Skip navigation.
Home

Are There Spys In Your Computer?

security

Spyware is a pain and security risk to computer users. WHATIS.com defines spyware while Lavasoft describes different carriers of spyware and what it can do.

Most people are familiar with freeware, shareware, cookies, media players, interactive content, and file sharing. What they may not realize is that some of the aforementioned may contain code or components that allow the developers of these applications and tools to actually collect and disseminate information about those using them.

They can track your surfing habits, abuse your Internet connection by sending this data to a third party, profile your shopping preferences, hijack your browser start page or pages, alter important system files, and can do this without your knowledge or permission. The security and privacy implications of these exploits should be quite obvious and undesirable on any system or network!

Alarming statistics on spyware frequency and user unawareness can be found in The Spyware Epidemic: Dealing With "Legal" Malicious Code.

90 percent of all Windows PCs are infected by spyware.

80 percent of all home computers are infected by spyware.

88 percent of owners of infected systems are not aware their computer is infected.

75 percent of PC owners believe they are safe from online threats.

Only 24 percent of PC owners are actually knowledgeable about how to handle spyware.

65 percent of all PC users do not run up-to-date anti-virus software.

50 percent of all broadband users do not use a firewall. The number drops to 7 percent for dial-up users.

Andrew Brandt discusses the testing of anti-spyware products as well as citing proposed legislations to deal with spyware in his comprehensive article Some anti-spyware companies use confusing ads, and our tests show their $20-$60 products are less effective than free competitors.

Brandt also cites SpywareGuide as a good resource which lists known spyware.

Spyware is often lumped into

Spyware is often lumped into the more broad category of viruses. http://www.symantec.com is the most common (and I've heard the most effective) source of products for protecting a Windows PCs.

I came across a very interest

I came across a very interesting site, the United States Computer Emergency Readiness Team (US-CERT). US-CERT is a partnership between the Department of Homeland Security and the public and private sectors. Established to protect the nation's Internet infrastructure, US-CERT coordinates defense against and responses to cyber attacks across the nation. The main site link is http://www.is-cert.gov/.

There are other sites too, including InfraGard at http://www.infragard.net whose Mission Statement is "It is our goal to improve and extend information sharing between private industry and the government, particularly the FBI, when it comes to critical national infrastructures." I am an InfraGard member (having passed their security background check).

While these say they are security, in my humble opinion, there is a direct link between computer security and software asset management. By being secure, we can help keep the spies out of out computers.

============================
Thomas A. Wills, CSM, CITAM
Information Systems Manager, Software Compliance
Tucson, AZ

The http://www.us-cert.gov cr

The http://www.us-cert.gov created in 2003 looks interesting. FYI, "the original CERT" is The Carnegie Mellon CERT Coordination Center which is well known and respected by both security professionals and "crackers" as a valuable source of information. The Coordination Center is a model for over 250 organizations world wide that have set up similar teams to deal with software vulnerabilities as they become published. Software programmers, system administrators and ISA members are very familiar with these notices.

Most software vendors also have security mailing lists to announce security issues for their products. They try to summarize all the warnings that have been issued and provide their customers with instructions on how to deal with them. Sometimes these steps include changing default settings. Most often they involve downloads of updates/fixes/patches to their software. Some software packages automate this process in their product and even scan for new updates automatically. Adobe Acrobat and Microsoft Windows are good examples.

I agree that software asset managers are very well advised to coordinate and assist internal IT security teams in doing the work they do best. In most organizations there are specialists who deal with such issues and subscribe to various advisory mail lists. Security need is one among many factors to consider when choosing to upgrade a software application throughout a corporate infrastructure, increasing the need for a coherent software asset management strategy.