(Chad Perrin, TechRepublic) Email security is about a lot more than just using a good password on your POP or IMAP server. Perhaps the most important part of email security is ensuring you don’t shoot yourself in the foot.

These tips focus on the ways users break their own security rather than on protecting against the predations of malicious security crackers. Security can be violated through careless acts more easily than by outside forces.
1. Turn off automated addressing features
2. Use BCC when sending to multiple recipients
3. Save emails only in a safe place
4. Use private accounts for private emails
5. Double-check the recipient, every time — especially on mailing lists

(Tom Brewster, ITPro) Malware levels have reached new heights as the first six months of 2010 proved to be the most active for malicious file activity on record, McAfee has reported.

There were 10 million new pieces of malware logged in the first six months of this year, while 6 million were discovered in the second quarter alone.

Threats were most likely to emanate from portable storage devices like USBs, while fake anti-virus software was the second most popular choice among malicious file spreaders. Social media-specific malware was the third most common basis for attacks.

(Robert McMillan, ComputerWorld) You know to keep your antivirus program and patches up to date, to be careful where you go on the Internet, and to exercise online street-smarts to resist being tricked into visiting a phishing site or downloading a Trojan horse. But when you've got the basics covered, but you still don't feel secure, what can you do?

Here are a few advanced security tips to help you thwart some of today's most common attacks:
1. Avoid scripting - This may be the one piece of advice that will do most to keep you the safe on the Web: steer clear of JavaScript, especially on sites you don't trust.
2. Back out of rogue antivirus offers - Rogue antivirus programs have emerged as one of the most annoying security problems of the past few years.
3. Sharpen your password game - People have to remember too many passwords on the Internet. Everyone knows this, but most of us get around the problem by using the same username and password over and over.Hackers know this as well, and they're happy to use it against you.

Read more by following the "full article" link.

(Ellen Messmer, Network World) Spam continues to grow largely due to the growth in malicious botnets. Many botnets are command-and-control systems used by criminals and are still the main way that spam is spewed into your e-mail box. A recent report states that the worldwide spam volume has now climbed to 230 billion messages per day, up from 200 billion at the start of 2010.

M86 Security has created the "Top Ten Most Wanted" Spam-Spewing Botnets list, many of them are believed to be controlled in Eastern Europe by criminals who manipulate compromised systems, mostly PCs, around the world to generate spam:
1. Rustock (generating 43% of all spam)
2. Mega-D (10.2%)
3. Festi (8%)
4. Pushdo (6.3%)
5. Grum (6.3%)
6. Lethic (4.5%)
7. Bobax (4.3%)
8. Bagle (3.5%)
9. Maazben (2.0%)
10. Donbot (1.3%)

Read more by following the "full article" link.

(Brad Reed, NetworkWorld) Like all good things, the increase in speed and power comes with greater risks: added data capacity, connection speeds makes 4G smartphones more vulnerable. This article describes what any smart IT department should know before allowing a 4G device onto its network.

The increased mobile data usage is only expected to intensify in the enterprise as more executives could try to use their favorite devices for both work and personal use. Mike Siegel, a senior director of product management at McAfee, says this will put a particular strain on IT departments' abilities to protect data across multiple operating systems and applications. "We have senior executives now who are pushing on IT to support Android or iPhone," he says. "With iPhone and Android, you have a propagation of applications that have connections back to sensitive corporate data in the cloud. So these devices now are very much a data leakage vulnerability."

What is to be done? Read more by clicking the "full article" link.

(Carrie-Ann Skinner, NetworkWorld) Cybercriminals sent 3.7 billion phishing emails over the last year, in a bid to steal money from unsuspecting web users, says CPP. 25% of Brits have been victims of scams, losing on average £285.

A new research revealed that 55% of phishing scams are fake bank emails, which try and dupe web users into giving hackers their credit card number and online banking passwords. Hoax lottery and competition prize draws and 'Nigerian 419' scams that involve email requests for money from supposedly rich individuals in countries such as Nigeria, were also among the most popular phishing emails.

