Could keyloggers turn out to be the biggest IT security threat of 2006?

Security firm iDefense reported that 5 years ago, there were only about 300 keyloggers in existence. This year, 6000 new ones have been released almost doubling 2004's total. Criminals use the clandestine software to steal user details and impersonate them. This type of identity theft costs victims an average of $4000 and 81 hours to rectify the situation. Software keyloggers get installed through email or during Web surfing and imperceptibly send all keystrokes (and sometimes screenshots) to the criminals who created them. 2006 is poised to be a bad year as many keyloggers and rootkits continue to be undetectable and most criminals are adopting the practice by creating their own individual versions.

Rogers Communications accused of cover-up and profiting from criminal activity

Affiliates of terrorist organization Hezbollah cloned the mobiles of senior executives of Rogers Communications, including chief exec Ted Rogers. Even though the firm had technology in place to trigger alerts over suspicious departures in call activity, Rogers staffers were too frightened of inconveniencing bosses to do anything about the fraud according to the Globe and Mail

A law professor and a technology journalist investigated the story after one of them was billed $12,000 for calls she didn't make. Although the cell phone had been cloned, Rogers Communications refused to cancel the charges until the story was exposed by the Globe.

What type of employee are you?

A study conducted by McAfee and ICM Research in Europe 'discovered' that the actions of employees - either through carelessness, ignorance or malice - continue to place companies at risk. If you're a regular PULSE reader, you know that I'm a strong advocate of security awareness training as opposed to blaming employees for being stupid. Be that as it may, McAfee has come up with a handy dandy guide for compartmentalizing such employees:

The Security Softie - This group comprises the vast majority of employees. They have a very limited knowledge of security and put their business at risk through using their work computer at home or letting family members surf the internet on their work PC.

The Gadget Geek - Those that come to work armed with a variety of devices/gadgets, all of which get plugged into their PC.

The Squatter - Those who use the company IT resources in ways they shouldn?t (i.e. by storing content or playing games).

The Saboteur - A very small minority of employees. This group will maliciously hack into areas of the IT system to which they shouldn?t have access or infect the network purposely from within.

What better time to defraud good samaritans than the holidays!

2005 was a big year for natural disasters but it was also an opportunity for fraudsters to take advantage of the good will of charitable donors. Following in the footsteps of the criminals who set up fake charity donation sites for Tsunami victims, fraudsters recently hacked a UK-based Christian charity and stole the financial and transactional details of some 2000 donors.  They have already tried to impersonate charities while contacting some of the charity-friendly victims.

Most security breaches are never detected, but this one was. "We are all in a state of shock,? said Neville Kyrke-Smith, National Director at Aid to the Church in Need UK. ?Apart from the obvious distress to benefactors, we're concerned that our charity identity has been stolen. However it's the beneficiaries, those who need the money the most, who will ultimately suffer. I urge all charities to regularly review their website security and make sure all software is up-to-date."

As the number of non-profit organizations and charities grows and takes greater advantage of the Internet, we will be seeing more security incidents due to small or non-existent budgets for security and the rush to simplify the donation process. For more information, refer to my 2003 paper: Secure Philanthropy, from the White Papers link below.

Santa Claus Worm is infecting computers through instant messaging

The Santa Claus worm presents itself as a harmless image of Santa Claus and appears to be sent from someone known to the recipient. If victims click the file a worm is loaded on to their computer. The worm then sends the same message to everybody on that person's address list. The new worm joins 70 others already making the rounds through popular instant messaging applications from AOL, Microsoft and Yahoo.

Although this virus is more festive than malicious, others are not so jolly. With an instant messaging bot or worm, hackers can infiltrate, steal information and carry out denial-of-service attacks on corporate networks. more info on IM viruses.

Worth reading: How do you react to pop-up messages and security warnings?

As we all know, no security at all is better than a false sense of security. This has little to do with the following article, but it was my last opportunity to mention it this year. This article deals with cryptic messages that users are bombarded with on a daily basis. Do you know what to do when a program asks you to Allow or Deny access? Store passwords in memory or not? Remember this setting next time? Well, users all over the world are baffled, and the resulting confusion may lead to problems that will eventually culminate in that false sense of security. The article is well worth reading.

At a governance level, Informatica Corporation is a Canadian security firm with unmatched expertise in regulatory compliance, information risk management and corporate education. At a lower, more technical level, a diverse, high profile clientele trusts Informatica to secure Web sites, applications and workplaces. At every layer, Informatica protects information security and data confidentiality. Visit us at http://www.informationsecuritycanada.com/