Awareness training: misleading applications.

There are materials (Misleading Applications: faking left, running right, Misleading Applications – What you need to know, KYE: Malicious Web Servers and others) about client security. IT and IT security can fight against such threats on infrastructure level (Web filtering - URL/Content/Category, Anti-virus/-malware/-spyware/-crimeware/etc.) but unfortunately it's not enough because new attack technologies trend to target people as the weakest link in the chain of security countermeasures using social engineering. New kind of such deceiving software - misleading applications - is not exception.

In this short post I outline some very simple rules that can help ordinary people to protect themselves and significantly lower risk of being attacked via Internet clients:

• Control your patch level and patch level of your antivirus.
• Do not visit unknown sites.
• Do not believe unknown sites. If site tries to persuade to install something that will do you good, consult with your IT/IT security. Do not install software from the Internet.
• Do not open e-mails you don’t expect or from somebody you don’t know. Do not open attachments or click links in such e-mails.
• Switch off unneeded functionality in client. For example, if you don’t need JavaScript, disable it in your browser.
• Do not start Internet clients (browser, e-mail client, IM client, etc.) with admin privileges
  
• Be paranoid, If you feel suspicion do not hesitate to contact your IT/IT-security.