CPP also revealed social networking scams are on the rise. Nearly one fifth of Brits have received phoney Facebook  messages claiming to be from friends or family in the past year. One in 10 fear that fraudsters are using Twitter to follow them, while a third are concerned their social networking account could be hacked.

"It seems that not a day goes by without a new case of online fraud hitting the headlines. But what's concerning is that consumers are still falling victim," said Nicole Sanders, an identity fraud expert at CPP.

(Mary Brandel, NetworkWorld) Cloud computing is one of the most-discussed topics among IT professionals today. And not too long into any conversation about the most highly touted cloud models - software as a service (SaaS), infrastructure as a service (IaaS) or platform as a service (PaaS) - the talk often turns to cloud security.

According to Milind Govekar, an analyst at Gartner, cloud has rocketed up the list from number 16 to number two in Gartner's annual CIO survey of key technology investments. "Like with anything new, the primary concern is security," he says. In fact, the vast majority of clients who inquire about cloud, he says, would rather create a virtualized data center on their own premises - what some call a private cloud - because they're uncomfortable with the security issues raised by cloud computing and the industry's ability to address them.

"We are in the early stages of a fascinating journey into a new computing model that, for all its purported advantages, from a security and risk point of view, is a difficult thing to deal with," agrees Jay Heiser, an analyst at Gartner.[...] For this reason securing cloud computing environments will be a major focus of vendor efforts over the next year, says Jonathan Penn, an analyst at Forrester Research. In the short term, he sees users having to do a lot of the legwork, but over time, "cloud providers themselves will see the opportunity to differentiate themselves by integrating security," he says.

(Chad Perrin, TechRepublic) Smartphones are becoming ubiquitous, but they are still limited in their usefulness. This is actually a boon for their security, at least for now — because they have not been effectively secured well enough to replace a desktop or laptop computer for a lot of high-risk activities.

With the growing popularity of smartphones, people are beginning to speculate about whether there will be an explosion of security issues in the near future. When will the storm of viruses appear? When will smartphones — relatively low-power by the standards of personal computers, but online pretty much all the time — become a platform of choice for botnet nodes?

Some security experts are skeptical of the idea that smartphones will ever be much of a target for malicious security crackers to build botnets, or otherwise hijacking resources. Maybe the botnet threat will never materialize for the smartphone platform, because it is so limited compared to the general-purpose desktop and laptop computer. On the other hand, even if malicious security crackers are not directly targeting our smartphones yet, the ability to transfer files between a smartphone and a more general-purpose computer means that a smartphone can become an important vector for spreading viruses and other mobile malicious code.[...]

(Tim Lohman, Computerworld) Almost by the day, enterprises are becoming more receptive to the consumerisation of IT and introduction of mobile devices and platforms into their environment. But introducing smartphones, netbooks or newer technologies such as the iPad and e-readers, can pose security issues to an organisation - and to any customer or business included in the data held on the devices.

Threats such as Trojans and drive-by-downloads which attack and exploit unpatched vulnerabilities in software installed on an endpoint, rogue security applications, spyware, botnets, worms, viruses and phishing attempts are all threats that apply as much, if not more-so, to consumer devices as office-bound PCs. And once commercial data makes its way onto an employee's device, which is often unmanaged, the enterprise can no longer control its spread or usage. [...]

IT managers must also bear in mind that while employee devices perform a dual role - as a personal device and a company device - the protection of any organisational data held on the devices is totally up to the company, says senior marketing manager for Websense, David Brophy.[...]

(Dancho Danchev, ZDNet) New research indicates that 1.3 million malicious ads are viewed per day, with 59% of them representing drive-by downloads, followed by 41% of fake security software also known as scareware.

More findings from the Dasient research:
- The probability of a user getting infected from a malvertisement is twice as likely on a weekend and the average lifetime of a malvertisement is 7.3 days.
- 97% of Fortune 500 web sites are at a high risk of getting infected with malware due to external partners (such as javascript widget providers, ad networks, and/or packaged software providers).
- Fortune 500 web sites have such a high risk because 69% of them use external Javascript to render portions of their sites and 64% of them are running outdated web applications.

