At F-Secure, we not only aim to protect our customers with the best security possible, we also want to do it in the smartest possible way. And here’s some good news: Globally renowned Forrester Research has looked at small business and enterprise client security vendors around the world and found that we’re succeeding in both areas.
We’re proud to be featured in The Forrester Wave™, Endpoint Security Q1 2013 as top-ranked in Strategy. Forrester Research Inc. called us a Strong Performer and gave us the highest score among all vendors for our product roadmap and strategy.
What makes our approach to securing the workplace so appealing is that we don’t see ourselves just offering our clients security software—we take away the worry of securing your office and let our professionals do the job. I recently had a discussion with an end customer of ours in the media industry. He told me that he’s not really interested in what happens in the background and how our products work – he only wants to know that the level of protection is sufficient. And this is not a unique case; we’ve heard the same story from many of our customers.
This simple, breakthrough approach also makes it easier and more affordable to deploy the award-winning security we’ve been providing for more than two decades.
“We think this vision is closely aligned with the bigger climate change where IT all over the world is moving to procuring services rather than products,” Forrester said.
Forrester also praised our rootkit detection and DeepGuard, which we’re especially proud of. Deepguard anticipates threats using heuristical, behavioral and reputation-based technologies.
The other morning when I was commuting to the office in freezing cold weather, I started thinking about layered protection – a term we use to describe the way our protection technology is built. Security is a bit like weather; we forecast it to be able to be prepared. And the colder it gets, the more layers we need to protect us. It is not always that we need all the layers we’ve got at the back of our closet, but we still need to have them come the winter frosts – and the same logic goes for the different layers included in our security products.
Just as clothing companies develop better materials, we continuously develop new technologies to protect our customers
Forrester credited our Labs’ research and gave our Client Security credit for performance, anti-malware detection and customer feedback.
The best news is that they evaluated us even before our new Software Updater tool, which makes it easy to keep your network patched and protected, was released. And that’s a big part of how we try to be smart—by always improving.
Here are some of our tips on securing your business network. And you can find out more about our corporate service portfolio here.
[Photo by Sean MacEntee via Flickr]
If you're in business, you have enemies -- and they're trying to get into your network. For-profit malware authors after baking information or files for extortion want in. Script-kiddies want in because mayhem is their game. And if you're large enough, criminals seeking data about your customers for espionage want in too. "For instance, if you're a law firm," F-Secure Labs Senior Researcher Jarno Niemelä said in a recent webinar, "your clients might be interesting." And it's not just the clients of lawyers, who may be "interesting". He noted companies that specialize in car rental, car leasing, cleaning and catering all have customers that are attractive targets for your enemies. In order for an attack to be successful, the attacker must first get information about his or her targets. And the worst part is we may be letting our enemies in. Here are the 5 most common methods that is done: 1. Email. Spam is designed to hit anyone and only needs to work a tiny fraction of the time. A spear phishing attack was designed to get you. 2. Hacked websites. Like a lion hiding in a savannah, the best attackers infect a website you're likely to visit -- naughty and not naughty -- and wait for you to become their prey. 3. Search Engine Poisoning. Criminals target a specific search term and tries to drive an infected site up the Google rankings. 4. Traffic Injection. These more advanced attacks hijack your traffic and send it to a router controlled by the enemy. Once you've become the victim of a man-in-the-middle attack any web site you visit could be infected just for you. 5. Social engineering. What your enemy lacks in technical savvy, s/he could make up with the ability to fool you. 6. Affiliate marketing. Some criminals -- and intelligence agencies -- simply buy their victims in bulk. Jarno calls it "the digital slave trade". Of course, these aren't the only ways into your network. Jarno also explained how offline attacks through external drives, for instance, can provide access. But these are the six most likely ways your enemies will find their way in your network. And you should have some idea what they're up to, since their success depends on your mistakes. Cheers, Sandra
This is the first in a series of posts about Cyber Defense that happened to real people in real life, costing very real money. A rainy, early spring day was slowly getting underway at a local council office in a small town in Western Poland. It was a morning like any other. Nobody there expected that this unremarkable day would see a series of events that would soon affect the entire community... Joanna Kaczmarek, a Senior Specialist in the council’s Accounting Department, rushed into her office a little late, but in a good mood nonetheless. Before getting down to work, she brewed herself a cup of coffee and played some music on her computer. Several days earlier, she had finally installed a music app on her PC so she could listen to her favourite tunes while she worked. This had taken some effort though, as she had needed administrator’s access to her computer. It took a lot of pleading and cajoling, but after a week the IT guy finally gave in. Joanna had no idea that she was opening a dangerous gap in the council’s IT system. That morning, Joanna launched, as she had countless times before, a government issued budget management application. With a few clicks, she made a transfer order for nearly twenty thousand zloty. The recipient of the money was a company that had won the contract for the renovation of a main road in the town. The whole operation took seconds. Two days later, the owner of the company phoned Joanna, asking about the advance he was supposed have received. “I can’t get the work started without that money”, he complained in