-thirds of those tested had six or more low risk vulnerabilities
- Two-thirds had six or more informational vulnerabilities
Users most at risk from the flaws are those using public access terminals, where the next user is able to see personal information provided, or continue the session with full access to the account. NTA Monitor defines the risk levels and flaws:
- High: lack of security behind the 'front door' exposing 'root' access Web server flaws, giving hackers access to critical systems once they have gained entry.
- Medium: Logout facility doesn't work; site has predictable authentication tokens; server allows unencrypted access to server areas; authentication token cookie is cached on the disk; authentication fields are not obscured during entry; account lockout mechanism does not work.
- Low: No protection against keystroke loggers; weak password mechanisms; no ability to change passwords; account enumeration possible.