Many vendors now have a rigorous attitude towards patching and updating their systems. These days, Microsoft is frequently used to demonstrate best practice and other manufacturers are following suit to provide regular updates to their systems.

In the third of our advisory notices on ‘forgotten security’, we advise companies to implement a change control procedure prior to making any changes to their network security. The absence of a change control procedure can result in ad-hoc changes which risk compromising security.

Routing can be tricky.  If you know where data is going, you’re half way to resolving a large number of application problems.  But understanding where data is being routed to and from is crucial in the security arena. Incorrect routing can result in security measures being bypassed or reduced to allow for badly configured networks.

Companies are protecting themselves from high-profile threats such as malware attacks, but are often leaving themselves vulnerable from the ‘forgotten security defences’. The first of these results from simply not monitoring the applications, hardware and security systems across the business, which can lead to network failure.

Network Box’s IDP solution is just one component of its unified threat management (UTM) managed service (it was competing with pure-play IDP systems in the test). In addition to  IDP, Network Box includes firewall, VPN, anti-virus, anti-spam, anti-malware, and content filtering within its UTM service. Its service is continually updated using PUSH technology, which literally pushes new signatures and updates to each Network Box device as soon as it is available, with no need for manual updates (or expensive annual upgrades). This makes it exceptionally good value for money compared with individual products. As the review states: “this product offers a solid value for the money as it can be set up to be a fully managed UTM device”.

Guidelines for companies on peer-to-peer networks, such as BitTorrent, on the company network.

We are often asked by clients how to block a particular application, most notably one that includes instant messaging (IM), such as Facebook, Skype, MSN etc. But the problem with blocking an application is that it will often find a way through a firewall – either using ‘tunnelling’ software, or by searching through all available ports until it finds one open (a problem that can be solved through security systems such as Network Box). So securing the application, and creating user policies on how and when to use it, may be a more effective solution than simply blocking IM altogether.

Guidelines for companies on creating policies around employees' access to social networking sites, such as Facebook, during work hours

It seems you can’t open a newspaper or look at a news site without seeing Twitter all over the headlines. From Barack Obama’s use of Twitter during his election campaign, or reports that the primary school curriculum will include teaching children about Twitter, to growing concerns about identity theft on the site, it is clear that the micro-blogging platform is in a phase of enormous growth.

Guidelines for companies on securing social networking sites, such as Facebook, during work hours.

Corporate bloggers need to pay as much attention to the security of their blogs as they do in writing them, to avoid being hacked. This Guide to Secure Blogging gives bloggers clear and simple guidelines to keeping blogs - and their readers' safe from hackers.

Threats from the internet are increasing and, as a result, a growing number of large companies have turned to managed security services as a cost-effective way of providing the expertise needed to keep these threats at bay. The decision to outsource security management to experts is taken by large organisations that have done the maths and recognise that it offers the best overall return on investment, protecting both the business and its customers from the disruption and cost of a security breach.

Legislation on protecting data in the UK – such as the Data Protection Act 1998 (revisions, that take effect in April 2010, were introduced to the Act in 2009) and PCI DSS – have made good security even more important for businesses. Since the introduction of the Data Protection Act in 1998, a company breaching data security rules could be served an enforcement notice by the Information Commissioner and made to clean up its act. In January this year, the Information Commissioner was given greater powers of enforcement, and the ability to fine companies breaching data security up to £500,000.

Car dealerships rely on IT systems and internet connections now more than ever before. Whether it is to provide an open connection to a third-party supplier database, to download manuals, to connect online with customers, or to use bespoke applications to provide inventory information, security is of increasing importance in this environment.

Network Box includes multiple Intrusion Detection and Prevention Systems (IDPS) working together in combination with the core routing and firewall functions, to provide a highly-flexible and modular approach to the problem of securing network traffic.

Recent years have seen a number of high-profile security breaches hit the public sector. Data privacy in particular is a serious concern, and is more tightly governed than ever before, with higher penalties for organisations that don’t comply effectively with legislation. At the same time, more public service business is conducted online, as information is distributed to citizens through web-based applications.

Identity fraud is rising. It is increasingly simple, with more ways of doing it than ever before. As more and more applications become available to us over the Internet, there is a growing need to prove our identity, in order to prevent criminals from taking advantage of us.

In the past year there have been a number of debates on the need for online privacy. Some commentators (Sir David Omand and Scott McNealy) have argued that privacy online must be sacrificed for progress and security whilst others insist on privacy being paramount in a free society (Sir Tim Berners-Lee and Sir Ken Macdonald).

There are two forms of attack on privacy which will be discussed in this document:
1. Data gathering by government and industry
2. Data leakage as a result of issues with browsers

Guidelines for companies on creating policies around employees' access to social networking sites, such as Facebook, during work hours

Sun Tsu once wrote that "the control of a large force is the same principle as the control of a few men: it is merely a question of dividing up their numbers". The Network Box Mail Portal system addresses just that - control itself, and the delegation of that control. While the Network Box web interface permits the administrator to view and control the Mail policies of the organization, at the gateway, Mail Portal allows the administrator to delegate that control to end-users and put them in control of their own email (while still being restricted by overall company policy).

Email envelope pre-scanning functionality, is a new technology which allows Network Box systems to make a very sound judgment on whether an email is from a spammer or not; without even needing to actually download and scan the email itself.  Pre-scanning email
envelopes can improve throughput, and also free up valuable Internet bandwidth from being wasted.

Losing sensitive data in transit is a burgeoning issue for individuals whose data has been lost, as well as businesses. Not only is data loss damaging to the reputations of companies involved, it can have other far-reaching implications, such as leaving businesses open to financial attacks from hackers, or causing intellectual property to land in the hands of competitors. Employees themselves also have reason to worry, with the proposal of legislation that could see individuals who negligently disclose personal information imprisoned for two years.

At Network Box, one of the most common questions we're asked by IT directors and managers is how to protect wireless networks. Obviously, there are many security technologies on the market that are capable of securing wireless networks; but what businesses and home users don't appear to understand is that they can greatly increase the security of their wireless networks simply by switching protocols from wired equivalent privacy (WEP) to wi-fi protected access (WPA).

The continual success of the network security industry is only as effective as the security professionals that run it. This means recruiting high-calibre security professionals is essential for any organisation wishing to be protected from the external and internal threats. Identifying, training and retaining security personnel is hard, often proving to be a time-consuming and expensive process.

In late 2006, an old technique became popular again with the blackhats. They resurrected parasitic malware, a technique whereby malware is added to existing files on a system. During 2007, this form of malware flourished with McAfee Avert Labs identifying 150 new variants of parasitic malware, Philis and Fujacks. New viruses using this technique were also discovered, such as Grum-A, and it seems that this technique has made a comeback.

As the world of ATMs evolves and they become connected to the Internet, IT security is fast becoming a pressing concern, which needs to be addressed before a major incident causes the public to lose confidence in this very useful tool.

As broadband connectivity spreads, companies are beginning to use it for voice telephony. This is known as Voice over Internet Protocol or VoIP. One of the most popular VoIP systems is Skype. But just how safe is it? While it's great for end users, from the network administrator's point of view, and from the security point of view, the doors may be wide open.

Phishing is fraudulently attempting to acquire sensitive information like passwords, credit card details etc. It is tied into the growing crime of identity theft and, over the past two years, there has been a big increase in this form of crime. So what can a company do to protect itself from this form of attack?

Senior managers outside the IT department will most likely have a very hazy impression of what is meant by the terms blogging, iTunes, MySpace or MSN messenger. Yet the use of these new technologies at work is a major threat to their businesses.

The era when script kiddies were the primary online threat has long since passed. Today, hacking and malicious code are big business. Too big, it would seem, for some blackhats to manage single handed.

This brochure has been written for IT managers who aren't security specialists, but who want to make good decisions about IT security.

As users blur work and personal Internet use, particularly on their own devices, you could find your organization exposed to malware simply because of their ignorance. Businesses need to think laterally when it comes to protecting their networks from attacks that may come in through a growing array of network endpoints – including smart phones, PDAs and laptops – that are being used to access social networks, blogs and micro-blogs, and photo and video-sharing sites.

