Australian businesses most hit by viruses spread over USB keys, security expert warns

Australian businesses are still neglecting simple techniques designed to protect computers from malware, viruses and other malicious material and must be more vigilant when it comes to hardware employees are bringing from home, one security expert has warned.

SophosLabs vice president Mark Harris, who is currently visiting Sophos offices in Sydney, says Australia has a higher than usual occurrence of worms and infections carried through USB memory sticks.

“Looking at our feedback statistics for what is most common in Australia, it seems to be USB worms. It’s quite significantly higher than other areas,” he says. “USB keys are perhaps more common here, or people are sharing more. But it is quite common.”

Harris is referring to viruses that can be spread through USB keys. Because employees often bring their own from home and connect them to a number of computers, it can be difficult to track where the original virus came from.

Harris says part of the problem is that many businesses don’t have proper structures in place to determine the hardware employees can use and for what purpose, noting that many should think about stopping staff from bringing keys from home.

“There are many businesses only stating that certain USB keys can be used. Others say that if you use a USB key, it has to be a corporate one. We certainly have very strict policies at Sophos about what can or cannot be used.”

“Another key point is encryption, always make sure these USB keys are encrypted. They are very easy to lose, and once you’ve lost them, what can you do? It can be very embarrassing if you lose all sorts of data.”

Harris says while many SMEs have focused on protecting their networks from outside attacks – and have managed to do so successfully in many cases – they ought to be now focusing on how to detect threats that have infiltrated their systems.

He points to the prominence of the Conficker virus, which spread across computer networks worldwide three years ago. Harris says many businesses are unaware that such a virus could exist on their networks.

“It’s not necessary that all machines are infected, but that these networks have been infiltrated and Conficker is trying to spread around.”

“It’s not necessarily about protection now, it’s about detecting machines inside the network that have these viruses. The larger the enterprise, the harder this is to do.”

Harris says businesses need to start implementing security policies that emulate occupational health and safety regulations, which state that whenever someone spots a liability, it is their responsibility to report it.

“It’s about all the members of an organisation helping. Security is everybody’s responsibility because it only takes a single person to use the same password, or get phished, and that opens up the entire organisation.”

“It’s like health and safety, certainly in Britain the regulations are that if you see a pool of water, it’s your responsibility to report it. We need to think about security in the same way. If you see something that isn’t legitimate, then report it, and be slightly paranoid.”