Bit9 Provides Tips for Effective Desktop Security in Light of Recent WMF Exploits.

CAMBRIDGE, Mass. -- In Second Installment of its Security TIPS Program, Bit9 Company Founder Dr. Todd Brennan Provides Enterprises with Best Practices for Managing Endpoint Security

Bit9, Inc., which solves the problem of unwanted software at the endpoint, today issued new recommendations for security best practices as part of its ongoing Bit9 Security TIPS Program. This program is a series designed to alert enterprises of security risks at the endpoint and to provide advice for proactive remedies. In this second installment, Bit9 is responding to the recent discovery of a critical vulnerability in Windows that could allow attackers to take control of enterprise endpoints.

In its January 5th WMF FAQ, Computerworld noted that the exploit "can be any kind of executable file, but payloads so far appear to be mainly of the adware and spyware type. Some versions attempt to 'recruit' machines into zombie armies, presumably to be deployed for nefarious purposes at a later date." Dozens of known exploits and hundreds of attack methods have been publicized prior to the patch. Although Microsoft has now released a patch, many enterprises were caught off-guard while waiting for it.

"Malformed data files, such as WMFs, are a good example of how porous a modern network is," says Dr. Todd Brennan, a founder and the CTO of Bit9, an endpoint security provider. "Malformed data files are similar to buffer overruns in that they often use unexpected inputs to confuse the system into executing malicious code. A side effect of this is that when the attacker does gain control of the system, it is often in a confused and jumbled state by definition. This usually necessitates an attack with two stages: first, the target program (the data file reader) is mangled/subverted, and second, the mangled program then loads and installs new software on the machine to execute."

But securing enterprise endpoints against these kinds of attacks need be neither reactive nor after the fact. According to Dr. Brennan, a strong file defense -- such as blocking new and unknown software -- is the most powerful protection for enterprise desktops, laptops, and servers.

In addition, Dr. Brennan is advising that when detecting and stopping new and unknown software, that companies do not rely solely on methods that look for known malware signatures or behavioral patterns.

"That's because what is known bad is always after the fact, and therefore out of date. The days of patch and pray - or pray for a patch -- should be long behind us," he says. "And behavioral solutions are very complex to configure given that behavioral patterns are constantly changing."

Unfortunately, software that has no business being on enterprise computers continues to increase. According to the 2005 Deloitte Global Security Survey, 31% of businesses rate spyware as a major threat this year, while Forrester Research estimates that 27% of small or medium-sized businesses do not use an anti-spyware product. Meanwhile Webroot has found that a full third of scanned enterprise PCs were infected with adware. Even so, Dr. Brennan suggests that spyware and malware are only part of the larger problem of unwanted software, which includes unlicensed applications and any non-business application that companies don't want running.

As well, he adds, different groups of computers may require different protection levels at different times. "One size of security does not meet all of the needs of today's dynamic enterprise," says Dr. Brennan. "Companies need simple, reliable, effective solutions that are flexible and easy to implement."

Dr. Todd Brennan is a founder and Chief Technology Officer of Bit9, Inc., which is solving the problem of unwanted software at the endpoint. Prior to Bit9, Dr. Brennan founded Okena, which was acquired by Cisco in 2003.

Unlike other endpoint security products that focus on what's wrong or malicious, Bit9 Parity is the only solution that detects and controls what's new and unknown--without relying on malware signatures or behavioral patterns. Based on patent-pending technology, this approach offers protection and coverage that today's other solutions can't.

About Bit9, Inc.

Bit9 is the first company to solve the problem of unwanted software at the endpoint. As the only solution to detect and stop spyware, malware, and non-business applications on desktops, laptops, and servers, Bit9 gives IT professionals unprecedented, network-wide visibility and control in real time. Bit9 provides the earliest and best possible protection against known and unknown intrusions, including Zero-day attacks. Founded in 2002 and headquartered in Cambridge, Massachusetts, Bit9 is a privately held company. For more information, visit www.bit9.com.

Bit9, Inc. and Parity are trademarks or registered trademarks of Bit9, Inc. All other names and trademarks are the property of their respective owners.