E-mail and end users are overlooked too often in security strategies, with IT professionals tending to take their eye off the ball in these two areas, warns M86 Security.
"There is a lot of sneaky stuff happening in the e-mail channel," Bradley Anstis, vice-president of M86 Security, told attendees of the Gartner Security & Risk Management Summit 2011 in London.
Many e-mail-based attacks seek to manipulate users through social engineering techniques that are a critical part of many attacks, he said.
Education of users continues to be an important part of any security strategy, said Anstis. Social engineering is not something that can be solved with a technical patch, which is why educating users about the current threat landscape is important.
Tackling the problem from the technology side should be multi-layered, including e-mail which can be an important conduit for malware, he said.
M86 Security has used the multi-layered approach in its product for defending against client-side attacks.
It is a combination of reactive technologies such as URL filtering and signature-based antivirus, and proactive technologies such as virtual vulnerability patching, file content inspection, static and dynamic code analysis, and dynamic web repair.
"Proactive controls are critical to detect dynamic malware, polymorphic viruses, targeted attacks and zero-day attacks," said Anstis.
In making technology choices, he said IT security professionals should look for innovation and not take a supplier's word on the performance of their products.
"Use one of the tools available to verify [suppliers'] claims in your own environment before buying, and look for a supplier backed by research labs and independent certification," he said.
Read more news from the Gartner Security & Risk Management Summit 2011: