“I’m careful when I surf the internet…I know how to keep my information safe.”

“I don’t visit very many sites, so it’s not important.”

“The only sites we visit are for work and banking, so I’m not concerned.”

Those are some of the many statements I have heard from users to whom I have spoken about the importance of proper online security and practices.  Almost always I am told that it is not something to worry about, something that is in no need of attention, or an area where they see no need to spend any money.

If these statements sound familiar to you, or users around you, I would encourage you (or they) take the time to read my next few articles, in which I plan to talk about online security and practices – most specifically surrounding surfing the internet and visiting those websites we all love to go to.  It is my hope that these articles are taken with more thought than the conversations I had with each of the users above, who later came back to me with infections on their systems – not knowing what had been compromised.

Many unsuspecting users think the web is safe, or that their online practices are effective, because “I’ve never been infected”.  Are you truly that certain that none of your systems are not compromised?

Most users or organizations don’t have the proper systems in place to notify them in the event if an infection.  Most malware are designed to steal personal information and passwords, or will utilize your PC and/or network to distribute spam, contribute to the spread of additional malware and/or inappropriate material without your knowledge.

A large corporation recently installed a web appliance at it’s network gateway and it immediately flagged alerts on more than 50 workstations on the network for suspicious behavior – broadcasting organizational data to a malware network.

Are you absolutely certain your network is completely clean?
How sure are you?
What information do you have available to you that makes you so sure?

One of our clients called us a few months ago, concerned that he might have clicked on something that cause his computer to act funny – he stopped what he was doing and called us right away.  I was available to remote into his PC immediately, and found that he had been infected by a fairly widespread piece of malware, specifically designed to track and transmit personal data that was found on the infected PC, and would then transmit it to the designers of the malware.  After a few minutes, I determined where the infection had come from – his bank’s website!  Their web-server had been hijacked, and was being used to infect visitor’s browsers without them even knowing.  As a matter of courtesy and security, I called the bank’s IT department and informed them of the breach so that they could address it.

Still think you’re always safe just banking, checking a couple popular sites, and maybe checking some news online?

The list below is a number of websites that were recently found to have been infected by one method or another.  This should show you how easily it is to visit a website, without suspecting that it might be infected.

• Vancouver Canucks
• US Department of the Treasure
• Facebook
• Yahoo
• City of London
• Network Solutions
• Twitter
• My Space
• The New York Times
• CNN
• The Washington Post

Chris McCormack (Product Marketing Manager @ Sophos) recently wrote a very good white paper entitled “The 10 myths of safe web browsing” (entire white paper available here).  In this paper, he discusses some commonly held beliefs by internet users, and their supposed safety while browsing the internet.  These myths include:

1. The web is safe because I’ve never been infected by malware.
2. My users aren’t wasting time surfing inappropriate content.
3. We control web usage and our users can’t get around our policy.
4. Only porn, gambling, and other ‘dodgy’ sites are dangerous.
5. Only naive users get infected with malware and viruses.
6. You can only get infected if you download files.
7. Firefox is more secure than Internet Explorer
8. When the lock icon appears in the browser, it’s secure.
9. Web security requires a trade-off between security and freedom.
10. Endpoint security solutions can’t protect against web threats.

In my upcoming set of articled, I plan to discuss a number of these myths and steps that users can take towards both protecting and educating themselves against such threats.