Automated Security Tools – The Human Factor View
Paz Itzhaki-Weinberger
CEO, Itzhaki-Weinberger Consultants (IWC) Ltd.

The computerized world is expanding rapidly, in an exponential rate. 
The internet is growing, bandwidth rising, new technologies and applications are emerging, and we witness a steady increase in the amount of people using the internet, computers and communications in general.

This rise in technology level, technology complexity and technology distribution worldwide, results directly in an even more rapid rise in computer threats, attacks and risks in general.

As our society becomes more and more dependant on technologies, there are more reasons for launching various cyber-attacks, and we can see the dramatic increase of those attacks (and also in the discovery rate of new vulnerabilities and exploits), both in numbers, complexity, damage and resources invested in countermeasures.

However, this increase of threats and complex technologies almost never result in more technology-understanding or security-aware end users.

Most end users of complex technologies remain "computer-illiterate", and are usually totally unaware of how the technology they use each day actually works, and of course (as they possess no relevant knowledge), they don't have proper security practices.

Most attacks today rely on user unawareness, on user mistakes, or on simply poor maintenance of PCs done by unskilled users.
This also helps attacks to spread - once control is being taken over a PC, the attacker can use this controlled PC also as a platform for launching other attacks, as we all know is done many times.

Security tools also have flaws, and many attacks are launched considering the security tools in use – we see many worms that first launch attacks to disable the anti-virus or firewall products, and only then launch the actual attack.

Systems will never be 100% safe. Even safe systems, not vulnerable to attacks, become vulnerable and unsafe when the user makes security mistakes.
And as we mentioned before - most users are and will always remain computer-illiterate, at least on the level required to maintain a "secured parameter" in their computing environment.
This "Computer-Illiteracy" will only increase in the next few years as more and more users from all levels of society join the group of advanced technology users, and as more complex technologies become widely available and simpler to use.

The solution is using automated solutions, solutions that will assist and enforce a safe computing environment for the normal, unskilled user, without and need for the user to learn about security or acquire new skills.

To maintain a "secured computing environment", the user must make sure many basic elements are in place. I will demonstrate several examples:

1.	Anti-Virus
Anti-Virus software is the most important security tool all users must have installed on their PC.
The anti-virus, however, in order to be effective in guarding the PC, requires the user to make sure many things happen / occur:

A. Virus definitions update: The user must make sure his anti-virus is updated.
     a non-updated anti-virus won't protect from the most relevant, newest 
     attacks and viruses.
B. Real-Time Protection: The user must make sure his anti-virus protects him 
     in real-time. Sometimes attacks disable this feature, and an automated 
     solution may alert or correct when such attacks occur.
C. Full System Scan: It is recommended, that once a week the anti-virus 
     software will scan all the hard drives and data on a PC, and clean any 
     infection that might be found.
D. External Protection: The user must make sure his anti-virus product protect 
     him also from making other security mistakes, by scanning his incoming 
     email, making sure he received no virus (blocking access to infected 
     messages), and also preventing him from becoming a distributor of viruses, 
     by scanning his outgoing mail, to make sure that even if he got infected he 
     won't spread the virus to other people (usually his friends and colleagues 
     from his address book).

As you can see, even the simplest protection (Anti-Virus) requires the user to do many actions and maintenance, usually impossible to him.

An automated security tool, making sure AV software is running, updated, protecting the PC & email, and running a full system scan periodically, is an ultimate solution for this situation.

2.	Firewall
Personal Firewall today became a basic tool to protect the personal PC from an attack.
The Firewall, however, in order to be effective in guarding the PC, requires the user to make sure many things occur:

A. Firewall is active: The user must make sure the firewall is not disabled and 
     working on his internet connection.

B. Firewall is configured properly: This is the hardest thing to ask from the 
     regular user. The user must know which ports and opened, which ones are 
     closed, what incoming traffic to allow, what outgoing traffic to allow, what 
     is considered normal and what isn't, and also needs to possess the abilities 
     to analyze logs and real-time data, and also inspect his filtering rules.

An automated security tool, making sure Firewall software is running, configured properly, and not tempered by other softwares / malicious code, is an ultimate solution for this situation.

3.	Various Security Configurations
Many commonly used softwares have security holes if they are not configured properly.
Simple "safe" configuration will allow most users to be totally protected from common attacks.

Almost all of us use Internet Explorer, Outlook, Outlook Express, Word, Excel, PowerPoint etc., and all of them have complex security configurations and levels.

An automated security tool, making sure all softwares on a PC are configured properly, is an ultimate solution that will prevent most of the known attacks.

4.	Security Updates
An essential part of computer security, is making sure the PC holds the latest security patches. Usually, a security patch is being released and becomes available many days or months before the computer will actually be attacked by an attack using the hole fixed in a released patch.

The user must always make sure he has the latest updates installed. He must also know which ones are critical, and which ones are not needed by him. The user must be aware of this issue at all times.

An automated security tool, making sure all critical updates were downloaded and installed immediately or near their release date, is an ultimate solution that will prevent most of the known / most dangerous attacks.

5.	Spyware Protection
Spywares are a global problem. Spywares are programs installed on the PC secretly or bundled with other "legitimate" softwares. These programs may violate privacy, but may also reduce internet performance, computer performance, and in many cases cause a computer to shut down, or annoy the user with popup messages, or hijacking his browser to other sites, disabling his ability to use the internet.

The user must make sure he is not infected by spyware – and this is a complex thing to check even for computer professionals.
Once you find out you are infected, removal is sometimes nearly impossible.

The user must make sure he has an anti-spyware product running, and run frequent checks for spywares.

An automated security tool, making sure an anti-spyware product is installed, updated with the most current spyware data, protecting a PC in real-time and being ran in full-system-scan mode periodically, is an ultimate solution that will prevent most of the known / most dangerous attacks.

6.	Privacy Protection
Using the computer and the internet leave traces.
You can find deleted files on a PC, you can see the history of programs ran, you can see the history of sites visited, and you may also have planted cookies on your computer, spying on you.

Most users are unaware of these privacy issues. Most users are even unaware of simple tasks such as recycle bin emptying, and think that files that they have deleted don't exist anymore, while they exist, are accessible, and take space on the hard drive.

An automated security tool, deleting files and covering all these traces, is an ultimate solution that will prevent most of the damages.

7.	Problematic / Forbidden Applications
Many applications are commonly known as problematic – application that take bandwidth, applications that have many unfixed security holes, old unsecured versions of softwares etc.

The user, in order to be secured, must be aware of all the damages and exploits and current security status of each and every application running on his PC.

An automated security tool, alarming the user that problematic applications exist on his PC and urging him to uninstall / upgrade / replace them, is an ultimate solution that will prevent most of the damages.

As shown above, in our changing world of security, even the most simple users must be computer literate and aware in order to stay protected from (most) harm.

But seriously, can you imagine your grandmother patching her windows XP?
Can you imagine your uncle configuring the firewall and examining logs? 
Can you imagine your aunt detecting and removing spywares or even knowing what spywares are?
Can you imagine your brother tampering with the Internet Explorer ActiveX definitions for example?

Most of us cannot. And this gap of knowledge is not going to be closed. The opposite – it will only increase.

This is why automated security tools, closing this gap by applying expert configurations and maintenance to the simple user, emulating the actions of an expert for the simple user creating a secured environment, are the tools of the future, tools that operate from a behavioral, human factor view.

•	The writer is the CEO of IWC Ltd., a leading Israeli Security Consulting firm
•	The writer is also the Security Expert & Security Content Manager of Gteko, a leading eSupport & automated assistance tools provider.