Blocking zero-day application exploits: A new approach for APT prevention
by George Tubin - Senior security strategist at Trusteer - Wednesday, 3 April 2013.
In the event that malware is somehow able to install on an endpoint device, a second and different layer of protection should be implemented to prevent the malware from accomplishing its goal of stealing information. This mechanism also uses the concept of whitelisting and applies it to data exfiltration states. In other words, it monitors and only allows legitimate external communication to be transmitted from the endpoint device.

When information-stealing malware enters the endpoint through an email attachment, a web download or infected media, it attempts to use data exfiltration techniques to communicate stolen data and credentials to the Internet. For example, malware can compromise a legitimate application process, creating a “zombie” process that looks authentic, or directly send data to an external IP address.

With this second layer of security, applications that exhibit data exfiltration states are restricted from communicating with the Internet or other processes but are permitted to perform other, more benign operations such as printing and file access. Restricted applications are then further analyzed and either whitelisted or removed if found malicious.

Automated management

The key to implementing Stateful Application Control is making it highly manageable so that it requires no end user intervention and minimal IT staff involvement. This can only be accomplished through a sizeable network of endpoints that enable new, legitimate application and data exfiltration states to be detected, whitelisted and immediately pushed out to all protected endpoints via the cloud. Additionally, corporations should be able to whitelist specific tools that would otherwise be restricted due to the nature of their operation.

Spotlight

Fighting malware, emerging threats and AI

Posted on 24 November 2014.  |  Liran Tancman is the CEO of CyActive, a predictive cyber security company. In this interview he talks about fighting malware, emerging threats, artificial intelligence and the cloud.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Tue, Nov 25th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //