Spyware getting smarter

Fighting the Mutants

For companies that just want to get on with doing business, the thought of letting their network become a playground for self-modifying, camouflaged spyware is worrying to say the least. And while the need for a strong anti-malware defence goes without saying, building a complete response to the threat of mutating spyware requires a broader response.

A clear policy is a good place to start. Employees must learn to be sceptical of things they receive in emails and see online. Downloading code from such sites must be conveyed as a policy violation with serious consequences, and education sessions with standalone computers can teach employees what to look for.

Spyware education is particularly important for mobile users, whose computers regularly travel outside the protections of the corporate network. Raising user awareness can reduce the number of inadvertent infections, but technology is also necessary. Scanners on desktop PC and Internet gateways should be updated hourly; Web browsers can be configured to ban execution of unknown code, and key applications must be updated as soon as new security patches are released. Regularly comparing installed software to the corporate standard operating environment (SOE) can identify configuration changes.

It may even be worthwhile downloading a virus toolkit and - on an isolated, non-networked and expendable computer - designing some new malware to see if current scanning technology can pick it up. If your customers' technical people can get by their own defences, hackers will have even less trouble.

Continued spyware growth is pushing vendors into a more proactive response. Subscription scanning services from major antivirus vendors - and via Microsoft's soon-to-be-released Windows OneCare Live service - move the detection point outside of customer networks, while Microsoft's addition of anti-spyware, anti-phishing and other security tools to Windows Vista will give users more tools to fight back.

Ultimately, the key to surviving mutant spyware is diligence. A successful defence is all about getting the right tools in place and being able to manage risk levels.