iS3's Robert Scaduto, CTO & Executive Vice President 1:1 Rake Narang, Info Security Products Guide

Rake Narang: Phishing is becoming more and more sophisticated everyday. Some of the phishing emails and websites look too convincing now as the real ones. What advice would you give to the million of users both at home and businesses on how they can protect themselves from phishing traps?

Robert Scaduto: The simplest answer, and the best answer is, “Be skeptical.” Phishing works because users respond to social engineering tactics; e-mails that purport to be urgent, requiring a response; phony security warnings, for example. Phishers also count on users not looking as carefully as they should at the URL in the address bar, and the grammar in the body text. Bank of America, E-bay and Amazon.com do not send out e-mails written in bad English. Most important, banks and reputable merchants do not ask their customers to provide sensitive identifying information online. Never click on a link in an e-mail unless you are sure of the sender. Financial institutions will send you a link to click to change or update your information only if you have initiated the action. Never click on a link that seems to be a random string of numbers and letters. You should save the URLs of your bank and other sites that you frequent in your FAVORITES list, and always access the site from there to ensure that you are going to the legitimate site… and always, always be skeptical of any correspondence you receive.

Rake Narang: Will the security vendors always be playing a catch-up game with hackers and attackers? How do you see the security products evolving 2-3 years from today? How is your company focusing on 2008 growth plans?

Robert Scaduto: I like to think of it as cat-and-mouse rather than catch-up. Spyware is very profitable and its creators are not likely to be caught and prosecuted. This means that the bad guys can afford to pay top salaries to very, very good programmers. While we are reacting to new innovations in spyware, we are also developing ways to kill spyware proactively, before it embeds itself deep in the operating system, which is the direction in which criminals are moving.

As the complexity and sophistication of online theft scams increase, conventional weapons such as database analysis to scan for known malicious programs become less effective. Consumer education and recovery services after the fact are even less useful. The future of computer security lies in smart technology that takes a predictive rather than reactive approach.