Schools today face increasing internet security risks from the number of new platforms and technologies used by pupils and teachers in and out of the classroom. The proliferation of social networks such as Facebook, Bebo and MySpace, instant messenger (IM) platforms, and file-sharing and peer-to-peer applications and software mean that the IT teams in schools have to cope with an even greater number of threats than many corporate networks.

According to figures from IDC, 20 per cent of businesses use Google Docs ‘widely’ within their businesses, with this figure likely to increase in 2010. But as businesses move away from traditional working practices and towards more flexible (and often free) communications services, they may be compromising privacy, and data security.

This guide gives companies the information they need to decide whether or not they should use free email hosting, browser and document storage services.

In 2009, the Radisson hotel group revealed that it had been the subject of a server hack that compromised the personal details (including credit cards) of guests for six months. In January this year, V3 reported that the international hotel group Wyndham Hotels announced that it too had been the subject of a hack, with data and credit card details stolen.

The nature of how sports clubs interact with fans has changed significantly over the past few years. More tickets, kits and souvenirs are bought online; games are streamed live on club websites; and some clubs are even creating entire online communities to connect fans, shareholders and players.

But although technology is changing the way sports clubs interact, the essence of sport is that it is a physical, not a virtual activity, and so technology is often not a primary concern for a club. Many clubs outsource the running of their website to a third party organisation, and it is left to a small IT team, or single IT manager to make sure the systems that connect into that site are secure.

James Pickering was asked to give advice and guidance to Network Box Corp (UK) Limited in relation to the application and effect of the Data Protection Act 1998 (“DPA 1998”). In particular, he was asked to outline the obligations imposed on businesses and their potential liabilities in the light of a number of significant amendments recently made to the DPA 1998 in response to a number of high profile contraventions.

Political leaders continue to hold conferences and sign treaties as the need to tackle cybercrime at an international level rapidly increases, but ultimately these attempts at agreement fail due to national interests and diplomatic concerns.  This whitepaper looks at what has been done and why agreements have failed to be ratified.

Denial of service attacks continue to grow in sophistication. This article considers the gains that such attacks can offer criminals, and examines the various types of attacks used today.  (First published in NESE http://www.elsevierscitech.com/nl/ns/home.asp)

The problem with spam detection is how to define spam.  This guide examines current techniques on how to define and then detect spam; and how spamming itself evolved... and how to avoid detection.

The nature of how sports clubs interact with fans has changed significantly over the past few years. More tickets, kits and souvenirs are bought online; games are streamed live on club websites; and some clubs are even creating entire online communities to connect fans, shareholders and players.

But although technology is changing the way sports clubs interact, the essence of sport is that it is a physical, not a virtual activity, and so technology is often not a primary concern for a club. Many clubs outsource the running of their website to a third party organisation, and it is left to a small IT team, or single IT manager to make sure the systems that connect into that site are secure. At Network Box, we work with a number of sports clubs – particularly football clubs, such as Tottenham Hotspurs, Sunderland FC and Norwich City – to support the in-house IT team and keep the club’s networks secure.

Most of the hoaxes people encounter these days come to them via the Internet. The number of opportunistic and targeted Internet-based crimes and misdemeanours carried out every day results in stolen data and damaged systems, and costs companies many hundreds of thousands of pounds. Other threats are more personal, attacking individuals and stealing their money and in extreme cases, much worse. However, the vast majority of users’ day-to-day experiences are positive, and being aware and prepared can help prevent them from falling victim to cyber-crime.

Whether you allow your users to work from home, from the airport, or from anywhere else and remotely access resources on the company LAN, there are some important and serious security implications you need to consider to ensure that your remote workstations, laptops, and especially data, are properly protected.

'Back-scatter' is the deluge of messages the 'sender' receives after a mailing has gone out. It is caused by systems that accept mail during delivery, but  then cannot deliver the mail.  The system then sends back a bounce message.  This whitepaper gives more information on Backscatter Spam and how the Network Box deals with it.