Application Isolation and Control – A Modern Defense for New Threats

By Fraser Kyne, EMEA CTO, Bromium

The detection method for preventing malware is fundamentally flawed, yet it is still the de facto standard in cybersecurity. Day after day, organizations scramble to protect against a growing number of threats, but all it takes is one piece of malware to go undetected to wreak havoc on IT systems.

Ironically, this was predicted by Alan Turing more than 80 years ago. His work proved no standard algorithm could ever predict an outcome for every possibility without falling into a logical paradox because of the halting problem. The halting problem proves that an algorithm cannot predict from a general description of a program and an input whether the program will finish running or execute forever.

The same logic applies to malware detection. A standard algorithm cannot be relied on to correctly identify every single threat that comes knocking because the volume of threats is large and varied, with previously unseen threats emerging every day.

A detection-based approach deployed by IT teams is akin to casting out a net, where the net will either be so large that it tangles itself, or it won’t be cast wide enough and will invariably allow some things to be missed. IT teams are trying to solve this problem by adding more layers to their detection solutions, but all this is doing is casting more nets plagued by the same problems.

Detection-based solutions can Over-complicate security landscapes

Hackers are resourceful, utilizing new tactics – such as polymorphic malware and zero-day exploits – to bypass detection-based software and break into critical IT systems. For example, in the Locky ransomware campaign, hackers customized the malware to execute after the fake document was closed, making it much harder to spot and bypassing the majority of detection-based AV solutions.

Instead of focusing on detection, organizations that are serious about security are starting to rely on segmentation. By segmenting networks and applications, businesses are seeing that they can prevent malware from causing harm and keep data and networks safe.

Segmentation offers businesses protection, but it relies on PCs or applications only having access to limited areas on the network. Early iterations failed to achieve a great uptake because adding new PCs to this system can be incredibly expensive and time-consuming during deployment.

Segmenting IP and sensitive data could also still leave users at risk if they don’t isolate the applications that are being used to access this data. Without a solution to these problems, network segmentation has largely failed to get off the ground and detection has persisted as the leading cybersecurity approach.

By focusing on isolation, security Is simplified and end users are protected

Everybody wants to be able to use technology to do more with less. In this instance, it means deploying more effective and reliable cybersecurity solutions. However, detection involves the complex process of “preventing, detecting, and responding”, where multiple layers of security are deployed to identify malware before it hits. However, these layers simply aren’t sufficient to protect against the volume and sophistication of the ransomware and targeted phishing attacks that are prevalent today. As you might expect, it also creates a tremendous expense.

While there are a few choices available that provide isolation, solutions that do this using virtualization are effectively bullet-proof. While no one can promise 100% protection, virtualization that starts on the chip, stops Meltdown, dramatically limits Spectre and works online or offline, can protect what’s targeted the most: endpoints.

Real solutions with a virtual defense

Isolation through virtualization works by allowing applications to open and carry out each task in its own self-contained virtual environment. This means that every tab that is opened in a browser, every Office or PDF document attached to an email, or any file that runs an untrusted executable, will be opened in an entirely isolated virtual environment that’s running on the hardware itself. The result is that any threat caused by an action in this environment won’t have access to anywhere else on the system and can be easily removed by simply destroying the virtual environment.

This allows users the freedom to download files and open documents, safely, knowing that they are no longer the last line of defense – giving users the ability to click with confidence. In fact, end users can let the malware run, because it doesn’t do any damage, and it allows IT teams to get detailed threat analysis. Users can get back to work; recruiters and HR teams can open emailed CVs, marketers can carry out research even if they click on a phishing link, and R&D teams can share downloaded resources without the fear of being stung by malicious files or links.

For organizations using this new approach, there is less worry. Virtualization-based security is being adopted by the giants: HP and Microsoft now use virtualization-based security to protect users. This is just the tip of the iceberg and marks the beginning of a virtualization revolution in security, where users no longer fear opening links and attachments and organizations can let their teams focus on innovation without worrying about making a security mistake.

