Web 2.0 applications are taking over the Internet. Officially defined 2 years ago, Web 2.0 continues its rocket-fueled expansion into our present experience. Today, Web 2.0 delivers a new kind of Web experience that is interactive, real-time and collaborative. Although many of the underlying technical components of the Web have remained the same, the use of the Web as a platform on which to build rich applications is transforming our experience online.

As with any paradigm shift, technologies and processes can take us to a new level of user experience and productivity, but those same technologies also present us with a new level of threat. Whether inadvertent or intentional, the threats are equally dangerous. Security is our 24x7 focus, and in this SWAT site, we offer you the benefit of our research and expertise. We invite you to investigate and learn about the various threats you face today known or unknown, and what you can do to protect your organization.

The SWAT Initiative

Like Web 2.0, SWAT Secure Web 2.0 Anti Threat initiative consists of many components - bringing together news and timely information, technologies, best practices, and products to help you protect your organization's assets in this Web 2.0 environment and beyond.

Use this home page to navigate to our resources available here and on the Internet, as well as from our home Secure Computing Web site.

What is Web 2.0 Anyway?

You may be one of the millions of people who've viewed YouTube, or Google Earth, MySpace, or Wikipedia. The Web world doesn't get much cooler than these places and others like them. They represent the types of Web 2.0 interactions available to users at the touch of their keyboard and mouse. But Web pages don't have to be this exotic to contain threats to visitors; even simple Blog pages and RSS feeds can house risks. All of the neat features we associate with Web 2.0 Web sites can be built with software that may not have security as one of its objectives. The biggest risk of all is you might not have any idea you just landed at an infected Web site until it's too late and a piece of malware already has invaded your PC, network, Web server, and applications. See below for a sampling of 8 specific Web 2.0 threats that exist right now.

Real-World Web 2.0 Threats Circulating Today

Technologies such as AJAX (Asynchronous Javascript and XML), JavaFX, Flex, and Windows Presentation Foundation along with the use of audio, video, and animation in content have provided us this rich Internet application experience. Now combine this with the new paradigm of user contribution to content (and code) in the form of blogs, wikis, applets, and mashups and we have a really rich user experience on the Web. (Click on our resources tab above for more information on these technologies).

Not only are surfers at risk. Web sites are vulnerable to cyber criminals who need to disseminate malware and spam. Most popular Web site defenses rely on policy enforcement at the protocol layer primarily using signatures which are easily bypassed by hackers. The results are Web pages that can infect visitors quickly, easily, and without their knowledge, or even the knowledge of the Web page owners!

Google study shows that 10% of all Web sites harbor malware.
Click here to read the Google Research.

Examples of Web 2.0 Threats and Application-Layer Risks

The increased functionality of Web 2.0 Web sites along with the relatively new underlying programming languages are creating new threat vectors and revitalizing traditional threat vectors. The most common and "most concerning" threat vectors for Web 2.0 include:

• Web-borne malware
• Real-time RSS/Atom Feeds with JavaScript Malware inside
• XSS Scripting (Cross Site Scripting) - e.g., MySpace Worm
• CSRF (Cross Site Request Forgeries) - Stealing data in Java space, e.g., Gmail
• XSS filter bypassing - ENCODING
• Exponential XSS Attacks - No need to limit to 1 Web site
• Forging "request headers" using Flash
• SQL injection attacks
• Backdooring Media Files - JavaScript in everything

Secure Computing® delivers a broad range of technologies to protect against Web2.0 threats and beyond. These products backed by TrustedSource global reputation service and are packaged in our integrated Web, Mail, and Firewall security appliances.

Secure Computing Architecture for Protection

Integrated Gateway Products

Secure Computing integrated security appliances deliver complete layered protection in easily deployed appliances. These products are recognized by Gartner and others as leaders in their market segments, and our powered by TrustedSource. Read Gartner reports on our Secure Web (Webwasher) and Secure Mail (IronMail) products. Read about our Secure Firewall (Sidewinder) SC Magazine's award for Best Enterprise Firewall.

Secure Web (Webwasher)
Gartner has called the Web gateway the "most vulnerable" security hole in today's enterprise. Secure Web gateway appliances deliver comprehensive security solution for all aspects of Web 2.0 traffic. When a user is requesting content from a Web 2.0 application, he is implicitly asking for active content to be delivered to, and executed by, his computer. Furthermore, the same user is required to provide content to the Web 2.0 application, making the security concerns both inbound and outbound in nature. Learn why Secure Web is the leading product to protect against known and unknown Web 2.0 threats. Read our Malware paper, or sign up for a weekly demo webinar.

Secure Mail (IronMail)
Web 2.0 blended threats often begin with malicious spam harboring malware and malware links. Stopping spam and as well as enforcing outbound content compliance and enforcing security policy on messaging is key to blended Web 2.0 protection. In one integrated appliance, Secure Mail protects enterprise email systems from inbound (spam, viruses, phishing, and hackers) as well as from outbound threats (regulatory or corporate policy compliance violations or theft/leakage of confidential information or intellectual property). Secure Mail even protects enterprise email systems from threats that haven't even been identified yet. Learn how you can protect your messaging infrastructure from Web 2.0 threats. Learn how you can protect your messaging infrastructure from Web 2.0 threats.