The research’s findings are also backed up by another recently released report by Google’s Security Team, stating that fake AV is accounting for 50% of all malware delivered via ads.

(Linda Musthaler & Brian Musthaler, NetworkWorld) Symantec has published its annual in-depth threat report and recommendations on how to improve enterprise security.

Based on multiple sources, the report presents an in-depth view of what threats exist on the Internet today, and what the trends are over a span of years. For example:

1. There continue to be many targeted attacks on enterprise organizations.
2. Web-based attacks are still common, and they are the primary means to install malicious code on computers.
3. More than 240 million distinct new malicious programs.
4. Executable file sharing has become the primary means of transmission of infections, especially for viruses and worms.
5. Botnets are responsible for distributing 85% of spam.[...]

(Bob Hinden, eWeek) Businesses in all types of industries today are investing in data loss protection technology at increasingly higher rates because of the increase in corporate insider threats. As more employees utilize Web applications for real-time communications, data leak prevention has become even more complex.

The ease of sharing information, combined with real-time communications, makes many of these social networking tools very compelling. And such trends are expected to continue, with enterprise spending on Web 2.0 technologies projected to reach $4.6B globally by 2013. Businesses can't ignore the opportunity to increase productivity by leveraging these new tools.

But the Web 2.0 world has made security more complex, and organizations are looking for a comprehensive approach to security that reduces—not multiplies—the number of threats, as well as eases management and regulatory challenges faced by IT managers.[...] An effective Web 2.0 security strategy will complement network protection with comprehensive endpoint security, and allow organizations to easily integrate new security services on existing infrastructure without exhausting limited IT budgets.[...]

(Wolfgang Gruener, ConceivablyTech) MessageLabs has released a new issue of its monthly intelligence report, which reveals interesting statistics of spam originating from client computers that are infected by botnets. Not surprisingly, most spam comes from Windows users, but Linux systems are five times more likely to be sending spam than Windows. And: There is virtually no spam that is sent from Apple Mac computers.

Spam still accounts for nine out of ten emails (89.9%) sent, one in 341 emails contains malware and one in 455 emails carries a phishing attack. Spam is dominated by botnets that infect client computers around the globe and use their connectivity to send out emails.[...]The entire spam volume caused by all botnets currently monitored is about 121 billion messages per day from up to 5.6 million computers. Non-botnet spam is only 7 billion messages per day, bringing the total spam volume to just above 128 billion messages per day.

If we look at the PCs that are controlled by the botnets and that are sending the spam, and break them down by operating system, MessageLabs’ data shows, not surprisingly, that 92.65% of all spam came from Windows machines, 0.001% from Mac OS X systems and 5.14% from Linux computers in March 2010.

(Jamey Heary, PCWorld) With today's limited security budgets you need to be sure that you've adequately covered your highest risk areas before moving on to other things. Take a look at the top 5 security solutions you can put in place today to cover the widest scope of current and emerging threats.

These 5 items working together will stop more cyber attacks on your data, network and users than any other 5 items in the marketplace today. There are lots of other very useful security solutions on the market but when it comes to picking the top five most effective and readily available ones, here are the choices:

1. Firewall - without firewalls in place to drop unwanted flows, your job of protecting your assets increases exponentially;
2. Secure Router - routers are chock full of security features, sometimes even more so than a modern firewall;
3. Wireless WPA2 - if you aren't using WPA2 wireless security then stop what you are doing and form a plan to start doing so;
4. Email Security - a good email security solution will get rid of the junk and filter out the malicious stuff as well;
5. Web Security - web security needs more than just URL filtering.

Read the detailed description of these 5 items by following the "full article" link.

(Debra Littlejohn Shinder, TechRepublic) Many organizations focus on protecting against external attacks but ignore a threat that might be even more destructive: data theft by someone inside the company. Here’s an up-to-date look at critical areas of concern.

Hacker attacks that bring down the network get a lot of attention, so companies concern themselves with protecting against those threats. In this article, we’ll take a look at what you should be doing to keep your data from walking out the door.