About the Author

By Fraser Kyne, EMEA CTO, Bromium Fraser’s role has encompassed a wide range of both engineering and customer-facing activity. Prior to joining Bromium Fraser was a Technical Specialist and Business Development Manager at Citrix Systems. He has been a speaker at various industry events on topics such as virtualization, security, desktop transformation, and cloud computing.

Source: Cyber Defense Magazine
http://www.cyberdefensemagazine.com/application-isolation-and-control-a-modern-defense-for-new-threats/

Read more from Fraser:

10 Things You Need to Know About Ransomware

Some cyber security experts call ransomware attacks an epidemic.

In 2016, the FBI estimated that ransomware attacks resulted in over $1 billion in income for cybercriminals*. Experts attribute the ransomware epidemic to people’s carelessness in clicking on phishing emails and infected advertisements.

Here are 10 things organisations should know about ransomware:

  1. Ransomware was first reported in 1989
  2. Ransomware doesn’t discriminate when it comes to platforms and devices
  3. Ransomware can be distributed through various channels
  4. Ransomware often goes undetected
  5. Organisations should change their mindset from a reactive-based model to a prevention-oriented one
  6. Organisations should develop a prevention and response plan
  7. Organisations should identify a prevention and response team
  8. Organisations should perform a compromise assessment
  9. Organisations should complete a security tools assessment
  10. Organisations should respond and future-proof

Download the full infographic here – Infographic courtesy of Cylance Consulting

As threatening as ransomware sounds, damage can be avoided with increased user awareness coupled with the right security practices. Businesses need to be aware of the risks and take adequate precautions to minimize the impact in the event of an attack.

See Cylance in action for yourself? Register here to join our workshop at The Metal Box Factory in London on the 25th May and see the capabilities for yourself.

*Source: CNN

 

Looking Behind The Attacks: The Top 3 Attack Vectors to Understand in 2015

We saw an unprecedented number of high profile cyber-attacks and malware infections reported in 2014 – Target, Snapchat, eBay and Adobe (to name a few). This has brought cyber security much more into focus, not only for c-level executives and cyber security analysts, but also for world leaders. The complexity of these attacks and the frequency that we saw in 2014, begs the question what does 2015 hold?

In this whitepaper our security experts look behind the attacks and highlight the key elements that malware, advanced persistent threats (APT) and other cyber-attacks typically use to infiltrate networks and how businesses like yours, can protect their valuable assets and data.

Download it hereWhitePaperImage

Webinar: Employees Are The Target – No More Zero Day Exploits – Live Trusteer Apex Demo

[vimeo vimeo.com/http://vimeo.com/82196875]

Trusteer Apex applies a new approach to stop advanced zero-day threats from compromising employee endpoints, without impacting the user and with minimal IT overhead. Take a look at our latest webinar for a live and compelling demo of Trusteer Apex. It’s well worth a view and will make you think twice before clicking that next email link!

Advanced Malware Protection with Trusteer Apex

[vimeo vimeo.com/http://vimeo.com/81704312]

We are all hearing more and more about the frequency and evolution of malware. In this video bog we discuss the different kinds of threats your organisation may face and a new solution to stop zero-day exploits and data exfiltration. Trusteer Apex can automatically and accurately determine if an application action is legitimate or malicious. A must see video blog for an overview of a new approach to protect enterprise endpoints.

The Most Dangerous Malware Trends for 2014

By Vanessa Cardwell, Marketing Manager, Netutils

Views expressed in this post are original thoughts posted by Vanessa Cardwell, Marketing Manager, Netutils. These views are her own and in no way do they represent the views of the company.

Given the increase in frequency and evolution of malware threats in recent months we MalewareThreatsImagethought you’d be interested in taking a look at this thought provoking infographic from our partners Trusteer detailing the 5 most dangerous malware trends for 2014. The infographic gives an explanation of the threat and the danger. You can check out the full blog post on the Trusteer website here or view the infographic below which lists the 5 threats in 2014 as:

  1. Source code leaks will accelerate malware release cycles
  2. Mobile SMS forwarding malware will become ubiquitous
  3. Old school malware techniques will make a comeback
  4. Account takeover will move to victims device
  5. Malware research evasion will become more popular

Malware Trends 2014 Infographic Final