Becrypt continues expansion in US with appointme... » Seeds of Genius, a specialist supplier to Federal Government and DOD, has joined the fast-growing nu... Lancope Strengthens Cisco pxGrid Support for faste... » LONDON (UK): Lancope, Inc.is providing tight product integration with the new Cisco Identity Service... International SOS and Vismo in joint partnership t... » York, UK: International SOS, the world's leading medical and security services company, and Vismo, a... Tech Mahindra selects Qualys to expand global IT s... » REDWOOD CITY, Calif.: Qualys, Inc. has announced a strategic partnership with Tech Mahindra , a mult... Barracuda launches SignNow Appliance » Barracuda Networks has launched the Barracuda SignNow version 4.0 and the new Barracuda SignNow Appl... Boston Networks design, deliver and maintain Intel... » Regarded as the world’s most prestigious team golf event, Boston Networks delivers a full turnkey so... British Parliament tells Teeside University to sta... » Ground-breaking research at Teesside University which has been described as the “holy grail” of crim... Army Officer wins engineering Modern Day Visionary... » Source: MoD AIRCRAFT Engineering Officer Major Oli Morgan has been named as the 2014 Modern Day V... Electronic I.D. Card project in Nigeria: How not t... » President Goodluck Jonathan recently launched a MasterCard-branded Nigerian National Electronic I.D ... Do you know which smartphone is the most popular s... » Surprisingly, it’s not the iPhone, LG, Huawei or HTC and Windows Phone hardly gets a look in. Even t...

CLICK HERE TO

Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.

READ MORE

Subscribe to Vigilance Weekly

Information Security Header

MANCHESTER, UNITED KINGDOM: Commenting on the active hacker exploitation of the latest Java zero-day vulnerability - which has already been included in the BlackHole and Cool Exploit kits - Avecto says this is an IT security disaster in progress, as there is currently no patch available for the problem.

 

According to Andrew Avanessian, VP of Global Professional Services with the Windows privilege management specialist, the vulnerability has also been added to the Nuclear Pack and Redkit exploit kits, strengthening the argument that Java should be carefully controlled on most endpoint systems.

"Whether or not Java is allowed to free reign on employee PCs, however, is actually secondary to the removal of admin rights from user accounts, as with standard user rights it is a relatively easy task to mitigate the effects of Java vulnerabilities on the Windows platform," he said.

"Put simply, without admin rights, it is difficult for cybercriminals to deploy malware capable of installing a root kit - or embedding itself in the operating system. The worst case scenario is where the malware runs in the user's profile - a problem that can be solved by removing the profile, rather than re-installing the operating system, with all the hassle this entails," he added.

Avecto’s VP of Professional Services went on to say that, once the admin rights have been removed, there is still a relatively small attack surface to deal with - and this issue can be remediated using a whitelisting security approach.

This, he says, is where the IT system only allows trusted `digitally signed' applications to run.

The good news, he adds, is that this approach also reduces the potential mis-configuration of endpoints by the user, which helps to strengthen the security model of the business IT platform in question.

Companies, says Avanessian, frequently underestimate the increases in security that can be derived through the removal of admin rights and whitelisting, despite the fact that processes can be easy to set up.

“Our observations suggest that many IT managers perceive these processes as being too hard to achieve, so they either avoid or simply don’t bother considering them. The reality is that, with the correct admin rights audit and allied requirements capture sessions in place, the right balance between security and flexibility is relatively easy to achieve,” he explained.

Avanessian says that adding a privilege management system to the security mix offers additional levels of flexibility and a positive user experience, especially against a backdrop of continuing security issues with Java, which appears to be caused by vulnerabilities in the platform.

“Simply removing Java from a computer system is not, sadly, the solution, owing to the wide variety of legacy applications that require its presence. The good news, however, is that with finer grained control over the code environment, IT professionals can mitigate most of the problems,” he said.

“One area worth noting is the issue of standard application installs and portable apps. There are several vendors developing applications, which do not need privileged accounts to run or install and, as a result, the endpoint build can become cluttered with unauthorised and unlicensed software. Application whitelisting goes a long way towards mitigating against this issue,” he added