http://www.inforisktoday.com/internet-explorer-bug-steps-to-take-a-6801/op-1
Internet Explorer Bug: Steps to TakeExperts Offer Remediation Tips, Details on Vulnerability By Jeffrey Roman <https://plus.google.com/108994419603328824318>, *April 29, 2014.* Faced with a vulnerability that exposes Microsoft's Internet Explorer Web browser to a zero-day exploit involved in recent targeted attacks, *CISOs*<http://www.careersinfosecurity.com/ciso-c-313>need to take prompt action, security specialists say. That includes communicating the vulnerability to end users, using alternate Web browsers and developing an incident management strategy. Meanwhile, organizations must be prepared to deal with other online vulnerabilities as they emerge, warns *Alan Brill*<http://www.databreachtoday.com/cybersecurity-top-priorities-in-2014-a-6377>, senior managing director at security advisory firm Kroll Solutions. "Organizations that don't recognize that - and treat each incident as a separate crisis - are likely to expend more effort going through the incidents than those that develop an incident management strategy," he says. On April 28, the Department of Homeland Security's *U.S. Computer Emergency Response Team*<http://www.us-cert.gov/ncas/current-activity/2014/04/28/Microsoft-Internet-Explorer-Use-After-Free-Vulnerability-Being>urged online users to avoid using Internet Explorer, versions 6 through 11 (see: *DHS Says Stop Using Internet Explorer*<http://www.databreachtoday.com/dhs-says-stop-using-internet-explorer-a-6794>). It warned that the browser vulnerability "could lead to the complete compromise of an affected system." The exploit of the vulnerability by hackers was first identified by security firm *FireEye*<http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html>, which outlined the vulnerability in an April 26 blog post. The company says the exploit is significant because the vulnerable browsers "represent about a quarter of the total browser market." Although Microsoft says it's working on a patch for the browser vulnerability, the company is no longer issuing any patches to users of its Windows XP operating system after recently dropping support for it (see: *End of XP Support: Are Banks Really Ready?*<http://www.bankinfosecurity.com/end-xp-support-are-banks-really-ready-a-6659> ). Threat Severity Because Internet Explorer is widely used, the vulnerability "is a big deal," says *Steve Durbin*<http://www.databreachtoday.com/interviews/how-to-minimize-supply-chain-risks-i-2111>, global vice president at the Information Security Forum, an independent membership organization that offers information risk management research and mitigation strategies. "Internet Explorer has a significant share of the market, so that's a huge number of devices that are now at risk until Microsoft is able to issue a fix." The vulnerability in Internet Explorer versions 6 through 11 could allow hackers to gain control of a user's computer after it's been infected with malware, Durbin explains. "The risk is that you could become more vulnerable to a malware infection that would bypass your anti-malware defenses, allowing hackers and cybercriminals to assume control over your device and use it as if they were the owner," Durbin says. "In short, you lose control over your ability to securely operate your device in cyberspace." *Anton Chuvakin*<http://www.databreachtoday.com/interviews/4-security-priorities-for-banks-i-1566>, a research vice president at the consultancy Gartner, says that the vulnerability allows for a malicious website to execute code on the user's vulnerable Web browser. "Injecting *malware*<http://www.databreachtoday.com/anti-malware-c-309>is one route, but they can also make system changes," he says. "If the user runs an administrative account, more effects are possible." The vulnerability is being actively exploited, Chuvakin says. "It is not a minor worry, but it is certainly not another *Heartbleed*<http://www.databreachtoday.com/securing-open-source-post-heartbleed-a-6791>," he says. "Major Internet Explorer vulnerabilities have been common in the past, and this one does seem to make Web-borne malware injection pretty easy." The Internet Explorer vulnerability is a "tremendous risk," says *Tom Kellermann*<http://www.databreachtoday.com/secure-virtual-supply-chain-a-5836>, managing director for cyberprotection at Alvarez and Marsal, a business management firm. "It is akin to leaving your keys in the ignition in a bad neighborhood. It is imperative that users move to other browsers until a patch has been released. Passwords should also be immediately changed and anti-virus programs run." Mitigating the Risks Organizations in all sectors need to develop a comprehensive incident management strategy, developing methods that work for their particular structure, to be ready for the next crisis, "be it mini or mega," Kroll's Brill says. "Each crisis requires analysis," he says. That includes assessing how, if at all, the organization was affected and determining the steps that need to be taken to respond to the threat. "Having a pre-defined process, working group, notification procedures, and, in some cases, pre-defined plans for various types of crises is incredibly helpful," he stresses To deal with the Explorer vulnerability, Durbin advises organizations to immediately disable Adobe Flash. "The attack is dependent upon Adobe Flash working, so if you disable Adobe Flash within Internet Explorer you should prevent the attack from working, and by so doing, manage your vulnerability," he says. Organizations also need to carefully monitor their networks and defenses and review traffic, he adds. And they need to inform all users about the vulnerability "so they can take the necessary steps on their corporate and personal devices to manage their risk," he says. "Managing your corporate resources alone won't help. If you have a bring-your-own-device policy, your employees are hacked and they don't know about it." *Christopher Paidhrin*<http://www.healthcareinfosecurity.com/blogs/iam-making-case-for-investment-p-1599>, security administration manager at PeaceHealth, a healthcare provider in the Pacific Northwest, says his organization worked to understand the level of exposure it faced and the remediation steps it needed to apply. "We have a desktop team, an automated update program and a security team that won't rest," he says. Applying the Patch Of course, organizations should apply the Internet Explorer patch from Microsoft as soon as it's available. Regarding the patch, Microsoft says once it's completed its investigation, it will take appropriate action to protect its customers, "which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs." But until then, Gartner's Chuvakin notes that "Microsoft also recommends its *Enhanced Mitigation Experience Toolkit*<http://technet.microsoft.com/en-us/security/jj653751>that seems to break the exploitation." CISOs need to educate senior leaders that all Web browsers eventually will be hacked, Chuvakin says. "[Browsers] are complex pieces of software, and this, sadly, means that they will remain vulnerable," he says. "The attackers will break through browser security and, thus, additional layers of security monitoring need to be in place." __._,_.___ Visit Your Group<https://groups.yahoo.com/neo/groups/grendelreport/info;_ylc=X3oDMTJmdDdwajJ1BF9TAzk3MzU5NzE0BGdycElkAzIwMTk0ODA2BGdycHNwSWQDMTcwNTMyMzY2NwRzZWMDdnRsBHNsawN2Z2hwBHN0aW1lAzEzOTg4ODUyMTI-> [image: Yahoo! Groups]<https://groups.yahoo.com/neo;_ylc=X3oDMTJldTFpa2o5BF9TAzk3NDc2NTkwBGdycElkAzIwMTk0ODA2BGdycHNwSWQDMTcwNTMyMzY2NwRzZWMDZnRyBHNsawNnZnAEc3RpbWUDMTM5ODg4NTIxMg--> • Privacy <https://info.yahoo.com/privacy/us/yahoo/groups/details.html> • Unsubscribe <[email protected]?subject=Unsubscribe>• Terms of Use <https://info.yahoo.com/legal/us/yahoo/utos/terms/> __,_._,___ -- -- Thanks for being part of "PoliticalForum" at Google Groups. For options & help see http://groups.google.com/group/PoliticalForum * Visit our other community at http://www.PoliticalForum.com/ * It's active and moderated. Register and vote in our polls. * Read the latest breaking news, and more. --- You received this message because you are subscribed to the Google Groups "PoliticalForum" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
