Business Security Information

When you look at the desktops, laptops and other devices in your business, do you realize the number and variety of software applications running on these devices?  Applications include Adobe Reader, Adobe Flash, Microsoft Office, off-the-shelf accounting software, and other similar types of applications.  Beyond these normal applications found on most computers, custom applications may also be used in your business such as credit card processing, accounting or other business-oriented software applications.  Most business owners and managers do not realize the number and variety of applications running on the computers they use.  Studies have shown that businesses spend most of their security efforts updating and securing the computer’s operating systems and not the software applications.

It is estimated that approximately 80 percent of security vulnerabilities are related to software applications.  The number of unpatched vulnerabilities on most computers is significant.  For more detail on software vulnerabilities and how attacks occur, go to the SANS website and read this article. It is clear from SANS as well as other sources that the number of third-party software application and web application vulnerabilities is greater than operating system vulnerabilities.  Recent attacks using vulnerabilities in Quicktime and Adobe Reader software applications are just two examples.

7 Ways to Improve Desktop Security

Here are some steps you can take to improve the security related to software applications for your business:

1. Be aware – First, be aware that software application vulnerabilities allow attacks against your network. Just by reading this post, you are now aware that you have numerous applications running on your computers, and that they can contain vulnerabilities.
2. Inventory Software – Inventory the software applications you have running on your computer systems.  It is impossible to protect something you don’t know you have.
3. Patch – After discovering what applications you are running on your computers, research to see if there are any updates or patches available for the applications you are using.  Also, uninstall any applications that are not needed or used in your business.
4. Configure Software – Look what configuration options you have available for each application and make sure the application is configured as securely as possible.
5. Defend Against Malware – Make sure you have software installed and updated to protect the computers against the many variations of malware.  If an attack is successful, you have a better chance of containing the malware and limiting any damage to your network.
6. Limit Administrative Rights – As I have written before, limit the use of administrative rights (LINK TO ADMINISTRATIVE RIGHT ARTICLE) or accounts on a computer.  If all else fails, the attacker initially is limited to only being able to do what a regular user can do on the computer.  Most user accounts do not allow the installation of new software without administrative rights.
7. Check Vulnerability Announcements – Lastly, I would suggest that you sign up for automatic notification through e-mail or an RSS reader from one of the many vulnerability tracking websites.  SANS is one of my favorite, but there are many good ones out there.  You can sign up for the e-mail newsletter of RSS feed at SANS.  I would suggest signing up for the Consensus Security Alert newsletter or RSS feed.

These are some key steps in implementing improved computer security at your business.  If the applications you use are not vulnerable, the number of possible attack methods that can be used against your network is also reduced.  Since software application updates are usually left to the user of the computer, it is important that business owners and managers stay on top of the issue.  How many of your employees would even feel the need or spend the time to update the applications they are using unless you make it a priority!

There are always more things that can be done to address this type of security issue, so please leave a comment and share your knowledge and insight with the rest of the readers.       

Related posts:

1. Reducing Security Holes in Administrative Rights
2. File Sharing Software and Information Security
3. Exploit