Symantec Internet Security Threat Report Sees Increase in Blended Threats, Vulnerabilities and Internet Attacks

Report also introduces analysis of attacker vulnerability preferences

Hong Kong -- 2 October 2003 - Symantec Corp. (Nasdaq: SYMC), the world leader in Internet security, today released its latest Internet Security Threat Report, one of the most comprehensive analyses of trends in cyber security activity. This Report* includes analysis of data from Symantec Managed Security Services customers as well as more than 20,000 DeepSight Threat Management System registered sensors worldwide monitoring attack activity in more than 180 countries. The Report covers network-based attacks, a review of vulnerabilities discovered and exploited, and highlights of malicious code trends.

Symantec reports that the increasing prevalence of blended threats, which use a combination of malicious code and vulnerabilities to launch a cyber attack, remains one of the most significant security issues companies face this year. Blended threats accounted for 60 percent of malicious code submissions in the first half of 2003, and the number of blended threats increased by 20 percent. Blended threats continue to be the most frequently reported threat.

The speed of propagation of blended threats is also increasing. For example, the Slammer worm impacted systems worldwide in less than a few hours. Moreover, for a time, the recent Blaster worm was infecting as many as 2,500 computers per hour. Symantec expects to see greater worm propagation resulting in overloads to network hardware, crippling network traffic, and seriously preventing both individuals and businesses from using the Internet.

With the release of the current report, Symantec provides analysis of attacker vulnerability preferences for the first time. This new analysis shows that 64 percent of all new attacks targeted vulnerabilities less than one year old. Additionally, 66 percent of all attacks documented in the first half of 2003 utilised vulnerabilities categorised as highly severe.

Recent activities support Symantec's analysis that the time from discovery to outbreak continues to shorten significantly. The W32.Blaster blended threat occurred only 26 days after the vulnerability was announced.

"The Symantec Internet Security Threat Report combines data from the most comprehensive sources of Internet threat information in the world with exceptional analysis from skilled security experts, including attack, vulnerability and malicious code trends," said David Sykes, Senior Director, Asia Pacific, Symantec. "The Report provides enterprises with reliable and accurate information to assist in the development of comprehensive security strategies for protecting critical information against Internet threats which is particularly important as attacks become more serious and vulnerabilities exploited more frequently."

Attack Trends

• The overall rate of attack activity rose by 19 percent. Companies experienced approximately 38 attacks per company per week in the first half of 2003 compared to 32 attacks during the same period in 2002.
• Attacks are categorised as either severe or non-severe in nature. Amongst Symantec Managed Security Services customers, the number of severe attacks continued to decline from 23 percent in the first half of 2002 to 11 percent in the first half of 2003. The 52 percent decline is attributable in part to strengthening security postures among these Symantec Managed Security Services customers.
• Attacks are increasingly leveraging worms to carry exploits of known vulnerabilities as a means of creating exposures or security holes on a large number of systems. Attackers are then installing backdoor Trojans on those compromised systems to create large networks of controlled systems (bot nets) that could be used to launch future attacks.
• The majority of the top 10 scans, which are a measurement of reconnaissance activity, targeted non-public services such as Microsoft SQL and file sharing. By exploiting services that are common to home and internal corporate networks, the number of potential victims is substantially higher. This trend reinforces the importance of extending security policies and controls beyond public-facing systems.

Vulnerability Trends

• Symantec documented 1,432 new vulnerabilities, a 12 percent increase over the number found in the same period the previous year. However, the rate of discovery during the first half of 2003 was significantly slower than the 82 percent increase noted in 2002.
• The number of new moderate vulnerabilities increased 21 percent and high severity vulnerabilities increased 6 percent. This trend is driven by the fact that 80 percent of vulnerabilities discovered in the first half of 2003 could be exploited remotely.
• Symantec reports that 70 percent of the vulnerabilities found in the first half of 2003 could be easily exploited, due to the fact that no exploit was required or an exploit was readily available. This represents an increase of 10 percent over vulnerabilities discovered during the first half of 2002.

Malicious Code Trends

• More than 994 new Win32 viruses and worms were documented in the first half of 2003, more than double the 445 documented in the first half of 2002.
• As the use of instant messaging clients and peer-to-peer networking increases, new worms and viruses use these mechanisms to spread. Of the top 50 malicious code submissions documented over the first half of 2003, 19 used peer-to-peer and instant messaging applications - an increase of almost 400 percent in only one year.
• Submissions of malicious code with backdoors has risen nearly 50 percent, increasing from 11 submissions to 17 for the first half of 2003. The most visible attempt at theft of confidential data was the release of Bugbear.B in June 2003. The discovery of this variant raised serious concerns since it specifically targeted banking institutions.

Recommended Best Practices
Symantec encourages users and administrators to adhere to the following best security practices to better protect their information assets:

• Turn off and remove unneeded services.
• Keep patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.
• Enforce a password policy.
• Configure email servers to block or remove email that contains file attachments commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organisation. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses.
• Ensure emergency response procedures are in place.
• Test security to ensure adequate controls are in place.

About Symantec's Internet Security Threat Report
Attack trends in the report are based on analyses from Symantec DeepSight Threat Management System and Symantec Managed Security Services. Symantec DeepSight Threat Management System analyses continuously collected attack data from more than 20,000 registered sensors in more than 180 countries around the world. Vulnerability trends are based on statistical analysis of data housed in the Symantec Security Response vulnerability database, which contains information on more than 8,000 distinct vulnerabilities. Malicious code trends are based on empirical data and expert analysis drawn from Symantec's comprehensive infection and malicious code databases. To download Symantec's Internet Security Threat Report, please visit www.symantec.com.

* Regional findings fact sheet - See Appendix A.

About Symantec
Symantec, the world leader in Internet security technology, provides a broad range of content and network security software and appliance solutions to individuals, enterprises and service providers. The company is a leading provider of client, gateway and server security solutions for virus protection, firewall and virtual private network, vulnerability management, intrusion detection, Internet content and e-mail filtering, remote management technologies and security services to enterprises and service providers around the world. Symantec's Norton brand of consumer security products is a leader in worldwide retail sales and industry awards. Headquartered in Cupertino, California, Symantec has worldwide operations in 36 countries. For more information, please visit www.symantec.com.

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Center at http://www.symantec.com/PressCenter/ on Symantec's Web site.

Symantec and the Symantec logo are trademarks or registered trademarks, in the United States and certain other countries, of Symantec Corporation. Additional company and product names may be trademarks or registered trademarks of the individual companies and are respectfully acknowledged.

FORWARD LOOKING STATEMENT: This press release contains forward-looking statements, including forecasts of future revenue and earnings per share, expected activities, and other financial and business results that involve known and unknown risks, uncertainties, and other factors that may cause our actual results, levels of activity, performance, or achievements to differ materially from results expressed or implied by this press release. Such risk factors include, among others: the sustainability of recent growth rates, particularly in consumer products; the anticipation of the growth of certain market segments, particularly enterprise security; the positioning of Symantec's products in those segments; the competitive environment in the software industry; general market conditions, fluctuations in currency exchange rates, changes to operating systems and product strategy by vendors of operating systems; and whether Symantec can successfully develop new products and the degree to which these gain market acceptance. Actual results may differ materially from those contained in the forward-looking statements in this press release. Additional information concerning these and other risk factors is contained in the Risk Factors sections of Symantec's previously filed Form 10-K for the fiscal year ended March 28, 2003. Symantec assumes no obligation to update any forward-looking information contained in this press release except as otherwise required by law.