Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Microsoft Office tops SANS security worries

Fear the spreadsheets of death.

Article comments

Web-based applications and security holes in Microsoft Office are among the biggest threats faced by Internet users today, according to the SANS Institute's highly-regarded annual security report.

Developers aren't using secure coding techniques to create Web applications, giving hackers an opportunity to tap the rich databases of information connected to them, according to SANS, a computer training and security organisation.

The report, which will be discussed in depth in London Wednesday, compiles information on security threats from governments, security companies and academics.

Related Articles on Techworld

Web applications exchange data between PCs and servers over the Internet, and hackers can take advantage of vulnerabilities on either side to collect information. In the case of online banking and e-commerce applications, they can try to collect logins and passwords or credit card data.

The report also found fault with Microsoft Office. Vulnerabilities in the applications suite jumped almost 300 percent between 2006 and 2007, notably because of new flaws in Excel. The flaws allow hackers to construct documents that, when opened, can infect a computer with malicious software.

The hackers attach those malicious documents to email and use social engineering techniques, like attaching a file with an enticing name, to trick recipients into believing the document is important or comes from someone they know.

Anti-spam and security software can block email with attachments, but Microsoft's programs and file formats are so widely used that it rarely makes sense to do so.

Gullible users are also to blame, SANS said, since they are often easily tricked, or install software that they should not put on their machines.

Also on the rise this year was spyware, or programs that surreptitiously collect data on a user's computer. Webroot, one of the security companies that contributed to the SANS report, said the number of websites rigged with spyware increased 187 percent this year.

SANS said it takes as little as five minutes to attack an unprotected computer connected to the Internet. Hackers use automated scanners that hunt for unpatched PCs to exploit.

SANS advised developers to use Web applications scanners that can find vulnerabilities in programs. They should also use secure coding testing tools, try out a penetration testing service, and codify security policies for application development.

IT administrators should use Web application firewalls as well as maintaining an aggressive patching schedule, SANS said.


More from Techworld

More relevant IT news


Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *