Tag Archives: malware

World Cup 2014 is kicking off. Is your network ready?

fifa-world-cup-2014-brazil-logoThe 2014 FIFA World Cup games begin today and will run until July 13. Since the broadcast of the last World Cup in 2010, the number of Americans who have watched, attended, or listened to a major soccer match has increased by 32%. If most of your employees start streaming the games or highlights simultaneously, can your Internet bandwidth sustain the demand? 42% of IT professionals state that popular events impact their network. How many simultaneous users watching game highlights does it take to saturate your bandwidth? Just 2 streaming users result in a 1 megabit-per-second download, while 17 users equal a huge 10 megabits per second. The Internet bandwidth is quickly overwhelmed. Given the time difference with Brazil, most of the 64 matches will be played during U.S. office hours, and streaming video could deal a major blow to corporate network and application performance. When the first match of the day kicks off, smartphones, tablets, and laptops will be streaming footage live from offices around the U.S.

In addition to the major spike in bandwidth usage, World Cup 2014 malware sites are out there! According to a recent survey from Osterman research, some kind of malware has infiltrated 74% of organizations via the Web increasing security risks. Another major revenue loss for companies is lost productivity. The World Cup 2014 is 27 days, 66 matches, and a total of 99 hours average wages lost per hour each day.

Wavecrest’s Cyfin and CyBlock products and services help all types of organizations manage and control employee Web activity.Cyfin and CyBlock products do this by monitoring, filtering, and bandwidth throttling employees’ Web use, and reporting on the activity by content categories, e.g., sports, social networking, games, and others. Of particular note, with regard to the World Cup, CyBlock products can be set up to block Web access by categories and by half hour so employees can access sports sites on their lunch break or after hours. This approach can help sustain morale while minimizing lost productivity and bandwidth associated with the World Cup.

CyBlock Web Security Solution is now available in the Cloud

 Melbourne, FL, Dec. 9, 2013 (GLOBE NEWSWIRE) — Wavecrest Computing, the makers of CyBlock, have just announced the availability of a Cloud version of CyBlock. Now companies have access to the most popular and solid Web Security solution in the Cloud.

CyBlock Cloud Web Security is an easy-to-implement solution that benefits organizations of all sizes and quickly safeguards your network. Whether you have branch offices, remote users, or just one location, CyBlock Cloud protects your company and its employees allowing you to take advantage of time and money savings. Enforce your company’s AUP by defining one or more Web-use policies to successfully address Internet abuse, legal liability, workforce productivity, and Web security threats.

“We are very excited to be extending our product line into the Cloud market. Now, new and existing customers who are considering a cloud solution have one less worry. Starting today they can access an industry tested and proven solution with a successful 13 year track record. CyBlock Cloud is a perfect addition to Wavecrest’s line of industry leading Web Security Solutions.” CEO – Dennis McCabe

Wavecrest Computing has been the recognized leader in Web-access security and Web-usage forensics solutions for the last 16 years. Our scalable filtering and forensic reporting analysis products are designed to enable organizations to successfully address Internet abuse, legal liability, workforce productivity, and Web security threats. Wavecrest Computing’s client list includes well-known corporations such as Edward Jones, General Electric, Lockheed Martin, Blue Cross Blue Shield, MillerCoors, Rolex, Siemens, and others.

Link to Press Release.

Analyze Your Encrypted Traffic With CyBlock SSL Inspection

In huge numbers, more and more organizations, particularly e-businesses, are using Web-enabled applications that involve the use of personal, private, and sensitive data. Banking, online shopping, and credit card transactions are good examples, but by no means the only ones. SSL encryption is being increasingly used to protect the confidentiality of this business and personal data on the Web. Surveys show 25%-35% of enterprise traffic is SSL-encrypted, and the number can be as high as 70% in specific industries. SSL encryption is the most cost-effective way of protecting the privacy of this traffic.

While SSL encryption solves many privacy-protection problems, it can allow traffic that poses security threats–both inbound and outbound–to pass through security protection measures uninspected and unchecked.

Inbound Problem.  SSL encryption creates security blind spots in incoming traffic. The traditional security infrastructure that protects an organization is blind to the threats in inbound SSL traffic and provides an easy vehicle for criminals and hackers to hide their cyber attacks.

Outbound Problem.  In addition to the risks of incoming threats hiding over SSL channels bypassing security protections, outbound enterprise traffic is now a growing problem. This is becoming quite a “hot button” for security applications (e.g., content filtering applications) that tackle data loss prevention (DLP), compliance reporting, and lawful intercept. In the past these solutions could see what was outgoing, but now they are suddenly “in the dark” when it comes to the data transferred over SSL.

From a security standpoint, most organizations already deploy an array of network and security appliances and programs to protect their enterprise, enforce internal corporate acceptable use policies, and satisfy external government regulation. Unfortunately, in many instances, they can only inspect plaintext traffic and are unable to inspect HTTPS communications for attack signatures. This makes it difficult or impossible for network administrators to enforce corporate acceptable use policies or ensure threats, such as viruses, spam, and malware, are stopped before they reach individual users.

In addition, without the ability to examine the contents of HTTPS communications, network administrators leave open the possibility for information to be accidentally leaked out of the enterprise or worse, stolen. Regulatory compliance requirements, including identifying accidental or intentional leakage of confidential information, are also virtually impossible to meet because of HTTPS encryption.

CyBlock SSL Inspection gives network administrators the ability to monitor this SSL-encrypted traffic and to identify and respond to any undesirable content. The total HTTPS inspection process decrypts, analyzes, categorizes, and then re-encrypts the traffic. If necessary, specific standard and/or custom URL categories can be exempted from the inspection process; this is known as “tunneling.” In addition, full URL information in a number of Wavecrest audit reports is available to network administrators.

To learn more about how CyBlock SSL Inspection can protect your sensitive data, please see our SSL Inspection Tech Brief or contact Technical Support at (321) 953-5351, Ext. 4 or support@wavecrest.net.

Source:  Examining SSL-Encrypted Communications – Netronome

Enhanced Malware Protection

Wavecrest Computing is pleased to announce an enhancement that delivers a tenfold increase in CyBlock’s ability to protect computer networks from malware and Cyfin’s ability to identify increasing security threats. Here is some background information.

Malware is the scourge of the Internet. The term “malware” includes computer viruses, worms, Trojan horses, spyware, adware, and other malicious programs that can disrupt computer operations, gather sensitive information, or gain access to private computer systems. For Wavecrest’s purposes, malware also includes Web sites that support hacking. Most malware originates and is spread from particular Web sites. Unfortunately, many thousands of such sites exist today, and to make matters worse, the number is growing steadily every day at distressingly fast rates.

The malware problem is not new to Wavecrest. For a number of years, companies have been using CyBlock and Cyfin products to protect against and identify automated invasions of malicious scripts and software, and unauthorized access to their internal networks–the two major problems caused by malware. CyBlock provided protection–under customer control–by blocking and reporting on employees’ attempts to visit sites in 3 of more than 70 URL List categories: Hacking, Phishing/Fraud, and Spyware/Malicious.

While this methodology was effective, it was not perfect. The difficulty lay in keeping the URL List up to date in the face of the relentless and rapid increase in the number of malware-spreading sites. This issue has been addressed with an enhancement that significantly improves the ability to keep the list current.

At the same time, three related categories, Hacking, Phishing/Fraud, and Spyware/Malicious, have been consolidated into one called Malware. This consolidation increases the ease of administration for customers.

This enhancement with its improved URL List is included in the latest release of CyBlock v.6.8.0 and Cyfin v.8.8.0. To realize its benefits as soon as possible, it is recommended that you upgrade your CyBlock or Cyfin product as soon as you can. Wavecrest will continue to update the enhanced list daily and make it available for download by customers. The download process remains unchanged.

You can schedule the list to be downloaded automatically every day, or you can download it manually at any time. In any case, as soon as it is downloaded, you will immediately begin to receive the added protection and see a significant reduction in the number of security threats to which you may be exposed.

To download the latest release, go to the Administration – Product Update screen in your CyBlock or Cyfin product. For additional assistance, please contact Technical Support at (321) 953-5351, Ext. 4 or support@wavecrest.net.

Cyfin Release 8.8.0 and CyBlock Release 6.8.0 Now Available

We are excited to announce the release of two major enhancements in the new version of Cyfin and CyBlock. The first major enhancement is the new SSL Inspection feature that allows our CyBlock products to decrypt, analyze, and fully inspect all HTTPS traffic. In order to defeat security threats facing companies today, SSL Inspection is essential. The second major enhancement is an innovative technique for protection against automated invasion of malicious scripts and software and/or unauthorized access to internal networks. Enhanced Malware Protection automates the process of identifying large numbers of new malware-spreading sites daily. To facilitate identifying and blocking malware traffic, three security threat categories have been consolidated into a new Malware category.

