Over the past few months, a class of malicious programs known as“spyware” has emerged as a new Internet menace. Spyware areprograms which transmit information from your computer, such asbrowser history or other personal information, to a remote server.These programs are sometimes installed by unsuspecting users who donot realize that, say, the “free password wallet” also has amalevolent interest in which sites they visit while online.Alternately, spyware is sometimes installed in addition to aseemingly legitimate application, a fact which can be difficult todetect. Some unscrupulous spyware vendors now use popup ads toinstall spyware, generating windows that will automatically installthe spyware if the user unthinkingly clicks `next.' More recently,spyware has increasingly been installed on PCs by a fourth, farmore insidious, method. Spyware authors have begun to use acombination of popup windows, as described above, andvulnerabilities in Internet Explorer, the most widely used Webbrowser, to covertly install these programs without any userinteraction. While Microsoft has released patches for several ofthese vulnerabilities, new ones seem to crop up several times aweek. These programs stretch the boundaries of spyware and canlegitimately be considered “Trojan horses” rather than simpleannoyances. Of course being proactive is the best way to protectyour institution from future spyware attacks. To do so, considerthe following preventative measures: Consider using a custom Webfiltering policy to limit access to Internet resources. Forexample, you might block access to non-business-related Web sitessuch as shopping and news sites. You could also use Web filteringto block access to certain dangerous file types, such as .cab and.exe files. Though it's not often used, increasing numbers ofcredit unions and banks are considering a default-deny policy onWeb browsing, which prevents employees from visiting unauthorizedsites. This method is very effective in protecting your employeesfrom malicious sites. It is best to block first and ask questionslater when the intentions of a particular Web site are in doubt.Patch! There are good reasons why you should keep your patches upto date. New Internet Explorer vulnerabilities come out all thetime, and you can be sure that when a patch is available, someoneis already using the vulnerability for evil. Don't let them makeyou a victim! There are services out there that can help you withthat. Run a spyware remover such as Ad-aware or Spybot regularly.Better yet, run more than one of them, as each has its strengthsand weaknesses. Treat them like your virus scanner – ensure thatthey're kept up to date with the latest signatures. Run up-to-dateanti-virus software, too. While spyware programs aren't technicallyviruses, more and more of them are getting close enough to the linethat anti-virus programs are beginning to develop signatures tocatch and remove them. If you lack the time or expertise to handlespyware and virus scanning, get help. If you do not use any Webapplications that require it, consider migrating your employees toa different Web browser like Mozilla Firefox(http://www.mozilla.org/products/firefox/) or Opera(http://www.opera.com/). These browsers have significantfunctionality improvements over Internet Explorer, and have few tono security issues. However, not all Web sites function properlywith browsers other than Internet Explorer, so significant testingis suggested before a full-scale migration. In conclusion, spywareis a large and growing threat that deserves careful considerationand countermeasures. Fortunately, while there is no way tocompletely eliminate your institution's exposure, preventivemeasures are very effective in protecting you, your staff and yourcredit union.