Web bigger malware threat than email

Companies are now more likely to pick up malicious software via employee Web surfing than from the more notorious email attachment, according to a study released on Wednesday by IDC Denmark.

Nearly 40 percent of the 200 Danish companies surveyed said they'd been infected by a virus or worm, despite the fact that 75 percent had implemented a security policy, IDC said. But the malware in question is no longer primarily making its way through email, as in the past.

"There is a common misconception that emails constitute the biggest security threat from the Internet," said Per Andersen, IDC Denmark's managing director, in a statement. "But the survey shows that up to 30 percent of companies with 500 or more staff have been infected as a result of Internet surfing, while only 20–25 percent of the same companies experienced viruses and worms from emails."

The risk of infection is about five times greater for companies that allow Internet usage by staff to go on unhindered and unmonitored, Andersen said.

The problem doesn't go away for companies that ban private Internet use, because often such policies aren't enforced, IDC found: about 30 percent of management at such companies said staff accessed the Internet for personal use during working hours.

IDC believes banning personal Internet use isn't realistic, particularly as a long-term solution. Instead, the company recommends closer monitoring of staff Internet use, using tools that give management an overview of time spent and behaviour patterns online.

"It can certainly be done in such a way that it does not constitute outright monitoring of the actions of every member of staff," Andersen stated.

Attacks can come from relatively innocuous online sources, according to Andersen. He cited the case of a poker Web site that placed a Trojan horse on users' PCs when they downloaded the site's help program.