03 May 2013
Qatar is the "least infected" country in the Middle East in terms of malicious software infections, Microsoft's Security Intelligence Report says.

According to ictQATAR, it is "great news" for the country since in 2011 Qatar had the worst rate of virus and malware infections in the world as reported by the same report. Steps taken by ictQATAR's Computer Emergency Response Team (Q-CERT) have reduced the number of infections reported in Qatar.

Qatar's current ranking as the cleanest or the least malware infected country in the Middle-East has only been possible because of careful planning and consistently implementing that plan to keep resident here cyber secure through Q-CERT's efforts. Q-CERT Department Manager (Cyber Security Division) Hamid Sadiq said: "Indeed the computers cleaned per mille (CCM rate) has been consistently decreasing for Qatar and it is good news." Q-CERT initiated a service towards the goal of reducing these incidents in Q3, 2011. It's called Public Incident Handling (PIH) targeting home Internet users. 

"Through this service we provide tips and guidelines to these users on how to use Internet safely. It also provides assistance to users in removing malware infections using certain free tools. And we continually strive to optimise its efficiency." There are hundreds of thousands dedicated corporate and individual ADSL connections in Qatar. The role of Q-CERT is very relevant in forming that important link with the people of Qatar, telecommunications regulator and the service providers so that it's possible to have a common ground to work with each other to solve the cyber security or threat challenge.  

Now, Q-CERT's Public Incident Handling (PIH) initiative is part of that link and works around the simple logic of detecting, analysing, and responding to any cyber threat faced by Qatari residents. "We manage the PIH effectively through three very distinct layers - detect, analyse and respond," said Sadiq. "We have the internal processes to define and evaluate as well, but for PIH we will talk about detect, analyse and respond."

"We have some 50 sources and 512 malware detectors that help the Threat Intelligence System collect the threat information in real time from various sources on the Internet. This data is classified according to the country code as well as the type of threat. Once the analysis is complete, the data is then stored for monitoring and reporting," Sadiq said.

Detection is naturally followed by analysis, managed by the Q-CERT function called Q-LAB, which not only works to analyse threats on its own but also provides assistance to the residents for reporting incidents to Q-LAB. 

It monitors recent malware and the location of compromised or - in other words - infected computers in Qatar, which may be passing this information to external servers.  It also works with ISP to stop the communication channels between infected computers and external servers (command and control servers).
Individuals can also submit suspicious attachments or URLs (links) to Q-LAB to analyse and find out if it is indeed malicious software.

On Qatar being the least infected country in the Middle-East, Sadiq said, "Microsoft is one of the many companies that have been regularly publishing reports focusing on malicious and potentially unwanted software to provide relevant data, insights, and guidance to help organisations and individuals protect their equipment, software and users." 

Microsoft Security Intelligence Report (Vol 14) which indicated a decreased CCM rate in Qatar is based on statistics generated by Microsoft security programs and services running on computers in different locations, tracking certain families of malicious code (malware) or Virus. The CCM for Qatar reduced from 12.1 in first quarter of 2012 to 8.6 in the fourth quarter of 2012. 
"The lower the rate, the better it is" Q-CERT said.

Safe browsing tips
ictQATAR's Qatar Computer Emergency Response Team (Q-CERT) has issued the following "safe browsing tips" that can safeguard Internet users from malware or malicious software.
* Keep anti-virus software updated (renew it before it expires)
* Update the software regularly
* Use original or licensed software
* Use a web browser with built-in safety features
* Pay attention to alerts and warnings while browsing
* Do not disable your computer's security features or firewall
* Use strong passwords
* And always look before click!! (Pop-up window, e-mail, Twitter, Facebook, etc.)
Q-CERT urged Qatar-based users to immediately contact its Call Centre (44995444) if they notice suspicious behaviour on their computer that may indicate they are being subjected to cyber-attack. Q-CERT can also be reached on call.qcert.org

© Gulf Times 2013