Other enhancements in this release include the rebranding of our products, new product icons displayed after installation, and new product Help. We also have a number of corrections in this release. The details of the enhancements include the following:

  • Product Rebranding.The Wavecrest products have been rebranded as follows:
    • The products offered are CyBlock and Cyfin (formerly Cyfin Reporter).
    • Three deployment options are available for CyBlock:
      • CyBlock Software (formerly CyBlock Proxy)
      • CyBlock Appliance
      • CyBlock ISA/TMG
    • These changes are reflected on the Wavecrest Web site and the Forum. They will eventually transition to the products and associated documentation.
  • SSL Inspection.This includes the following changes:
    • Ability to view the full URL including path, embedded URLs, and parameters.
    • Domain, path, and parameter matching.
    • Ability to filter detailed HTTPS traffic by Web categories and Web content types and display blocking messages for both.
    • Safe Search blocking (where applicable).
    • Ability to view full URLs in the Real-Time Web Monitor.
    • Ability to view full URLs in the following reports (where applicable), not just domains:
      • Category Audit Detail
      • Category Audit Summary
      • Site Audit Detail
      • User Audit Detail
      • User Audit Summary
    • A new SSL Inspection screen that allows you to select groups and/or IDs and standard and custom categories to be inspected. To access this screen, go to Advanced Settings – Proxy Settings – SSL Inspection. For inspection to occur, you must select a group and/or an ID, and set a category to Inspected. The Financial category is set to Tunneled by default for privacy reasons, but this can be changed to Inspected.

Note:  Before using SSL Inspection, the Wavecrest Certificate must be installed. Refer to the Wavecrest Certificate Installation Guide for instructions on how to install/distribute the certificate. For more information on this enhancement, see the SSL Inspection Tech Brief.

  • Enhanced Malware Protection in URL List.This includes the following changes:
    • Extensive malware site additions were made to the URL List. You will receive the enhanced protection when the list is downloaded manually or automatically.
    • The Hacking, Phishing/Fraud, and Spyware/Malicious categories were consolidated into a new Malware category.
    • Custom URL entries categorized as Hacking, Phishing/Fraud, and Spyware/Malicious are now categorized as Malware.
    • The Hacking, Phishing/Fraud, and Spyware/Malicious categories were replaced by the new Malware category on appropriate screens and in all category drop-down boxes.
    • For CyBlock, on the Block Web Categories screen, the Malware category is set to “Block” in the Default policy in new installations by default. In existing installations, previous settings will not change when the product is upgraded, that is, the Malware category will be set to the previous Spyware/Malicious category setting.
    • The Malware category is displayed on the Help – Reporting – Check URL screen under URL Category Match when there is a category match.
    • Scheduled reports now report on the Malware category if they were set up to report on the Hacking, Phishing/Fraud, and Spyware/Malicious categories.
  • Product Icons. The Wavecrest product icon has been replaced with new CyBlock and Cyfin product icons on the Start menu and on the browser tab (favicon).
  • Product Help. The QR pages in the product have been replaced by a new searchable Help system. The Help system has a similar TOC as the product manual, but also includes an Index and a Search box. If a search result indicates “Web site,” you can right-click the entry to open the page in a new tab or window. You can also print a displayed Help topic by clicking the Print button.

To see the full release notes for your product, visit the Support Forum. You can download the latest release by going to the Administration – Product Update screen in your Cyfin or CyBlock product.

For additional assistance, please contact us.

What employers need to know about online holiday shopping

Leave a reply

It’s that time of year again. Christmas is coming, and it’s time to find the best deals and research the best products. And where does everyone go these days to find the deals and do their product research?  You guessed it. The Internet.  Should employers be concerned with this? Absolutely!  Online shopping results in significant productivity losses, excessive bandwidth usage and serious threats to cybersecurity.

Lost productivity can mean big bucks for your company. A recent study by Comscore found that 50% of all online holiday purchases occur during working hours. For the companies in the study, the typical productivity loss during the short holiday season averages $15,000.

Adding insult to injury, the additional traffic will lead to network slowdowns due to significant increases in bandwidth usage. Just as they did in previous years, online retailers are now preparing bandwidth-hogging promotional videos to help sell their products. Remember last year?  On Cyber Monday 2011, video views increased by 897 percent over the previous year. And now the number of views this coming Cyber Monday are expected to exceed last year’s. So, it is critical to prevent vital bandwidth from being consumed by non-productive Web-use.

