Intervista a Zone Labs: sicurezza in Rete e firewall

Rendere la propria rete immune ai problemi futuri, richiede in primo luogo la prevenzione dalle infezioni mettendo in quarantena le e-mail sospette, l’applicazione di tutte le patch necessarie per applicazioni e sistemi operativi, bloccare i tentativi di comunicazione in Rete di tutte le applicazioni sconosciute e la diffusione delle stesse.

L’approccio preventivo (“colpevole finché non ne è stata provata l’innocenza”) nei confronti delle applicazioni che tentano di accedere alla Rete è una caratteristica distintiva dei prodotti per la sicurezza sviluppati da Zone Labs.

IlSoftware.it: Rendere sicura una rete da questo tipo di problemi, ad esempio da worm come Nimda, richiede, in primo luogo, la prevenzione delle infezioni. Ma quali sono i vostri suggerimenti a riguardo di questo punto-chiave?
Zone Labs: La prevenzione è proprio il punto focale. La maggior parte dei prodotti “profile-based” , come gli antivirus e i sistemi per l’identificazione di intrusioni (Intrusion Detection Systems), sono in grado di proteggere solo nei confronti di pericoli conosciuti.
I prodotti di Zone Labs sono in grado di proteggere il personal computer sia da problemi conosciuti che da quelli ancora sconosciuti: è possibile così bloccare nuovi virus prima che l’antivirus e i prodotti IDS siano in grado di riconoscerne l’esistenza.
Il punto di arrivo in fatto di sicurezza si basa su tre componenti: difesa di tutti i personal computer client, gestione centralizzati di policy di sicurezza, “rinforzo” di tali policy all’interno dell’azienda.

ZoneAlarm Pro offre un livello di sicurezza avanzato per i PC client mentre Zone Labs Integrity “rinforza” le policy di sicurezza in azienda ed assicura che solo i PC che montano versioni aggiornate del firewall aziendale ed adeguati antivirus siano in grado di connettersi, e di rimanere connessi, alla rete.

IlSoftware.it: Secondo voi, strumenti come MBSA (Microsoft Baseline Security Advisor), HFNetChk, Windows Update e Microsoft Personal Security Advisor, sono sufficienti per difendersi da nemici come Nimda? Cosa dire a riguardo dei buchi di sicurezza ancora sconosciuti?
Zone Labs: L’uso degli strumenti citati si riflette sul fatto che gli aggiornamenti applicati possono essere o non essere sufficienti – o comunque indicati – per l’uso su un personal computer individuale piuttosto che su quello di un’azienda. L’applicazione di patch ai vari software, specialmente in ambito enterprise, può avere diversi effetti: sia catastrofici che leggeri. E’ necessario considerare che le modifiche più radicali all’interno di software “desktop” possono causare problemi di compatibilità o di funzionalità con applicazioni critiche di tipo enterprise. Le aziende di dimensioni più grandi sono quindi scettiche nell’esecuzione aggiornamenti automatici.

IlSoftware.it: Quali sono le soluzioni che Zone Labs fornisce per la prevenzione e la risoluzione di problemi come quelli introdotti da Nimda?
Zone Labs: Come allegato e-mail, Nimda infetta gli utenti che semplicemente leggano o visualizzino in anteprima – mediante Microsoft Outlook o Outlook Express – il messaggio infetto. Non è necessario che l’allegato alla e-mail infetta venga aperto: il worm sfrutta una vulnerabilità di sicurezza presente in Microsoft Internet Explorer 5.01 e 5.5 (la stessa “cavalcata” dal virus BadTrans).
Questa falla di sicurezza in Explorer fa sì che un allegato possa essere eseguito senza l’autorizzazione dell’utente. Nimda sfrutta il bug per scaricarsi in modo automatico ed auto-eseguirsi allorquando un utente visiti una normale pagina web infettata dal virus. Nel mese di Marzo 2001, Microsoft ha rilasciato una patch per risolvere questa vulnerabilità ma molte aziende e molti utenti non hanno ancora provveduto ad installarla. Ciò comporta una conseguenza di notevole importanza: Nimda è in grado di infettare anche utenti più evoluti che tendono a non aprire allegati sospetti.

Usando Zone Labs Integrity, un amministratore può richiedere agli utenti della propria rete di aggiornare versioni vulnerabili dei vari software. Per esempio, l’amministratore può impostare una policy di sicurezza che identifichi automaticamente tutti gli utenti di Internet Explorer 5.01 e 5.5 all’interno della propria rete e li indirizzi ad una speciale pagina che spieghi il problema e li guidi nella procedura di aggiornamento del sistema.
Integrity è in grado di fornire la sua protezione multi-livello anche sul personal computer individuale. Ciò avviene mettendo a disposizione di livello di protezione di cui i normali antivirus non dispongono: MailSafe, controllo sulle applicazioni e desktop firewall.
MailSafe monitora tutte le e-mail in arrivo e mette in quarantena quelle potenzialmente dannose: è in grado, ad esempio, di riconoscere Nimda in tutte le sue forme (file eml e exe). MailSafe protegge il computer anche da altri tipi di file, come gli script vbs, e da molti altri sfruttati da gran parte dei virus. Il controllo sulle applicazioni impedisce che programmi “maligni” o comunque non autorizzati, possano guadagnare l’accesso ad Internet. Questa funzione, nel caso di Nimda, fa sì che il suo server SMTP integrato non possa spedire via Internet e-mail infette.
Il desktop firewall blocca i tentativi di connessione al computer perpetrati dall’esterno. In questo modo è possibile evitare che un hacker remoto possa connettersi all’account “guest” impostato sul proprio personal computer, visualizzare le connessioni di rete, accedere ai propri dati. Nel caso di Nimda il firewall pone fine ai tentativi di attacco DoS (Denial of Service) che accompagnano il virus.

IlSoftware.it: Il futuro di Zone Labs: potete informarci su quelli che saranno i vostri piani futuri?
Zone Labs: Continueremo a migliorare, ad aggiungere nuove caratteristiche e nuovi servizi ai nostri pluri-premiati software, sia sul versante consumer che su quello enterprise. Il nostro nuovo servizio AlertAdvisor (annunciato già il 6 Marzo 2002) è solo il primo dei vari servizi che intendiamo fornire nel prossimo futuro. Nel corso dei prossimi due anni, poi, il nostro obiettivo sarà quello dell’espansione a livello internazionale. Per esempio, lo scorso anno abbiamo aperto il nostro primo ufficio europeo a Francoforte e stiamo attualmente lavorando per tradurre nelle varie lingue i nostri prodotti.

La nostra intervista in inglese

Pubblichiamo qui di seguito l’intera nostra intervista proposta a Zone Labs in lingua inglese:

Q.1: Reading technical review and surfing on web sites, people is warned about new security threats. More and more articles explain how users and system administrator can prevent and solve these problems. Could you give to our readers an idea on how security is a big problem? Have you got some impressive statistics about?
A.1: Security is an ever-increasing problem for both businesses and the individual computer user. Computer Economics reported that the cost of viruses to the enterprise in 2001 was $13.2 billion. Computer Economics also reported that the total cost of the LoveBug virus (aka Love Letter) in 2000 was $8.75 billion and the cost of Nimda was $635 million. A report from the U.S.-based Internet Fraud Complaint Center (IFCC) found that last year’s cybercrime incidents shot up to more than 49,000. This is up from 21,000 in 2000 and 10,000 in 1999.

Hackers have more tools available to them now, including modifiable source code for Trojan horse programs, web sites and exchanges that make it easy to trade malicious code and tools to ‘roll your own’ viruses without requiring significant amounts of programming skill. Many hackers are now motivated by profit – they wish to find sensitive financial information, or hold data hostage. Several companies have been in the news in the last year because of breaches like this.

Q.2: In your opinion, at what level security problem has to be considered?
A.2: Internet security has become top-of-mind with a much wider group of people than ever before. No longer the arcane focus of the IT department, effectively securing companies’ digital assets and intellectual property is now a CXO- and Board-level concern. The continuing spate of security breaches drives home the seriousness of Internet security to every PC user – whether in the enterprise or in the home. We are all responsible for the security on the Internet.

Security breaches come at a considerable costs to organizations (both in hard dollars and productivity losses). When the proper security is not in place, a breached company is at risk to also lose customers, reputation and brand value. For example, in the United States, security is mandated by the government – HIPAA and Gramm-Leach-Biley.

Q.3: Why a “consumer user” should install and use a personal firewall?
A.3: Hackers ‘ping’ blocks of known IP addresses to find an open port -in other words an unprotected doorway into the computer. Many customers have written to us to mention how many probes ZoneAlarm and ZoneAlarm Pro stopped, and the geographic diversity from whence the probes originated.

