THREAT MONITOR
Ditch IE?
Ed Skoudis, CISSP
08.05.2004
Rating: -4.03- (out of 5)
|
It's been a rough summer for Internet Explorer. A rash of vulnerabilities in the most widely used browser has allowed attackers to spread particularly vicious malware at an unprecedented rate. From exploiting a gaping hole in order to load a keystroke logger from a Russian site to manipulating help features to run arbitrary code, the sheer number of these flaws is driving some people to consider dumping IE in favor of another browser. Organizations ranging from U.S. CERT to BusinessWeek magazine have advised people to consider using another browser to ride out this vulnerability storm. People often tell me that I should jump on a soapbox and advise folks to move off of IE to help improve their security. But is ditching IE a reasonable way to go?
Let's first consider the chances that the IE onslaught will relent in the near future. IE certainly has had numerous vulnerabilities, and they show no sign whatsoever of letting up. I'm not convinced this is because IE is inherently less secure than other browsers. Instead, it's just a much bigger target. Malware developers focus on IE, given its vast market share. With this motivation for the bad guys, I don't think we'll see a near-term decrease in the number of IE-based exploits. Microsoft has said that Windows XP Service Pack 2 will fix a lot of these problems. But, if we use history as our guide, we can easily foresee a bunch of new security holes ripe for the picking by clever attackers.
So, does that mean you should drop IE altogether? Before jumping to conclusions, you need to calculate carefully the cost of such a change. For home users surfing the Net for fun and e-commerce, switching from IE has virtually no cost. Both the free Firefox and the commercial Opera browsers are wonderful, and supp
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
ort all kinds of nifty functionality. So, if you have a home computer, go ahead and give an alternative browser a shot. You just might like what you see.
For more information on this topic, visit these SearchSecurity.com resources:
Read this recent news article on Microsoft's fix for IE.
Learn how to battle worms with a network-based IPS.
Keep your users up to date with the latest information about malicious code with this tip.
Unfortunately, things are not quite so simple in the corporate space, where we face hundreds, thousands or tens of thousands of laptops and desktops, often using homegrown Web-based applications. IE is extremely entrenched in such companies and replacing it with another browser entails major costs, including:
These are the cost sides of this equation. The benefits? You'll be less of a bull's eye for much malware, of course. That could be a substantial benefit to organizations requiring high security. However, in many organizations, the losses from IE-inflicted malware are, in all honesty, quite low so far. Also, dumping IE doesn't make you impervious to attack, as we saw with the recent significant hole in the Mozilla browser running on Windows.
Believe me, as a security guy, I wish I could say that security trumps all other issues. However, we've got to very carefully weigh the costs and benefits of ditching IE. If your cost-benefit analysis shows that a switch from IE is worth it, by all means make the switch. If not, batten down your hatches, because the storm doesn't appear to be letting up yet.
About the author
Ed Skoudis, CISSP, is cofounder of Intelguardians Network Intelligence, a security consulting firm, and author of Malware: Fighting Malicious Code (Prentice Hall, 2003).
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
|
|
BROWSE BY TAG
Threat Monitor,
Application and Platform Security,
Application Attacks (Buffer Overflows, Cross-Site Scripting),
Web Security Tools and Best Practices,
Web Browser Security,
Information Security Threats,
Malware, Viruses, Trojans and Spyware, VIEW ALL TAGS
|
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
