It had become clear to Bear Stearns that its PCs and corporate network might be vulnerable: The Bloomberg service regularly issues automated updates to its client software running on PCs, directly over a dedicated connection. Bear Stearns' developers found that the Bloomberg software, like other packages with autoupdate features, had built-in capabilities to read, write and modify anything to which the PC user had access. That didn't sit well with Bear Stearns' executives. So Bear Stearns now runs a custom version of Pelican Security's SafeTnet software, based on behavior-blocking, or sandboxing, technology.
"We were concerned about [the Bloomberg software] accidentally overriding our software," says Jennifer Bayuk, managing director of IT security at Bear Stearns. With the software traveling freely into Bear Stearns' network, it had become a desktop support concern, Bayuk says.
The custom tool Pelican developed for Bear Stearns intercepts any calls to the operating system by the Bloomberg application and makes sure the Bloomberg software updates only its own files on Bear Stearns' PCs. Any other actions by the Bloomberg software, such as accessing non-Bloomberg files, Bayuk says, would get quashed. The total cost of the Pelican software was about $95,000.
Bear Stearns hadn't encountered any major problems with the Bloomberg software before installing the Pelican software, but it did discover some unusual behavior. In one case, the Bloomberg software attempted to set registry keys in the operating system that controls the speakers on Bear Stearns' PCs. Another time, it moved a DLL for another application to its own folder on the desktop, Bayuk says. Bloomberg representatives were unavailable for comment on the Bear Stearns deployment, despite Network Computing's repeated requests for an interview with the company.
Off-the-shelf, commercial versions of Pelican's SafeTnet and other behavior-blocking software packages, meanwhile, focus mainly on policing rogue code. They go beyond virus scanning by preventing stealth or unauthorized code from performing potentially harmful tasks, like copying an address book, erasing a hard drive or moving files. Behavior-blocking technology hasn't taken off in a big way yet, despite its promise as another layer of prevention that fills the void left by antivirus scanners.
Implementing behavior-blocking technology wasn't Bear Stearns' first attempt to contain the Bloomberg software. The company tried deploying Microsoft Windows NT Server's user-access restriction features, "but frequent changes in the Bloomberg software made it hard to maintain the correct access profile for the Bloomberg application," Bayuk says.
That's where the Pelican Security application came in. "We saw that it could alleviate the Bloomberg" security issues, Bayuk says. The solution didn't restrict Bear Stearns' end users from having access to any of the Bloomberg service features, Bayuk says. And it didn't pose an extra management burden for Bear Stearns -- the SafeTnet software provides a log on its management console of any actions it denies.
The challenge for Bear Stearns was to balance its brokers' access to Bloomberg, updates and all, with internal corporate security. Like brokers in most financial services companies, Bear Stearns' employees rely heavily on Bloomberg's online service for financial news, e-mail and other services; for many, it's their main desktop portal.
Pelican Security will roll the Bloomberg feature it created for Bear Stearns into the next version of its SafeTnet software, which is expected to be released in the second quarter. Bear Stearns is now testing the commercial SafeTnet application as an upgrade to its custom version. Bayuk says the application will let Bear Stearns shield its Microsoft Exchange e-mail and WorldStreet Corp. project-sharing applications from malicious code and attacks that can slip past antivirus and other security software.
|
IT Department Info
- Biggest Challenge: Staying abreast of the security implications of advances in IT.
- Latest Projects: Secure Internet File Transfer System and preauthorized online forms.
- Coolest Part of the Job: Reviewing the latest technology prior to its initial implementation and being able to influence the way it's deployed.
|
REPORTS
ANALYTICS
Follow 
