Digital Edition

SYS-CON.TV
Gartner Attacks Overhyped Security "Myths"
Maybe the World's Not as Dangerous as It Seems

According to a presentation at the company's IT security event this week in Washington, DC, a report from Gartner said that the five most over-hyped security threats are, the company's opinion:

- Internet Protocol (IP) telephony is unsafe
- Mobile malware will cause widespread damage
- “Warhol Worms” will make the Internet unreliable for business traffic and virtual private networks (VPNs)
- Regulatory compliance equals security
- Wireless hot spots are unsafe
 
“Many businesses are delaying rolling out high productivity technologies, such as wireless local area networks (WLANs) and IP telephony systems because they have seen so much hype about potential threats,” said Lawrence Orans, principal analyst at Gartner. “We’ve also seen the perceived need to spend on compliance reporting for Sarbanes-Oxley hyped beyond any connection with the reality of the legislation,” added John Pescatore, vice president and Gartner Fellow.
 
Gartner analysts examined the status of each of these over-hyped security risks.
 
IP Telephony is Unsafe. The reality is that security attacks are rare for IP telephony. Preventive measures for securing an IP telephony environment are very similar to securing a data-only environment. IP telephony eavesdropping is the most over-hyped threat. Eavesdropping is unlikely to happen since it requires local area network (LAN)-based access to the intranet. The attackers must be inside the company because they have to be on the same LAN as the IP telephone that is subject to the eavesdropping attack.
 
Gartner analysts said companies can encrypt voice traffic to protect IP telephony eavesdropping, but typically it is not required. It is no more difficult to eavesdrop on voice packets than it is on data packets.
 
“Enterprises that diligently use security best practices to protect their IP telephony servers should not let these threats derail their plans,” Mr. Orans said. “For these enterprises, the benefits of IP telephony far outweigh any security risks.”
 
Mobile Malware Will Cause Widespread Damage. In most cases, mobile malware will be a niche nuisance in the foreseeable future. Penetration of smartphone and personal digital assistants (PDAs) with always-on wireless to knowledge workers or consumers was about 3 percent in 2005. Gartner projects it to reach approximately 10 percent by the end of 2005.
 
“Anti-virus vendors see huge potential profit opportunities in selling security solutions to billions of cell phone and PDA users,” Mr. Pescatore said. “In particular, the anti-viral industry sees cell phones as the way to grow sales outside of a flat, commoditized PC market. However, device-side anti-viruses for cell phones will be completely ineffective.”
 
“The most effective approach to blocking mobile malware will be to block it in the network,” Mr. Pescatore said. “Companies should ask their wireless service providers to document existing and planned capabilities. By the end of 2006, all wireless service providers should be required to offer over-the-air mobile malware protection.”
 
“Warhol Worms” will Make the Internet Unreliable for Business Traffic and VPNs. A “Warhol Worm” is a worm that infects all vulnerable machines on the Internet within 15 minutes. The “SQL Slammer” worm had a strong impact on the Internet in 2003, but this is the only observed example of a “Warhol Worm.”
 
Gartner analysts project that through 2007, the Internet will meet performance and security requirements for all business-to-consumer traffic, 70 percent of business-to-business traffic and more than half of corporate wide area network (WAN) traffic.
 
“Every organization should consider using Internet VPNs, and most should adopt them in some way,” said Mr. Orans. “Today’s Internet offers a low-cost, good-enough or better option to the data networks of traditional global carriers.”
 
Regulatory Compliance Equals Security. Regulations often provide a means to obtain funding for important security initiatives before incidents occur, but most regulations lead to increased reporting rather than increased levels of security.
 
“Regulations generally take more static looks at issues and generally don’t lead to higher levels of security in proportion to the spending required to meet the latter of the law,” Mr. Orans said. “The best way to increase enterprise IT security is to buy and build software that has fewer vulnerabilities, but there has been no regulatory focus on this area. Companies should focus on building stronger security processes, then document these processes to demonstrate regulatory compliance.”
 
Wireless Hot Spots Are Unsafe. Uneducated consumers can fall prey to wireless hackers, but enterprises can equip and educate their mobile workers with the tools and knowledge to mitigate these threats and increase business productivity via hot spot usage.
 
Gartner analysts said mobile users should seek out 802.1X protected access points because these points facilitate encryption between the mobile endpoint and the access point. Users can also use client-based software, such as solutions from AirDefense, AirMagnet or T-Mobile’s Connection Manager, that can validate the access point’s identity and thereby reduce the risk of connecting to a hacker’s access point.
 
“Mobile uses in hot spots should utilize their corporate VPN connection to protect traffic as it travels through the Internet,” Mr. Pescatore said. “Mobile users in hotspots should use personal firewalls and turn off file/print sharing to protect their endpoints from data theft.”
 

About Security News Desk
SYS-CON's Security News desk trawls the world of security for news of software, hardware, products, and services that seems likely to be of interest to infosec professionals and summarizes them for easy assimilation by busy IT managers and staff.

In order to post a comment you need to be registered and logged in.

Register | Sign-in

Reader Feedback: Page 1 of 1



ADS BY GOOGLE
Subscribe to the World's Most Powerful Newsletters

ADS BY GOOGLE

Big Switch's mission is to disrupt the status quo of networking with order of magnitude improvements...
Lori MacVittie is a subject matter expert on emerging technology responsible for outbound evangelism...
Dynatrace is an application performance management software company with products for the informatio...
In his session at 21st Cloud Expo, Michael Burley, a Senior Business Development Executive in IT Ser...
Having been in the web hosting industry since 2002, dhosting has gained a great deal of experience w...
NanoVMs is the only production ready unikernel infrastructure solution on the market today. Unikerne...
All in Mobile is a mobile app agency that helps enterprise companies and next generation startups bu...
CloudEXPO | DevOpsSUMMIT | DXWorldEXPO Silicon Valley 2019 will cover all of these tools, with the m...
SUSE is a German-based, multinational, open-source software company that develops and sells Linux pr...
Yottabyte is a software-defined data center (SDDC) company headquartered in Bloomfield Township, Oak...
Your job is mostly boring. Many of the IT operations tasks you perform on a day-to-day basis are rep...
Serveless Architectures brings the ability to independently scale, deploy and heal based on workload...
Technological progress can be expressed as layers of abstraction - higher layers are built on top of...
When building large, cloud-based applications that operate at a high scale, it’s important to mainta...
Whenever a new technology hits the high points of hype, everyone starts talking about it like it wil...
Every organization is facing their own Digital Transformation as they attempt to stay ahead of the c...
"Calligo is a cloud service provider with data privacy at the heart of what we do. We are a typical ...
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, disc...
Bill Schmarzo, Tech Chair of "Big Data | Analytics" of upcoming CloudEXPO | DXWorldEXPO New York (No...
Chris Matthieu is the President & CEO of Computes, inc. He brings 30 years of experience in developm...