What many customers have told us is that they gained peace of mind — they weren’t hacked, they weren’t broken into, they have one less thing to worry about. Unless you have a product like ZoneAlarm or Pro installed, you won’t even know someonès been on your system and you won’t know if something important (your online banking info, your copy of the marketing plan for your company or your patient records) has been carried off.

For the best security, we recommend a security product, like ZoneAlarm or ZoneAlarm Pro, used in conjunction with an updated virus checker. There are good hardware solutions, too, such as the network routers that Linksys (www.linksys.com) offers. The best precaution is to be proactive and to use strong defenses, ‘layering’ as necessary. Because malicious code can be ‘planted’ on a PC, we recommend that protection be installed on every PC.

Q.4: What are, in your opinion, the main mistakes made by users in firewall’s configuration? How do your products can help on avoiding these mistakes?
A.4: Traditionally, firewalls require users to have in-depth knowledge of ports and protocols used by applications, network and communications software to be configured correctly. Unfortunately, this knowledge is beyond the grasp of the average user. Poorly configured firewalls give users the illusion of security – which is worse than no security at all.
ZoneAlarm, and then ZoneAlarm Pro, were among the first firewalls to let users configure the firewall simply by answering “Yes” or “No” to questions about an application’s access to the Internet. Almost all consumers understand that their browser or email should get a “Yes” for permission to access the Internet, while an unknown .exe should get a “No”. Zone Labs’ firewalls configures itself based on the user’s answers.

Q.5: What are the “killing features” that has been made ZoneAlarm so famous and so used?
A.5: Zone Labs’ client-oriented products ZoneAlarm and ZoneAlarm Pro protect PCs from both known and unknown attacks with a combination of: a stealth firewall to barricade the PC from external attack; Program Control to manage which applications are connecting to the Internet; and MailSafe to identify and quarantine potentially harmful email attachments. Zone Labs’ enterprise security solution, Integrity, is an endpoint security management platform that protects corporate data and productivity. The centrally administrated client/server network security solution includes the same multi-layered defenses as in our client products, as well as additional features like Cooperative Enforcement with other network security products.

Q.6: Microsoft has added into Windows XP a new firewall feature. What would you like to say to users who do not install a personal firewall, but they activate only the Windows XP built-in firewall?
A.6: Traditional firewall products, like the XP firewall, are designed simply to stop infiltration by outsiders. With today’s threats, this type of protection is no longer adequate. All Zone Labs products provide superior protection to traditional firewalls. Both ZoneAlarm and ZoneAlarm Pro, the consumer and small business solutions from Zone Labs, include Program Control –the ability to filter outbound Internet connections– as well as inbound connections. That means that you can be alerted if a Trojan horse, spyware, or other malicious code has slipped past your firewall (usually with an email attachment or due to a visit to a web site with malicious active content) and is trying to “call home.” Program Control lets you know when this happens, so you can stop the transmission and remain in control of your PC connections.

In addition, both ZoneAlarm and ZoneAlarm Pro have MailSafe, which identifies and quarantines suspicious email attachments for you upon arrival. ZoneAlarm looks out for .vbs scripts, like the infamous LoveBug virus, and ZoneAlarm Pro looks out for 45 different file types.

Zone Labs Integrity, the enterprise security management platform from Zone Labs, goes further by protecting corporate data and productivity. The centrally administrated client/server network security solution includes the same multi-layered defenses as in ZoneAlarm Pro, as well as additional features like Cooperative Enforcement with other network security products.

Q.7: Nimda was one of the worm virus that caused many damages all over the world. The worm sends itself out by e-mail, searches for open network shares, attempts to copy itself to unpatched or already vulnerable Microsoft IIS web servers. So Nimda was the first really dangerous worm virus infecting both local files and files on remote network shares. What can a network administrator do to protect against Nimda-like multifaceted threats?
A.7: The multifaceted threat that Nimda represents takes advantage of multiple network and Windows vulnerabilities. Nimdàs propagation vectors and payload exploit a series of *known* security holes in one
cleverly-executed package. The result is a huge network traffic jam, slowing down network responses. In fact, at Nimdàs peak, the entire Internet experienced a noticeable slowdown.