Secure Firewall (Sidewinder)
Web 2.0 threats can also start with hacking into under-protected web-facing applications. Sabotaging a Web site can give spammers and malware authors a new platform to launch their assaults. In fact 70% of successful attacks are aimed at applications that rely solely on stateful packet firewalls, packet filters with only IPS signatures, or just policy enforcement at the protocol layer. Secure Firewall goes further with integrated proxies that provide both visibility and control of the applications, TrustedSource global reputation intelligence, inbound network access rules, and our patented Secure Firewall Type Enforcement® technology. Learn why Secure Firewall is the leading product to protect your internal servers against Web 2.0 threats. Read a white paper on the 3 Firewall Must-Haves for a Web 2.0 World, or sign up for a weekly demo webinar.

Technologies

TrustedSource Global Reputation-Based Protection

A global reputation based system behaves like a satellite advance warning system for the Internet. If it's doing its job well, it functions as an Eye in the Sky to detect suspicious behavior patterns at their origin and instruct security devices to take corrective precautions and action.

Wouldn't you like to see spammers' activities in action? What if you could see zombie activity on a daily basis? With TrustedSource, spammers can't hide since it can see and track their suspicious behavior - they do leave nasty fingerprints where they've been. TrustedSource™ reputation system is a global threat intelligence engine that sees these characteristics by analyzing a massive base of global messaging and communication behavior. This behavior is classified into trends and patterns in Web and email traffic, instantly seeing deviations from what's normal on a minute-by-minute basis. TrustedSource's watchful eye tracks unacceptable behavioral patterns and recognizes nefarious behavior. As such, TrustedSource is a critical tool in combating Web 2.0 zero day threats and attacks. Visit our TrustedSource site at: www.trustedsource.org or send us your own domain and we'll provide you with a free Domain Health Check™. Hopefully your domain is healthy; the ongoing challenge is keeping it that way.

Domain Health Check
See if any of your resources are hijacked by botnets or other malicious resources. The Domain Health Check™ is a free service from Secure Computing® that provides information on the publicly observed messaging and Web traffic on your domain and any associated net blocks that you provide. The information in this report comes from the Secure Computing TrustedSource™ service, a global reputation service that tracks messaging and Web activity for every domain on the Internet. Get Your free Domain Health Check here.

Secure Computing Anti-Malware Engine
Malware (malicious software) takes many forms, such as viruses, Trojans, spyware, worms - and dozens of other ways of getting into your network. Secure Computing's Anti-Malware engine contains multiple tools to ensure that you are protected proactively from every type of threat, from every conceivable location - even from within your own network. Secure Computing's Anti-Malware solution is the best in the world, bar none. You can read the review results for yourself: PC Magazine/AV.org's test results, PC Welt, and eWeek.

Malware Catch rate - percent
Number - False Negatives
Recent independent test results from AV-TEST.org,
a leading lab in Europe

Learn more here

Controlling information and data leakage is a critical part of Web 2.0 security. Secure Computing's Advance Compliance engine provides organizations with the ability to define and detect private and confidential information, enforce policy and audit compliance levels. Learn more and read our Data Leakage white papers, Part 1 and Part 2

Secure Computing Decryption of SSL/HTTPS

Both our Secure Web Gateway (Webwasher) product and Secure Firewall (Sidewinder) offer the unique ability to mitigate Web 2.0 threats even in encrypted SSL/HTTPS sessions. These encrypted sessions are the hackers & malwares new playground to pass through perimeters and gateway security devices because the sessions are encrypted and therefore can't be filtered by other inferior security solutions.

Seven Design Requirements for Web 2.0 Threat Prevention
Addressing Web 2.0 threats requires a new generation of multi-layered security that builds on traditional security applications. This paper outlines the new Web 2.0 threats and explains why most security solutions in place today do not protect against these threats. The paper confirms that most enterprises do not have adequate protection and then goes on to propose a set of design requirements for Web 2.0 threat prevention and reviews Secure Computing's relevant offerings.

Now available in Dutch, French, German, Swedish, Italian, and Spanish.

Forrester Research Study on Web 2.0 threats in the enterprise
This study found that the proliferation of Web 2.0 has led to a prevalence of rich and interactive content on the Internet, which has exacerbated the malware problem; malware writers are now using the Web to propagate a plethora of new threats undeterred by traditional security means. The need for more effective Web protection has never been greater.

What?! My Firewall Is Obsolete!? 3 Must-Haves for a Web 2.0 World
In our Web 2.0 world, firewalls have more issues to tackle to protect public-facing assets like web sites. No longer are web sites attacked only for the purposes of defacing the site to gain credibility among hacking peer groups. Today it’s about the money to be made for the bad guys in the distribution of malware and spam, and firewalls must be up to the challenge.

Did you GET the memo?
Getting you from Web 1.0 to Web 2.0 Security
Download Article

Still Sneaking In: The Threats Your Security Tools Aren't Telling You About
Download Article

• Discover your web, network and messaging areas of vulnerability—that may pre-date Web 2.0 threats.
• Learn about Secure Computing S.W.A.T.; our Secure Web 2.0 Anti-Threat initiative
• Connect with peers and colleagues over lunch to discuss common security challenges and best practices for implementing blended defenses
• Meet your local Secure Computing S.W.A.T. Team!
• Walk through a brief product roadmap and demonstration to discover what tools can further help you protect your network infrastructure from Web 2.0 threats
• Provide direct feedback, ask questions, and receive specific technical details from Secure Computing
• Receive a gift just for attending!!

Space is limited!

Reserve Your Seat Now!

Date:	Location:	Registration Link:
September 18th, 2008	Milwaukee, WI	Register!
September 23rd, 2008	Ottawa, ON	Register!