Ensure employees don't bring viruses back into the workplace

Published on Tuesday 28 March 2006 02:07

WHAT do Melissa, Lovebug and Code Red have in common? They are viruses spread by e-mail that caused havoc in computer systems at home and in the workplace. These viruses and "worms" were designed to target the greatest number of machines in the fastest, most destructive way.

In the past, the hacker was profiled as a lone teenage male seeking to infiltrate a major business's computer system. Occasionally, this would cause major damage. However, a new breed of hacker is emerging. The "thrill seeker" is being replaced by organised gangs of criminals, intent on stealing millions of pounds.

Tools to build viruses are freely available on the web. The new phenomenon of "spyware" - software embedded into programs that gathers information but masks its presence from commercial anti-virus products - can be used to gain access to company systems.

Organised gangs from eastern Europe are suspected of utilising such tools to remove millions of dollars from large organisations undetected. Last year, there was an example of an employee in an Indian call centre who sold customer lists on the black market.

Despite the high-profile attention that hackers draw from the media, the biggest threat to IT security in any organisation has always been staff. One might be wary of the threat from disgruntled employees, but what about those working from home?

The benefits of flexible working practices are widely understood and the number of permanent home workers in the UK stands at over 2.5 million.

Until recently, organisations have assumed that laptops living inside the company's network are automatically protected even when staff are working outside the physical parameters of the building.

But one of the biggest security threats to any organisation comes from staff using laptops as their home PCs. Outside of the safety of the organisation's firewall, laptops are subjected to viruses and spyware.

A recent AOL/National Cyber Security Alliance study showed that over 80 per cent of home PCs lack at least one of three critical protections: updated anti-virus software; spyware protection and a properly configured firewall.

However, improving the security of the domestic laptop or PC on a national scale is a daunting and long-term task. One way it could be done effectively would be for the procurement department to negotiate additional licences for staff, which could be purchased by them at a discounted rate for use on home PCs.

Fostering awareness among staff can only contribute to a broader and more inherent understanding of security and move to a more efficient security culture. Organisations should also be working towards "adaptive perimeters" to address this issue, meaning that security levels increase when employees are working from home and lower again when inside their employer's building.

Companies should be acting now to unify the day-to-day operations and strategies of their anti-virus management teams and security management information teams, to converge their "anti-ware" products.

Unified attacks require a unified defence to keep ahead.

• Simon Perry is the vice- president of security strategy with CA EMEA