The Industry’s Insight about Anti-Malware Testing

The journalist and blogger Kevin Townsend posted some interesting queries about the AMTSO or the Anti-Malware Testing Standards Organization. One question that surely caught the attention of many is, “Is AMTSO the anti-malware industry looking after itself?” Yes in some cases, but it can go bad when penetration testing and anti-malware testing goes awry. It is because good testing means better promotion for products, while bad testing will promote the bad ones – the ones that could cause unwarranted results and damages. That is not good.

You see, Townsend is not the only person having suspicious thought about AMTSO, Security Curve believes that AMTSO is a list of companies involved in the anti-virus industry. The list is not limited to them but also to non-vendors and influential testers in the security industry. However, their issues are 2 different things. Security Curve addresses the fact why AMTSO have members who are deeply connected to the anti-virus industry. It is an inappropriate conduct to have those who sell the product to test and criticize the product. And that the organization has to solicit the input of other testers, those who are known and considered to be experts in their field such as pen test or internet security.

However, Townsend sees the testers and the ones who are selling the software as two peas in a pod. He may have a point since, the testers and those sellers have some sort of symbiotic relationship. Testers need new product that they could test, while vendors need professionals who can test their products and provide data about them.

There is no such thing as monopoly on the millions of malware samples available. Information security labs have seen thousands of new and distinct malicious codes every day. Because of this interesting number, it has generated lots of problems, and that is not only in testing. It affects almost everything from the rational management of data to the exchange of samples, codes, data and also metadata. These issues are being faced together by testers and anti-virus sellers alike. Although the exchange between the two can be called as cheating by those who are outside the group, it is not some polluted and vile plot to make bias testing and results. The reason is that it is appropriate to share the data and samples to form and maintain a competitive edge and advantage with each other.

But in Townsend’s complaint, AMTSO doesn’t encourage other individuals and personalities outside of their circle to join them. We cannot argue that the security software has to be properly made sure that everything they are doing would help most users facing the brunt of attacks. However, AMTSO must inform and also educate the public and not just engage with them. Sadly, even if AMTSO is a non-profit organization, running the organization needs substantial amount of money, thus the fees are very expensive for regular people to take part with.

It doesn’t mean that opinion coming from the public doesn’t matter at all. In fact, public has the most influence on the cyber security industry today because of the money they use in purchasing the products of these companies, which are used in research in security and many more. The only reason why the representatives and the members of AMTSO are limited to some, it is because AMTSO are looking for experts; experts whom they can exchange information with and actually help in their roles in achieving a more secure Internet system. Before the public could say something against AMTSO, they must make sure that they know more about how the testing really works. In fact, they should apply for penetration testing training or any other security training, before they can say something against it or maybe help improve the system being tested.

Maybe, it would be much better if AMTSO would engage more with individuals like Townsend, but it is highly unlikely now. Most likely, it won’t become a “free for all”. But if this can be done sooner or later, then each side would surely look for ways to meet in the middle, like changing some things about AMTSO and how they conduct their practices. Perhaps, positive changes might happen like a cheaper membership for certain members, better information dissemination or others. We will just have to wait.

The International Council of E-Commerce Consultants (EC-Council) is a member-based organization that certifies individuals in cybersecurity and e-commerce. It is the owner and developer of 20 security certifications. EC-Council has trained over 90,000 security professionals and certified more than 40,000 members. These certifications are recognized worldwide and have received endorsements from various government agencies. They also offer trainings in penetration testing.

More information about EC-Council is available at www.eccouncil.org.

The History of Cyber Security

The term cyber crime is all the same as any other kind of crime – there is a culprit and also a victim. For the cyber crime to become successful, it needs the same component of other crime; the motive, the opportunity and the means. When one can view the brief history of cyber crime we could see that the elements for the motive, opportunity and means are few, thus computer crime is less prevalent. Indeed, profit is one of the reasons, but there are some reasons like revenge for cyber crimes like DDoS attacks as well as ego in creating malicious viruses.

However, as the accessibility and connectivity has increased, the means and the opportunity have also increased. Back then, only a few people know how to use computers and there is no reason in assaulting them; the companies during those times weren’t even connected online. Since the internet nowadays is almost everywhere, the means and the opportunity has greatly increased. Now, anyone can use a computer and there are many ways to use them like networking, online gaming, and banking and money transactions

When we look back, cyber criminals were almost always more sophisticated than those individuals who are trying to deter them. And even if companies have IT security, there are only few security professionals and ms information security graduates and much fewer security tools available against threats. Today the story is almost the same, criminals may have grown more dangerous and has many ways to accomplish their dark deeds, but for some reasons the threats they pose have been greatly reduced, compared to as before.

The vulnerability in cyberspace has been greatly reduced thanks to the increased numbers of security professionals and graduates of master’s degree in information security as well as many products and methods that can be used to mitigate threats. All of these can provide better security in the cyberspace for companies.

Another possible reason would be is that the laws against cyber crime have also changed; more cyber criminals are being brought to justice. Cyber crime is treated the same as any crime, any culprits caught are punished and are locked in behind bars. However, there are some skilled criminals who can escape justice from both worlds – the virtual and physical world.

Even if companies will muster all their resources just provide the best IT security by hiring security experts and employing the use of technologies and best methods; the threat of cyber crime is still present. If the criminals are barred in one way, they will still seek other ways of entry. In the past, cyber criminals grew tired of directly attacking hosts and networks, they shifted their attention into other ways like attacking the more vulnerable applications. If the application is blocked, then attackers would target the end users of those companies via phishing, XSS or other attacks targeting the clients. They become the most suitable target because they are unaware of IT security and on how to keep every transaction safe and secure.

Any financial institution with weak IT security will fall prey to cyber criminals in just a matter of seconds, but banks with advanced security will be much more difficult to confront. But that doesn’t stop criminals; they could easily trick the clients and steal their credentials and important information needed for banking transactions. Often times, attackers would send Emails masking as security mails asking to verify important data; once the clients make the mistake of supplying the information then his account will be compromised. Employees of companies can also fall victim to the same method. Emails, phone inquiries and other techniques are used just to get the necessary data that can be used to penetrate the systems of the company. We can simply put it this way; the surest way to go through security is have someone else’s login ID as well as password.

Sometimes, the most common reason why individuals fall prey to these vile criminals is their ignorance. Some of these individuals are still making use of computers with ancient operating systems which are more prone to cyber attacks. They didn’t know that computers are not like appliances and that they needed to be updated from time to time.

The ware against cyber crime is still not won. And each side is getting better and better as years go by. Many security experts and master’s degree information security graduates would agree with this statement, “It is much better to protect the individuals and company’s information network rather being the cause of their downfall.”

EC-Council University is a licensed university that offers degrees and master’s degrees on Security Science online. The degrees are recognized worldwide and may be used in any employment worldwide as well as the graduate certificates that they offer. With excellence and dedication as the core values, many professionals and degree holders have benefited from undergoing the programs in this university.

More information about master’s degrees in information security available at www.eccuni.us.