Avoiding the Dangers of Web Browsing

There is a proverb in consulting that warns against celebrating after solving your No. 1 problem, because at that instant, your No. 2 problem gets promoted, and you're back where you started.

Similarly, bankers should resist the urge to relax after implementing a firewall to fortify the network

It's not that employees are suddenly untrustworthy. Rather, the problem is that a common activity formerly considered benign-Internet Web browsing-has become highly risky.

Understanding the Problem

Unrestricted Web browsing brings with it some obvious concerns, including lost productivity, bandwidth hogging by streaming media (such as Internet radio and rich media advertisements), and the presence of content that may be construed as creating a hostile work environment.

Employees may also be using Web access to subvert corporate usage polices. For example, many personal e-mail accounts can be accessed through the Web, and these e-mails can include attachments that are invisible to the corporate and desktop antivirus software.

It gets worse. Just by browsing certain Web sites, malicious software (or "malware") can be automatically downloaded and installed on an employees machine. This type of software includes adware, spyware, ActiveX components, and keystroke loggers. In their mildest form, these programs can take over a users home page and present a flurry of pop-up ads. More insidious versions can capture keystrokes (such as logon credentials, passwords, and Social Security numbers) and transmit that information outside the banks network to a third party.

The most popular Web browser in use is Micosoft's Internet Explorer. Some users are not even aware that they have a choice among World Wide Web viewers, with options such as Netscape, FireFox, Mozilla, and Opera. Among banks, the use of Internet Explorer is probably even higher than among the general population, because many core processors require it to use builtin banking applications.

The popularity of Internet Explorer is regrettable, because its design makes it the most prone to rogue installation of malware. The reason is that Microsoft integrated functions into Internet Explorer that make it easier to install and run software from within the Web viewer. This was done for competitive reasons, but the net result was that this feature has become an Achilles' Heel.

Authors of viruses and trojans have leveraged some of Internet Explorers operating system integration to get their malware on users' machines. Other avenues of infection have exploited bugs in Internet Explorer, such as a recent vulnerability that is triggered by the display of photos on a Web page. Users do not have to click anything; just browsing a site with hacked images could infect them.

Steps for Avoidance

In most cases, victims of these browser exploits could have saved themselves if they had simply stayed out of "bad neighborhoods" on the Web. Some banks have responded to this by configuring firewalls (or Web proxies) to limit access to an explicit list of permissible sites. Whitelisting, as this practice is known, works-but it requires frequent updates, and can often be an impediment to business when site access is necessary for a non-listed location.

A more flexible approach is the use of a Web content filter system. A Web content filter acts as a go-between for your browser and the Web. When a user enters a Web address, or clicks a link on a page, the request is sent to the Web content filter system, where it checks an internal database of Web sites to see whether the target site is permissible. Blocked requests are dropped, and the user is presented with an "Access Denied" page.

Web content filter systems break the Web down into categories (such as shopping, games, gambling, sports, and adult), enabling administrators to granularly define categories that will be blocked. Further, group policies can be created that allow, for example, tellers to see one class of sites, and management another. However, this stratified approach can introduce another common problem.

In many banks, it is not the line employees who are bringing in malware, but rather the managers, who are often reluctant to restrict their own access to the Internet. Bank information technology staff often know this is a problem, but may be afraid to confront management.

Because infections can occur without any specific action on the browsers part, bank managers need to face the reality that their Web browsing must be reined in. They must do their recreational surfing at home, and not introduce risk into their institution. For the safety and security of the bank, unrestricted use of the Web must now come to an end.