Uline, a distributor of shipping, industrial and packing materials, prides itself on being able to fulfill customer orders within two seconds of a call. But things began to slip about two years ago.
Uline’s representatives were taking longer to handle orders and customers had to wait longer to reach them, said Robert Olson, system administrator for Uline in Waukegan, Ill.
The service representatives’ machines were becoming infected with spyware and slowing the systems down, he said. The representatives were spending more time closing pop-up ads or struggling to get new machines to work faster and spending less time taking orders or answering customer questions.
Spyware is a piece of software that can be as innocuous as an Internet cookie that monitors shopping habits at a Web-based retail site to far more malicious kinds.
Some spyware can highjack browsers, steal passwords or deliver unwanted advertising. It can get onto a system through casual surfing or be delivered via free, downloadable programs, such as peer-to-peer file sharing applications.
“As of right now, I would rank spyware neck-and-neck with anti-virus,” Olson added. “It has grown from an annoyance to something that is now a real issue for us and something that we experience almost daily.”
Olson is not alone in thinking that spyware is a growing problem. According to Framingham, Mass.-based IDC, spyware is becoming a major security issue for corporations and a help desk headache.
“Viruses and worms continue to be the most serious threat facing corporations today,” said Brian Burke, research manager for IDC’s Security Products program, in an IDC study entitled, “Worldwide IT Security Software, Hardware, and Services 2004-2008 Forecast: The Big Picture,” and published in December 2004. “However, spyware, spam and regulatory compliance are quickly moving up the priority list in many IT security departments.”
According to Olson, almost half of his help desk calls two years ago were spyware related. In some cases, the spyware infestation became so bad that the machine had to be taken off-line and rebuilt, which involved reformatting the hard drive and reinstalling all software and user configurations.
“The time frame it takes to rebuild a computer from scratch is roughly some three hours,” Olson said. “So now I’m spending three hours of my salary rebuilding a system rather than doing something else.”
Considering that Uline has about 900 computers in six remote branches and distribution offices, the cost of having to tackle spyware on those machines can be expensive. Olson said that the cost of fixing a spyware infested machine can run close to US$2,000, including the cost of his salary and the money lost by the worker who does not have a computer.
According to Boulder, Co.-based Webroot Software Inc., a provider of anti-spyware tools, an organization with 10,000 workstations might have to take two machines out of 1,000 off-line each day in order for them to be rebuilt due to spyware. That means 5,000 machines rebuilt each year at a cost of millions.
But if cost alone is not enough to make corporations worry, there is security to think about. Webroot is carrying out a corporate audit, where companies can download an auditing tool to scan corporate systems and machines for spyware and anonymously report the results back to Webroot. As of Jan. 5, 2005, some 23,918 corporate audit scans had been compiled and the results are not encouraging.
According to Webroot, corporate computers have on average 15 pieces of spyware, including tracking cookies, while 14 per cent have at least one systems monitor piece of spyware, and more than six per cent have at least one Trojan program.
“That Trojan could be a backdoor program giving access to that computer to the someone outside the network,” said Richard Stiennon, vice-president of threat research with Webroot in Boulder, Co and a former Gartner Group analyst covering the security space. “A keystroke logger is potentially recording passwords and user names.”
Stiennon said a keystroke logger was used against Microsoft and resulted in a significant part of the code for Windows 2000 being leaked.
Sam Curry, vice-president of security management solutions for Computer Associates in Islandia, NY said the security risks from spyware will grow as the number of spywares increase faster than virus threats. On average, two to three viruses a year cause real problems for corporations but some 80 to 100 pieces of spyware each year can cause corporate headaches.
“To put it in perspective, the number of unique pieces of spyware…each month is about 1,200,” Curry added. “At the moment, we add about 400 to 600 viruses a month. If you get a brand new systems and go online (with no protection) within an hour or two you can get between 50 and 60 pieces of spyware.”
What can be done to tackle the problem of spyware? Right now, most businesses are looking to companies like Computer Associates and Webroot to supply anti-spyware solutions that can be deployed across the entire enterprise to prevent spyware from getting onto systems in the first place. Uline’s Olson said Webroot’s corporate anti-spyware solution has made a dent in the number of calls coming to him regarding spyware. It used to represent 50 per cent of his calls, now it is 30 per cent. Another step includes placing filers on the enterprise to block out certain spyware-infested Web sites.
More vendors are stepping up to tackle spyware. Microsoft Corp. recently released a beta of an anti-spyware solution, using technology from its recently acquired company Giant Company Software Inc.
Olson suggested the best way to tackle spyware is not just through technology, but also through education.
At Uline, all new employees are given training on things they need to do to avoid getting spyware.
For example, if employees get a pop-up telling them the system is slow and they must download something to fix it, they have been educated to ignore such messages, since it is most likely a virus or spyware. The company may go as far as restricting what programs can be put onto machines or eliminating downloads all together.
But any policy must be balanced by the demands for productivity. Too many restrictions can result in lower productivity as people struggle against constraints to get work done.
Quick Link 055846
