Security Reality Check

To pick up where we left off in the last blog (below), the discussion was about the claim 'if you change to Mac or Linux, the crooks will only do the same'.

Inherent in this claim is the supposition that either or both of the non Windows systems will grow enough in market share to become attractive to the 'bad guys'.

Is that possible, or likely?  How does one determine how likely it may be?  

Since "anything is possible", it is theoretically possible for either Linux or Mac OS X to gain enough market share to become attractive as a target for those who write malware.

How plausible is this, though?  And how much of a change would this take?  Would Linux and/or Mac OS X need to be 25% of the total computers on the 'net, or would it take more?

Even assessing current market share, that is, determining how many of the computers on the internet are Macs, machines running Linux, and how may are PCs running Windows, is difficult. (For the sake of this discussion, by the way, I'll only consider desktop computers, not servers.)

Accurate market share numbers are a challenge because there are different ways to calculate it.  Gartner and IDC use similar methods, i.e. the number of computers sold.  NetApplications  and GlobalStats track operating systems used to visit websites.

For instance, in this most recent quarter, IDC shows Apple with slightly less than 10% in the U.S., and Gartner pretty much concurs, 

However, worldwide, Apple doesn't make the top five vendors, and, by IDC's numbers the fifth place global vendor, Toshiba, has a 5.2% market share.  That would make it likely that, even if Apple is number six, it's world wide market share is less than 5%.

Gartner and IDC don't track Linux on the desktop, however. Accurate numbers are very tough - maybe impossible to determine, because most computers running the Linux operating system on the desktop were sold with Windows installed.  Here the best way to determine numbers may be here, and here. Both show Linux at under 1%, and Mac OS X at 5.27% and 3.92% respectively at the time of this writing.

The trend has been up for both alternate OSs, but is it up enough to indicate that either of these choices could make an attractive target for those who write malware? Is this likely to change anytime soon?  If an OS  has to have 25% of the computers on the internet to make it financially worthwhile for a 'black hat' to write code for it, Apple would have to have five times the market share it has now.  Five times.  

Linux would have to have twenty-five times the market share it has now.  

Is this really plausible?  

I certainly don't think so, not in the foreseeable future.  

From a business perspective, so that your business is less of a target - choose well, choose intelligently, especially as to what OS you use to do on line banking.

Brian Krebs of the Washington Post continues to do a yeoman's job, reporting and investigating the crimes of bank fraud that are being perpetrated against small and medium sized business.  

He has learned from the FBI that at least $40 million has been stolen, and most of these crimes were committed during late 2008 and during 2009.

How can you avoid being a victim?  In addition to the recommendations I made in my Oct. 22 blog, take a look at the chart in Mr. Kreb's blog, which lists information on victims of this type of fraud.

Once you've gathered this information, here are a few more safeguards.

• Remind your people *not* to open any emails that look at all suspicious, and, of course, don't click on a link inside an email. Instead, open your browser and navigate to the link yourself, by retyping the link.  Don't copy it.

• Use Firefox as a browser, wherever possible - and keep it updated.  Firefox has recently made extra efforts, beyond any other browser, to insure security.

• While the safest option may be to do banking on a Mac or a PC running Linux, at the very least use a dedicated machine.  In other words use this machine for your banking only - no email accounts, or other web surfing at all.  Use it just for banking.

• Make sure your banking PC/Mac is used at your place of business, or another safe network - don't take it to an open, public network.

• Note that, of the victimized companies, those who bank with very small institutions, where employees know their customers, were most likely to recover potential losses. 

• Since many banks have a policy that requires 48 hour or even 24 hour notification of any unauthorized transfers, once you know your bank's policies, have someone check each day or every other day and act immediately on any suspicious transactions.

The basic strategy is to stay informed, and then act accordingly to protect your business.  

Stay safe out there!

Let's get more strategic about the computer security challenges facing small & medium sized businesses. The goal is to make your business as safe as possible while interfering with your day to day operations, as little as possible.

Great goal.   How do you get there?

The first step is to know the basics.  Here's one source, 'Tips for Safe Computing'.  (More on basics to come in future blog entries.)

The next step is to stay up to date on what real dangers exist.  You have a good idea of the  security level of the locks on your place of business - and whether or not you need an alarm system.  You know this partially because you have a sense of your neighborhood, and you know how safe it is or isn't.

One of the goals of Security Reality Check is to help business owners and operators have that same level of comfort with respect to their computer security.

To achieve this, a business owner needs to know as much about what's going on that could threaten the business as s/he knows about how likely it is for some one to rob, or break into the physical business.  

Recently, a neighborhood association mail list informed us, here in San Jose, CA., that mail boxes had been broken into, at condo developments across the street from us.  A few weeks later, when checking the mail, I noticed mail on the ground - when I went to pick it up, I saw that the back of the mail box - which accesses eight mailboxes, was wide open.  Anyone could get my neighbor's mail.  I reported this to USPS, and the manager of our condo association.  And took note of the potential threat.  As a result, if I'm expecting any checks in the mail, I'll be quick to get to the mailbox, in addition to being more alert - that is, I'll pay more attention to our mailboxes.

What do you know about businesses who have systems like yours?  Have there been any exploits?  How well protected are your colleagues? Are there practices they're using that could benefit you?

Of the threats you hear about, which are real?  Which could affect you, and which ones are just theoretical, or worse, alarmist?

(For example, a 'real' threat is one that has a solid chance of impacting you.  If the threats out there pertain to Windows XP, and you've upgraded to Windows 7 or use Linux, then you'll know you don't have an issue - at least this time.)

The answers you come up with for yourself will be most valuable. I'll be adding more on these topics, in future blog entries.