If you're an administrator trying to protect yourself or end-users, it's important to understand and communicate that trusted Web sites can no longer be considered non-malicious. Dozens of recent research papers have reported how millions of legitimate Web sites are being infected by malicious criminal gangs.

Not that infected legitimate Web sites are anything new. I remember one of the world's most popular Web sites trying to infect my computer (unsuccessfully) with the Nimda worm in September 2001. What has changed is that infected sites are no longer an acute problem or something to be aware of only during significant malware outbreaks (Santy worm, Code Red worm, and the like). It's now systematic and a minority part of the Web all the time, 24/7.

From an end-user perspective it's important to be aware of this fact, so that no Web site is fully trusted. Next, make sure your operating system and applications are fully patched. My favorite online patch scanner is Secunia's Software Inspector. Being fully patched significantly decreases the risk of malicious compromise. Third, if unexpectedly prompted to install new software when visiting a Web site, ensure that you really are installing legitimate, needed software. If the Web site states you need a new media codec, media viewer, or Microsoft Windows patch (the most common malicious ploys), be very skeptical.

If you manage one or more Web sites, you've got to protect yourself. First, hack yourself before a malicious hacker does. If your site contains SQL, download and use any of the number of free SQL injection scanners against your site(s). Make sure the Web site is not susceptible to cross-site scripting. Use router access control lists, firewalls, and other security controls. Make sure your Web server software and its operating system are fully patched, and that administrative passwords are sufficiently strong. Refer to the OWASP Top 10 list for the most popular Web site vulnerabilities.

Finally, make sure your Web site developers follow the Security Development Lifecycle when programming. Be careful when reusing free Web gadgets and code snippets. These are often insecure, with many intentionally coded by malware authors hoping for indiscriminate use. Securing Web server software is fairly easy. Securing a Web server application is fairly hard.

Educating technical staff and users is also hard. It's important to update your company's secure computing educational material to include the growing threat of malicious modified legitimate Web sites. It's a new way of thinking, and most end-users haven't made the mental update, yet. You can help them.