The Hindu Business Line : Spywatch

E-mail can bring in great news — and let in the spies too. With so much talk of security in cyberspace, eWorld caught up with Shantanu Ghosh, Vice-President, India Product Operations, Symantec Corporation, for his take on the scene. Over to Ghosh:

How exactly does spyware become a security risk?

Spyware programs have the ability to scan systems or monitor activity and relay information to other computers or locations in cyberspace.

Similarly, Adware programs facilitate delivery of advertising content to users through their own or another program’s interface. The information that may be actively or passively gathered and disseminated by spyware includes passwords, log-in details, account numbers, personal information, individual files, or other personal documents. Such programs seek to remain unnoticed, either by actively hiding or by simply not making their presence felt on a system known to the user.

Where does India figure in this?

The Internet is one large universe and users in India and across the world are exposed to similar security threats. Interestingly, 51 per cent of the malicious code threats in India has been seen as threats to confidential information (Symantec Internet Security Threat Report XIII).

The majority of spyware infections are due to irresponsible Web browsing, and infections resulting from the careless use of peer-to-peer applications, instant messaging and e-mail.

With enterprises and individuals looking to security vendors for protection, what are you doing to address threats?

Symantec has designed a risk classification system for rating adware and related applications that guide users to make informed decisions about what to keep and what to remove from their computers.

Using a risk calculator, this system measures the overall impact of applications in four different categories, providing a final designation of the application as ‘high,’ ‘medium,’ or ‘low’ risk alongside a recommendation as to how to proceed.

The four categories used within the risk classification system are:

Performance impact: One of the most troubling areas for users and administrators is the unexpected impact that spyware and adware programs can have on a system or a network’s performance. System crashes, bogged-down Internet connections, and unusual Web browser behaviour all fall into the category of ‘performance impact,’ which measures the effect of a security risk program on a system’s stability, speed, and performance. Programs that score higher in this category can produce wasted hours of troubleshooting, increased calls to the IT help desk, and/or irritating disruptions.

Privacy impact: While commonly invisible to the user, the violation of a user’s and an organisation’s privacy by spyware — and less frequently, by adware — is a critical concern. The privacy impact of a security risk application indicates the extent to which it captures information about users from their behaviour for use by a third party (i.e., the spyware or adware company). Once captured, the user’s information is typically transmitted back to the third party via the Internet but may also be sent via other means or stored locally.

Ease of removal: Spyware and adware programs often resist removal in an attempt to prolong their stay on a system. Symantec’s removal measurement is based on the relative difficulty of removing an unwanted application from a system. Behaviour for this category ranges from applications that can be easily removed using a vendor-provided uninstall program to applications that embed themselves deep within the machine and all but refuse to be removed.

Stealth: Stealth behaviour ranges from a completely ‘silent’ or unnoticeable installation and concealed operations to programs that inform a user of installation and are easily visible on the machine (i.e., users can see the program’s icons/processes, etc, and understand how it arrived on their machine).

Our technologies and tools, such as Data-driven Unpacker, Cookie Crawler and SpyMatrix, look to protect the system and the user from such threats. The Symantec Global Intelligence Network captures data on malicious behaviour such as spyware and adware, transmitting it back to Symantec Security Response centres for analysis. Data is gathered from more than two million decoy e-mail addresses, 150 million desktop antivirus sensors, and 45,000 intrusion-detection and firewall sensors worldwide.

savitharin@gmail.com

Related Stories:
Symantec offers integrated storage tool
Symantec offers endpoint protection for desktops