‘Future-proofing’ your network from such an unknown threat requires preventing infection in the first place – quarantining suspicious email; managing application version and patch levels to plug existing vulnerabilities network-wide; and blocking unknown applications from making further connections and, thus, propagating themselves.

This pro-active ‘guilty until proven innocent’ approach balances
productivity and protection and is a distinguishing haracteristic of Zone Labs’ security solutions.

Q.8: Securing a network from such an unknown threat that, for example, works like Nimda, requires preventing infection in the first place. What are your suggestions about this key-point?
A.8: Prevention is *precisely* the point. Most profile-based products like antivirus and Intrusion Detection Systems (IDS) can only protect against *known* threats. Zone Labs products are able to protect against both known and unknown threats so we are able to stop new viruses before the antivirus and IDS products know they exist. True endpoint security requires three components – strong defenses on each endpoint or client PC; central management of policy; and enforcement of policy across the enterprise.

ZoneAlarm Pro offers advanced endpoint security, while Zone Labs Integrity enforces security policy across a corporation and ensures that only endpoint PCs running up-to-date versions of the company firewall and antivirus solution are allowed to connect, and remain connected to, the corporate network. This ensures that uniform corporate security standards are enforced as a prerequisite for connecting to the corporate network by any endpoint PC. Integrity enables companies to manage both endpoint firewall and anti-virus policies from a single location. Integrity also provides the ability to assign subnets to Zones so only authorized users can access particular parts of the network.

Q.9: Are, in your opinion, tools like MBSA (Microsoft Baseline Security Advisor), HFNetChk, Windows Update and Microsoft Personal Security Advisor enough in order to prevent threats like Nimda? What about *unknown* security holes?
A.9: The above items depend on measures that may or may not be sufficient or even interesting for individuals or organizations. Patches to software, especially in the enterprise environment may have affects ranging from catastrophic to mild. You must consider that major changes in desktop software may have cause compatibility or functional problems with critical enterprise applications. Therefore, large organizations are skeptical of automatic updates to software across their user-bases.

Q.10: What are ZoneLabs’ solutions that helps users to prevent and solve
Nimda-like threats?
A.10: As an email attachment, Nimda infects users who merely read or preview the infected message in Microsoft Outlook and Outlook Express. They don’t even need to open the infected attachment; the worm exploits a security vulnerability in Microsoft Explorer 5.01 and 5.5–the same vulnerability that the virus BadTrans exploits. This Explorer flaw allows an Outlook message attachment to execute itself automatically on a computer. Nimda exploits this same Explorer bug to automatically download and launch itself if a user happens to browse pages on an infected server. In March of 2001, Microsoft issued a patch to fix the vulnerability, but many companies and users still haven’t installed the patch. This has an important ramification: Nimda can infect even educated users who know not to open suspicious attachments.

Using Zone Labs Integrity, an administrator can require users to upgrade vulnerable versions of their software. For example, the administrator can set and enforce a security policy that automatically routes all users of Internet Explorer 5.01 and 5.5 to a custom upgrade page that explains the situation and directs users through the upgrade process. At the individual PC itself, the Integrity Agent affords multilayered protection. It does this by providing three layers of proactive protection that antivirus programs can’t: MailSafe, Application Control, and a desktop firewall.
MailSafe monitors all incoming e-mail on the user’s computer and quarantines potentially dangerous attachments based on file type. Even without a specific virus profile, it catches Nimda in either of its two forms: .eml and .exe. MailSafe also protects against numerous additional file types, including .vbs, which many other viruses use. Application Control prevents rogue applications on the computer from accessing the Internet. In the case of Nimda, this prevents its built-in SMTP mail server from sending out infecting email. The desktop firewall keeps external threats from making an inbound connection to the computer. This keeps the hacker from connecting to the guest account, shares, or back doors that Nimda or Code Red II created. In addition to protecting the endpoint PC, this stops the crippling Denial-of-Service effect that accompanies Nimda.

Q.11: Looking at ZoneLabs’ future: could you make us a short summary about
your future plans?
A.11: Zone Labs will continue to improve upon and add to our award-winning product line in both the consumer and enterprise space, as well as add new services. Our new AlertAdvisor service (announced on March 6, 2002) is only the beginning of the various services we plan to offer. In addition, over the next couple years our focus will be on international expansion. For example, last year we opened our first European office in Frankfurt and are currently in the process of localizing our products.