Contributing to the danger, hackers and identity thieves are very aware of these online shopping patterns. They are fully prepared to deceive online holiday shoppers with very appealing schemes – “deals” that require them to click a link to special discount or filling in personal information before they can get the deal. These acts can lead to malware infection or pose significant risks to your organization’s network and sensitive data.

The peak period for all these holiday-related problems is coming soon. The Comscore study tells us that 80% of all annual online purchases occur between Nov 26th (CyBer Monday) and Dec 14th.  So now is a good time to remind your employees of your organization’s Web-use policy and make sure you have the right protections in place.

Dennis McCabe, President of Wavecrest Computing, recommends that companies monitor and/or filter employee Web-use to better protect themselves from lost productivity, excessive bandwidth usage and security threats. His company is ready to help them do this.  Easy to use and priced to fit any budget, Wavecrest products are tailored to address all aspects of Web-use management reliably and cost-effectively.

About Wavecrest

Since 1996, Wavecrest Computing has developed, marketed, and supported a spectrum of innovative Internet usage monitoring, analysis, filtering, and reporting solutions. Their products help all types of organizations manage employees’ online activities, ensure compliance with acceptable use policies, preclude legal liability and prevent bandwidth abuse. Founded 15 years ago, their client base has grown to more than 3,000 organizations, including many prominent Fortune 500 companies and high-profile government agencies.

What Is the Purpose of the ‘IP Address’ Category?

Leave a reply

From time to time we are asked, “What is the purpose of the ‘IP Address’ category used by Wavecrest products?” The short answer is — it’s used to capture and segregate the IP addresses of Web sites that the product was unable to associate with ‘regular’ categories. Customers can then analyze them to identify network security threats, traffic to intranet sites, or other patterns of interest.

Here’s a bit more detail.

First note that our products identify many IP addresses and place them in content categories. The Wavecrest URL (control) list contains many such addresses.

Unfortunately though, initially unidentifiable IP addresses still appear from time to time. Generally speaking, we see three types, i.e., addresses associated with:

  1. Internal (and partner) Web pages
  2. Innocent links on Web sites
  3. Possible malware or virus servers

When the product encounters any of these three types, it places them in a special ‘IP Address’ category. Customers can then run reports on that category the same way they do on any other category. In addition, if the customer runs a Top Non-Categorized report, the uncategorized IP addresses will be listed along with uncategorized domain names.

Because the traffic associated with unidentified IP addresses can be important or even dangerous, it’s obviously desirable to pursue the matter further. So what can be done? Well, with a bit of work—and in some cases with some help from Wavecrest—it is possible to:

  • determine the source and purpose of most of the addresses
  • categorize the legitimate ones
  • isolate/neutralize the malicious ones

Let’s see how this is done. We’ll take it one ‘type’ at a time.

  1. Internal and Partner Web Pages. Some unidentified IP addresses may have resulted from users going to internal (intranet) or partner sites. (These normally would not be in the Wavecrest URL list.) To address this issue, start by running a Top Non-Categorized Sites Report or IP Address Category Report. Using your local knowledge, try to determine the IP addresses of those sites and then enter the information in one or more custom categories. (Instructions on how to create custom categories can be found in our manual.)
  2. Innocent links on Web Sites. These addresses could be associated with image or ad servers. If you want to address this issue, send a copy of a Top Non-Categorized Sites (“OtherWise”) Report to Wavecrest (sites@wavecrest.net). Our categorization team will then research and categorize the unidentified IPs for you the same way they categorize domains. If you would like to identify the IPs yourself, you can use IP address lookup tools such as the one available from https://www.networksolutions.com. This tool will provide you with information about the owner of the IP address(es) of interest. For example, the owner of the IP address could be a marketing company that serves ads, or it could be an image server. Once identified, if you desire, you can add the addresses to one or more custom categories.
  3. Possible Malware or Virus Servers. Some of the unidentified IP addresses could be associated with malware, spyware or virus servers. The clue here is very high around-the-clock traffic. This is an indication that the user’s computer has been infected or attacked. The solution in these cases is to isolate the internal computer(s) and remove the malware/spyware or virus. Here’s an approach you can use to help solve this problem.
  • Using the Dashboard, run a Trend report on the IP Address category and look for any unusual spikes. If you see anything suspicious then …
  • Run a category audit on the IP Address category and look for large amounts of activity coming from a particular PC(s). Make a note of the IP address(es) and then scan for infected files.

Summary. The IP address category was created to be a ‘red flag.’ Its purpose is to alert you that further action may be needed to resolve problems or to simply give you a more complete and comprehensive picture of all Web activity.