1. Practice the principle of least privilege and put policies in writing
2. Set restrictive permissions and audit access
3. Use encryption
4. Implement rights management
5. Restrict use of removable media
6. Keep laptops under control
7. Set up outbound content rules
8. Control wireless communications
9. Control remote access
10. Beware of creative data theft methods

Read more by following the "full article" link.

(Veronica C. Silva, MIS Asia, NetworkWorld) A new report on consumer online behaviour and criminal activities on the Internet noted that new security threats have recently emerged, prompting the implementation of a mix of security solutions to protect unsuspecting victims.

Blue Coat's annual 'Blue Coat Web Security Report for 2009' released recently noted that security solutions are finding it difficult to keep up with the rapid attacks by cyber criminals. The popularity of social networking activities online is also making the Internet more vulnerable to recent attacks. The report noted that social networking sites accounted for 25% of activity among the top 10 URL categories last year. Web-based e-mail, on the other hand, dropped in popularity from fifth place in 2008 to ninth in 2009.

"The battlefield for information security against identity theft and cyber crime is the Web. The Web, and especially social media, is where the apps are, where the eyeballs are and, therefore, where the attacks are," said Andreas Antonopoulos, senior vice president and founding partner of Nemertes Research.[...]

(Dave Rosenberg, CNET) In this day and age of technological advancement and digital lifestyles, it's incredible to me that nearly half of a recently surveyed audience opened junk e-mail (aka spam), intentionally.

According to a new survey report, tens of millions of users continue to respond to spam in ways that could leave them vulnerable to a malware infection or bot network. The results of the survey show that nearly half of the users have opened spam, clicked on a link in spam, opened a spam attachment, replied, or forwarded it - all activities that leave consumers susceptible to fraud, phishing, identity theft, and infection.

(Kenneth van Wyk, Computerworld) Should it really be necessary for a consumer to be a security  expert to safely use a computer? We get disgusted that users keep falling for old tricks. But what are we doing to actually help these people?

We should start by better understanding the misconceptions about e-mail and Web site safety that pervade the user base. For example:

1. If an e-mail looks authentic, it is safe
2. This e-mail came from someone I know, so I know it's safe
3. If a friend on Facebook or Twitter posts a link, it's safe
4. If I merely view a message, without clicking on any attachments or links, I'm safe
5. If I go to the URL, but don't do anything while I'm there, I'm OK
6. If my browser displays the locked padlock, then the site is secure

Our systems - from their operating system cores and through the e-mail clients, Web browsers, etc. - need to help our users do things securely.

Read more by following the "full article" link.

(Bill Brenner, ComputerWorld) The security community has grown to depend on some basic technologies in the fight against cyber thieves. Here are four techniques and related technologies several cited as underrated in today's security fight.

1. Whitelisting
Application security is something companies increasingly worry about, as the number of business and personal apps proliferate. One of the more overlooked features of the technology is whitelisting - the art of allowing only traffic known to be valid to pass through the gate; thus providing an external input validation shield over the application.
2. Data encryptors and/or shredders
You need shredding machines to securely dispose of unnecessary or unscanned records and data encryption to protect the necessary scanned ones.
3. CPU stress testers
It seems that the current state of firmware security, even in case of such reputable vendors as Intel, is quite unsatisfying.
4. Firewalls and AV
Firewalls and AV may no longer get the glory, but many regard them as absolutely necessary parts of any network security posture.

(Mis Asia Writer, Network World) Global spam volume grows by 25 per cent. A new research revealed a surge in spam levels in February 2010 to make up 89.4% of all e-mails.

Spam levels in Hong Kong reached 90.6% and virus activity in China was the highest in the world in February, according to Symantec's latest MessageLabs Intelligence Report. In Singapore, one out of every 319.2 e-mails contained a virus in a period when the total spam volume globally increased by about 25%.

In February, the most spammed industry, with a spam rate of 93.1%, was the engineering sector. Spam levels for the education sector were 90.8%, 89.3% for the chemical and pharmaceutical sector, 89.8% for IT services, 91.1% for retail, 87.6% for the public sector and 88.4% for finance.[...]

