Matching evolving malware with advancing tools

By Nick Lewis | Jan 25, 2010

0 comments

Facebook

LinkedIn

Digg

In the past year, malware has evolved in five major areas: bots, rogue security software, generic spyware, targeted malware and attacks on mobile phones and smartphones. These threats have, in turn, allowed criminals to find new ways to monetize the unauthorized access they have been able to gain. In the last year, malware has incorporated better techniques for hiding and staying resident on new hosts, improving their communications and increasing users' concerns about identity theft and related fraud. 

Most security attacks get incrementally more dangerous over time, and some attacks will make major advancements in 2010. Malware, for example, will only get worse over the next year, even from its current state of sophisticated botnets. Malicious code will get easier to use, and criminals will have the ability to configure full-management applications, improved toolkits and update mechanisms to incorporate zero-day attacks and customizations. 

It may seem bleak, and enterprise security pros should certainly find it daunting. However, tools and techniques will also evolve over the next year to better protect corporate networks and data.

Predictions: Future security threats, defenses for 2010
There are few constants in information security, but the continued evolution of (and danger from) malware is one of them. Organizations can combat evolving malware and botnets through a combination of best practices like security awareness training, policies and procedures, and two emerging technologies: whitelisting and cloud-based antimalware. Let's discuss both of those technologies briefly:

• Whitelisting will evolve in enterprises as organizations evaluate new products, their functionality and how they can be used to more effectively protect their environment. Whitelisting defines the executables that can run on a system and then stops all others when software isn't on a defined list of acceptable behavior.

  Whitelisting has evolved in the last couple years. Initially, the technology was a complex system where enterprises needed to define every single executable. Now whitelisting products come with preconfigured templates, improved capabilities to approve new executables, and full management systems. Enterprises will realize that relying on antivirus software alone will not be tenable, and a new defense must be used. More enterprises in 2010 will use and set up their own whitelists and blacklists to supplement or replace their existing antimalware protections and then configure policy to determine what action to take for software that's not on either list.  

0 comments

Facebook

LinkedIn

Digg