Peter Wood is the CEO of First-Base Technologies LLP, an ethical hacking firm. He has over 40 years of experience in computers and security. Some of the main corporate web security issues he discusses are drive-by malware infections from compromised websites, phishing and spear phishing attacks, and social networking attacks. Statistics show the continued prevalence of these threats. He provides examples of past attacks and recommends patching systems regularly, controlling web browsing habits, and thinking before clicking links or downloading content.

1. The Corporate Web Security Landscape Peter Wood Chief Executive Officer First • Base Technologies LLP An Ethical Hacker’s View

2. Who is Peter Wood? Worked in computers & electronics since 1969 Founded First • Base in 1989 (one of the first ethical hacking firms) CEO First Base Technologies LLP Social engineer & penetration tester Conference speaker and security ‘expert’ Chair of Advisory Board at CSA UK & Ireland Vice Chair of BCS Information Risk Management and Audit Group Vice President UK/EU Global Institute for Cyber Security + Research Member of ISACA Security Advisory Group Corporate Executive Programme Expert Knowthenet.org.uk Expert IISP Interviewer FBCS, CITP, CISSP, MIEEE, M.Inst.ISP Registered BCS Security Consultant Member of ACM, ISACA, ISSA, Mensa 1969 1989

3. Information leakage

4. Web Security Issues Drive-by malware infection Phishing and spear phishing Social networking attacks

5. Web Security Issues Drive-by malware infection Phishing and spear phishing Social networking attacks

6. The Statistics Cisco 1Q11 Global Threat Report

7. Drive-by Malware Infection Just surfing to a compromised website is enough to infect your computer The malware exploits security holes in browsers and plug-ins

8. Drive-by Malware Infection Web sites often employ JavaScript, Java, ActiveX, PHP or Adobe Flash These allow continuous communication between browser and server without user intervention Legitimate uses include changing web banners, loading lists or sending data to servers If a browser has an unpatched vulnerability, malicious scripts can access a user's computer directly Thus malware can move from the server to the browser, and via the vulnerability to the user's computer, without any conscious action by the website visitor at all Even legitimate, well-known and frequently-visited websites can be infected

9. Browser Version %

10. Operation Aurora Two days after the attack became public, McAfee reported that the attackers had exploited purported zero-day vulnerabilities (unfixed and previously unknown to the target system developers) in Internet Explorer and dubbed the attack ‘Operation Aurora’ In an advisory on January 14, 2010, Microsoft said that attackers targeting Google and other U.S. companies used software that exploits a hole in Internet Explorer The vulnerability affected Internet Explorer versions 6, 7, and 8 on Windows 7, Vista, Windows XP, Server 2003, Server 2008 R2, as well as IE 6 Service Pack 1 on Windows 2000 Service Pack 4

11. Web Security Issues Drive-by malware infection Phishing and spear phishing Social networking attacks

13. Spear phishing

14. Web Security Issues Drive-by malware infection Phishing and spear phishing Social networking attacks

15. Malware on LinkedIn January 2009 - www.lavasoft.com

16. Malware on Facebook Users don’t always realize that third-party widgets for Facebook, for example, aren’t written by Facebook Some collect more information than necessary or safe Others have been written specifically to install adware or generate revenue “ Secret Crush” on Facebook spread spyware Victims received an invitation to find out who has a secret “crush” on them, lured them into installing the Secret Crush app, which spread spyware via an iFrame The attack became worm-like when it required the victim to invite at least five friends before learning who their “crush” was Kelly Jackson Higgins, DarkReading

17. 3 May 2011- http://technolog.msnbc.msn.com

18. Social Networking Attacks http://www.independent.co.uk

19. DON’T PANIC! (assuming you’re the only user)

20. Patch and Check Regularly!

21. Control Your Web Browsing

22. Think Before You Click!

23. Don’t Forget to Cross Your Fingers!

24. Peter Wood Chief Executive Officer First • Base Technologies LLP [email_address] Twitter: peterwoodx Blog: fpws.blogspot.com http://firstbase.co.uk http://white-hats.co.uk http://peterwood.com Need more information?