(Steven Andrés, PC World) Whether your business is a big fish or a small-fry home office, you can get hacked just the same, and the stakes are higher than a few canceled credit cards. Here are a few tips to protect your users and your networks - steps that even enterprise-class security specialists may slip up on.

Steps for small businesses and enterprise-class security specialists:

1. Know Who Might Be Targeted - and How and Why
2. Don't Take the Bait
3. Use Unique Email Addresses to Keep Password Reset Emails at Bay
4. Don't click on anything in email
5. Patch Early, Patch Often
6. Don't Let Bob Stop You From Running a Secure Network
7. The P of P2P Is Personal, Not Business
8. Nail Down Your Network

Read more by following the "full article" link.

(Ellen Messmer, Network World) Botnet attacks are increasing, as cybercrime gangs use compromised computers to send spam, steal personal data, perpetrate click fraud and clobber Web sites in denial-of-service attacks. Ranked by size and strength, these article presents the 10 most damaging botnets in the U.S.

1. Zeus
Compromised U.S. computers: 3.6 million. Main crime use: The Zeus Trojan uses key-logging techniques to steal sensitive data such as user names, passwords, account numbers and credit card numbers.
2. Koobface
Compromised U.S. computers: 2.9 million. Main crime use: This malware spreads via social networking sites with faked messages or comments from "friends."
3. TidServ
Compromised U.S. computers: 1.5 million. Main crime use: This downloader Trojan spreads through spam e-mail, arriving as an attachment.[...]

Read more by following the "full article" link.

(Lance Whitney, CNET News) "Bomb Blast." "Jackson is still alive: proof." "Obama cursed by Pope." These are just a few of the subjects used by cybercriminals last year to trick people into opening malware-infected e-mails.

Spam that uses the latest news headlines was just one of the hot trends last year in the world of cybercrime, according to McAfee's "Q4 Threats Report", released Tuesday. The latest threat assessment also noted a rise in "hacktivism," or politically motivated cyberattacks.

Though spam levels in the fourth quarter actually dropped by 24% from the third quarter, the daily volume of junk mail around the world still averaged 135.5 billion per day. To reach that level, spammers relied heavily on news stories, especially tragedies.

(by hjkim, MailRadar Community) When most people think about email security, they think in terms of virus and spam protection. The typical questions are: 'How do I protect my users from viruses and spam?', 'What about phishing?', 'How are Trojans and other threats stopped?'. What is missing is a comprehensive, holistic approach to email security.

The above are some of the issues that a company needs to consider. However, there are many other issues that need to be addressed:

1. Educating the employees and helping them understand how security affects their livelihood
2. Reviewing physical security regularly
3. Checking the network security
4. Validating the administrators managing your email server
5. Software security

Email security encompasses much more than just anti-virus and spam protection. The biggest threat does not occur outside of the company; most of the threats are within the company where information can be easily shared and hacked.

(Debra Littlejohn Shinder, TechRepublic) If it seems like you’re getting hit with more email scams than ever, you’re right. Email scams have been with us since the Internet went commercial back in the early 1990s. But scammers have gotten more sophisticated, and some of the more recent email scams are harder to detect — unless you know what you’re looking for.

Let’s look at some of the email scams that are currently going around the Internet and how you (and your users) can recognize them and keep from being victimized by them:

1. Fake Facebook “friend” messages
2. Fake admin messages
3. Fear-mongering messages
4. Account cancellation scams
5. Bogus holiday cards
6. Phantom packages
7. Threats from the government
8. Census survey says…
9. In Microsoft (or Apple or Dell or HP) we trust
10. You’re a winner! [...]

View the original article and learn more about email scams by clicking on the "full article" link.

(Joel Snyder, TechTarget) Some email managers have asked for the ability to stop certain types of files from coming through the system. The premise is simple: some types of files are rarely legitimately sent. A good example would be a file with an extension of .BAT. Yes, IT people do occasionally and legitimately send .BAT files. But all of the non-IT people in an organization should not be getting .BAT files. And if they do get .BAT files, then they are probably getting into trouble with them.