an annoyed voice. Joanna was a little surprised and contacted the bank. The bank confirmed the operation, saying that there was nothing suspicious about it. Joanna, together with the Head of the IT Department, carefully ran back over the events of the day of the transfer. They found nothing out of the ordinary, so started checking what was happening on Joanna’s computer around the time before the transfer date. They soon found something: nearly a week prior to the date of the missing transfer, Joanna had received an email from the developer of the budget management software. For Joanna, the message hadn’t raised any red flags; the email contained a reminder about a software update and looked very legitimate. It contained the developer’s contact data, logo and telephone number. Everything was in order… Everything except for a change of one letter in the sender’s address. Joanna hadn’t noticed – a “t” and an “f” look so alike when you read quickly, don’t they? Unaware of the consequences, Joanna followed the link that was to take her to the update website. With just one click of her mouse she started a snowball of events that ultimately affected each and every resident of the town. Instead of the “update”, she downloaded dangerous spyware onto her computer. In this way, the cybercriminals who orchestrated the attack learnt that the woman was a Senior Specialist in the Accounting Department and was responsible for transferring money, including EU funds. The thieves lured Joanna into a digital trap, tricking her into installing software that replaced bank account numbers “on the fly”. As she was processing the transaction, the hackers replaced the recipient’s account details with their own, effectively stealing the money. Joanna would have been unable to install the fake update if she hadn’t obtained the administrator’s rights she’d needed for her music app. All she had wanted was to listen to some music while she worked. If only she had known what the consequences would be... After the attack was discovered, the Police launched an investigation. Joanna was just one of many victims. Investigators discovered that the malware infection was likely to have targeted computers used by local government workers in hundreds of municipalities across Poland. Law enforcement authorities haven’t officially disclosed how much money was stolen, but given the fact that losses may have been underreported, the estimated figures are in the millions of zlotys. On the top of that, Joanna’s town had to wait months for the completion of the roadwork. This was one of the largest mass cyber-attacks against local government in Poland. It certainly won’t be the last one... For small and medium sized enterprises, the average financial loss as the result of a cyber security incident is on average 380 000€. The risk and the lost is real. Don’t be an easy target. We help businesses avoid becoming an easy victim to cyber attacks by offering best in class end-point protection and security management solutions trusted by millions.
F-Secure Labs reported this week on a new WhatsApp scam that’s successfully spammed over 22,000 people. Spam seems to be as old as the Internet itself, and is both a proven nuisance AND a lucrative source of revenue for spammers. Most people don’t see what goes on behind the scenes, but spammers often employ very sophisticated schemes that can expose web surfers to more than just ads for Viagara or other “magic beans”. Spam typically tries to drive Internet traffic by tricking people into clicking certain websites, where scammers can bombard unsuspecting web surfers with various types of advertising. Profit motives are what keep spammers working hard to circumvent spam blocks, white lists, and other protective measures that people use to try and fight back – and it can pay off. Numerous spammers have been indicted and suspected of generating hundreds of thousands of dollars in revenue from their spam campaigns, with one study projecting that spammers could generate in excess of 3.5 million dollars annually. While most spam circulates via e-mail, the popularity of services like WhatsApp is giving spammers new resources to exploit people, and new ways to make money. Here’s a few ways spammers and cyber criminals are using WhatsApp to make money off users: Following Malicious Links: One way that cyber criminals use WhatsApp to scam people is to trick them into following malicious links. For example, a recent scam sent SMS messages to WhatsApp users telling them to follow a link to update the app. But the message was not from WhatsApp, and the link didn’t provide them with any kind of update. It signed them up for an additional service, and added a hefty surcharge to victims' phone bills. Sending Premium Rate Messages: Premium rate SMS sending malware was recently determined by F-Secure Labs to be the fastest growing mobile malware threat, and WhatsApp gives cyber criminals a new way to engage in this malicious behavior. Basically the users receive a message that asks them to send a response – “I’m writing to you from WhatsApp, let me know here if you are getting my messages”, “Get in touch with me about the second job interview”, and various sexual themed messages have all been documented. Responding to these messages automatically redirects your message through a premium rate service. Spanish police claim that one gang they arrested made over 5 million euros using this scheme – leaving everyday mobile phone users to foot the bill. Manipulating Web Traffic: A lot of spam tries to direct web traffic to make money off advertising. As you might imagine, this means they have to get massive numbers of people to look at the ads they’re using for their scams. Scammers use WhatsApp to do this by using the app to spread malware or social engineer large numbers of people to visit a website under false pretenses. F-Secure Labs found that people were being directed to a website for information on where they could get a free tablet. In March there was a global spam campaign claiming people could test the new WhatsApp calling feature. Both cases were textbook scams, and instead of getting new tablets or services, the victims simply wasted their time spreading misleading spam messages and/or exposing themselves to ads. WhatsApp and other services are great for people, but like any new software, requires a bit of understanding to know how to use. Hopefully these points give WhatsApp users a heads up on how they can avoid spam and other digital threats, so they can enjoy using WhatsApp to chat with their friends. [ Image by Julian S. | Flickr ]