This leads to a lot of antivirus configurations that delete certain body parts from email messages. Good products let you do this in three different ways:

1. By the filename of the body part (such as *.mp3)
2. By the MIME label (such as MIME type "audio/mpeg")
3. By the fingerprint of the file as detected by the email gateway (such as "audio files").

A key consideration: The only reason to look at types of email body parts is to block them from entering your organization. Don't use these features to exempt certain types of data files from virus scanning. Remember: Computers are cheap, people are expensive, and (more importantly) attackers are constantly moving their attack vectors. Any attempt to optimize your antivirus configuration to speed performance is going to eventually compromise security.

Blocking certain types of files from entering via email is more of a business-by-business decision. Going one way or the other can't be classified as a best practice.

(Michael Kassner, TechRepublic) The complexity of today’s IT environment makes it easy for computer malware to exist, even flourish. Being informed about what’s out there is a good first step to avoid problems.

With all the different terms, definitions, and terminology, trying to figure out what’s what when it comes to computer malware can be difficult. To start things off, let’s define some key terms:

1. Malware: Is malicious software that’s specifically developed to infiltrate or cause damage to computer systems without the owners knowing or their permission.
2. Malcode: Is malicious programming code that’s introduced during the development stage of a software application and is commonly referred to as the malware’s payload.
3. Anti-malware: Includes any program that combats malware, whether it’s real-time protection or detection and removal of existing malware. Anti-virus, anti-spyware applications and malware scanners are examples of anti-malware.

One important thing to remember about malware is that like its biological counterpart the number one goal is reproduction. Causing damage to a computer system, destroying data, or stealing sensitive information are all secondary objectives.

Is it even possible to reduce the harmful effect malware causes? Here are a few thoughts on the subject:

1. Malware isn’t going away any time soon. Especially when it became evident that money, lots of money can be made from its use.
2. Since all anti-malware applications are reactionary, they are destined to fail.
3. Developers who create operating system and application software need to show zero tolerance for software vulnerabilities.
4. Everyone who uses computers needs to take more ownership in learning how to react to the ever-changing malware environment in.
5. It cannot be stressed enough, please make sure to keep operating system and application software up to date.

(Joel Snyder, Security Operations and Strategies) When you look at your firewalls and security policy, it's helpful to learn two new terms: "client-protecting" and "server-protecting." The reason we need these terms is that you configure your firewall very differently depending on whether you are protecting clients or servers. In fact, the configurations and requirements are so different, that you should consider having different firewalls for your servers and for your clients. That's not always the right answer, but it can simplify things dramatically, because you can focus on what you are protecting and where the vulnerabilities are.

When a firewall sits between the Internet and users browsing the Web, that constitutes "client-protecting." For example, if a user tries to go to a malware site, and the firewall blocks the malware from being downloaded, that's client-protecting behavior.

At the other end of the spectrum is "server-protecting," which means that the firewall is protecting your servers from attack or infection. For example, if someone tries a known SQL injection attack on your web server - whether it is vulnerable or not - and the firewall IPS blocks it, that's server protection.

The problem comes in when you are trying to mix client-protecting and server-protecting configurations in the same box. Some firewalls don't let you apply protections in different ways to different types of traffic. Sometimes it's just very confusing to keep straight whether the firewall is protecting clients or servers, because documentation and configuration tools are very commonly ambiguous about which direction things are flowing. And sometimes it's a cost question: when you pay subscription fees for services such as antivirus and intrusion prevention, it may be less expensive to pay for just what you want to protect on two smaller systems, rather than a single larger one that has to have every protection turned on for every user.

(Joel Snyder, TechTarget) If you've bought a firewall in the last 3 years, you've bought a UTM firewall: a device that will not only control traffic based on policy, but also one that has other built-in threat mitigation technologies, such as antivirus, intrusion prevention and content filtering. UTM features have been around for longer than that, but the market universally moved to UTM about 3 years ago for all but the biggest and smallest of devices. There are lots of reasons for this shift, including a desire to provide better security and adapt to current Internet threats.

However, one cynical reason for the shift to UTM should be kept in mind as you investigate your new (or old firewall): UTM services are subscription services. Firewall vendors want to move their customers from a buy-once model to a recurring revenue model, where software updates, IPS rules, and antivirus/antimalware signatures add up to a steady trickle of revenue from each subscriber. This inherent conflict of interest means you need to evaluate what services you really want and need from your UTM firewall, so as to maximize the value of the subscription dollars you spend.

UTM firewalls are all over the map with additional security features that go beyond basic firewalling, but the three most common areas are antivirus/antimalware, intrusion prevention, and content filtering. Let's look at all three to see what makes the most sense for you. If you don't have a good feel for the terms "client-protecting" and "server-protecting," then you should review "How Many Firewalls Do I Need?" first.

Antivirus/Antimalware Solid Secondary Protection
UTM firewalls are great secondary antivirus/antimalware protection in a client-protective environment. If you have desktop antimalware, then adding UTM antimalware (hopefully from a different antimalware vendor) will provide a good level of secondary protection.

For years, the specter of viruses, Trojan horses and worms caused many a chief security officer to lose sleep. But it’s the enemy within that is now prompting IT staffers to ramp up security efforts. According to Forrester Research, the majority of security breaches involve internal employees, with some estimates as high as 85 percent.

Inadvertent employee error, laptop theft, contractors’ unauthorized access to information, disgruntled employees, password mismanagement – all of these factors can mean drastic revenue loss, legal liabilities, diminished productivity and brand erosion.

What are the top internal security threats – and how can you avoid them? Read on to find out.

E-mail worms, not long ago the scourge of the Internet, have declined sharply in 2007, a security company has revealed. According to UTM security vendor Fortinet, the incidence of mass-mailing worms has declined by 5 percent each month since the start of the year, putting the once-feared worm well below other types of attack in terms of volume.

The figures come from the company's The State of Malware report for June 2007. Viruses, spyware and software exploits have remained roughly stable in volume throughout the same period, while Trojans have been climbing since February to represent the number one threat.

Much less common mobile, IM, Linux, and non-mailed Win32 worms have all shown marked declines, albeit from relatively low levels.

Thousands of legitimate Web sites are hosting an infection kit that evades detection by attempting to compromise each visitor only once and using a different file name each time, Web security firm Finjan warned on Monday.

The attack, dubbed the "Random JS toolkit" by the security firm, currently uses dozens of hosting servers and more than 10,000 legitimate domains to attempt to exploit the systems of visitors to the sites, the company said in an analysis posted to its Web site.

Back in the days when Windows 98 was the latest Microsoft operating system, HTML email messages accounted for a large number of infected Windows-based systems. Surprisingly, things have not changed much nowadays either. Accepting and displaying HTML email messages still pose a great deal of threats for email users, regardless of what operating system they are using, or if the latter is actually immune to an attack based on vulnerabilities of other systems.

To illustrate, here are some of the possible threats posed by the use of HMTL messages; including, but not limited to virus or other malware infections, which still account for a high degree of risk.

Estimates vary, but generally it is believed that there are 100 to 500 Linux viruses out there. The tiny number of Linux viruses that do exist have never resulted in a significant outbreak. In comparison to the plethora of viruses and worms in Windows-based platforms, the volume of Linux viruses is insignificant. So this leads us to two questions: why are there so few Linux viruses and are Linux anti-virus tools necessary?

The answer to the first question has a lot to do with the differences between Linux and Windows desktops. Linux hosts are an unwelcoming environment for a virus because the multi-user access controlled model makes traditional virus propagation methods problematic.

Let's look at an example:

Virus attacks often start with the victim receiving an email containing a malicious attachment. If the user attempts to execute the attachment on a Windows platform, it will run if it has a suitable file extension, appropriate executable content or configured to be executed by association with a particular application. Even worse, some clever Windows-based viruses don't even require the user to execute the attachment. Viruses can be activated by merely reading the email containing it. As users of many Windows-based hosts, especially Windows XP, are also running with local administration rights, the virus may potentially infect and subvert the entire host.