Future Blended Threats

Subscribe Now

Receive alert message from us when new articles submitted to our site for free.

Future Blended Threats

By: Simon Heron

Article Word Count: 1475 words [Comments (0)]
Total Views: 112 Views

On the face of it, the IT community is blessed with a

competitive, customer focused and responsive anti-malware

industry offering 24 hour operations centres, updates and

patches to quickly block any new viruses or attacks. And even

accepting that handling these patches in-house can be a bit of a

nightmare for customers you can nonetheless say that this works

reasonably well - can't you?

There is a problem with this view, and it stems from the

tendency to put security protection into neat little

compartments. Anti-virus updated - check - spyware protection in

place - check - and when all the boxes are ticked you can relax

and feel protected.

Except that threats don't always fit so neatly into well-defined

packages. Blended threats are increasingly common, and need a

holistic approach to block effectively. Blended threats use

numerous ways of spreading, whether it's email, SQL, Netbios or

whatever, and it requires a blended defence to stop them.

One of the more uncomfortable facts that we, as an industry,

need to face is that the revenues being generated from

'compartmentalised' anti-malware applications can amount to a

powerful vested interest- Vendors are frequently providing

protection solutions against single threats or multiple

solutions against multiple threats, and implying that customers

are safe, when the real story is more complex.

In particular, the difference between viruses and spam grows

ever smaller. Should phishing be classified as spam or as a

virus? Is an email with links to offensive porn just spam, or

should it be handled by your content filtering protection before

it even gets to the user?

We've also seen virus writers using spamming techniques to speed

the delivery of their viruses, and viruses used to create

"zombie" PCs to help in spam distribution. The crux of the

matter is that we don't want spam or viruses. If anti-virus and

anti-spam protection is separated, some viruses and spam will

fall between the two.

A well-configured firewall and up-to-date anti-virus protection

can deal with many threats. However, if you have a service that

you need to have open, such as HTTP, SQL or VoIP, then the

firewall cannot work effectively, as this traffic must be let

through.

In this case, the firewall and anti-virus are not enough. You

now need to tie in intrusion detection/prevention (IDP) to

prevent exploits like SQHell.

If you are running virtual private networks (VPNs), they need to

be restricted and scanned in the same way that a physical port

should be scanned and restricted. This means that VPNs should be

integrated with a firewall, IDP, anti-spam and anti-virus.

As well as coping with these blended threats, by linking

together different aspects of security, the overall performance

can be improved. For example, anti-spam protection works better

if it has access to a database of suspect URLs that it can

filter for. By tying the anti-spam engine to a content filtering

database like SurfControl, its effectiveness can be enhanced.

Another headache for security firms has been the port hopping

capability of peer-to-peer applications like Kazaa. If you block

the port that Kazaa is using, it can simply move to use another

port. In practice, this makes it very difficult to stop by

simply blocking ports.

On more sophisticated appliances, intrusion detection

capabilities can specifically block peer-to-peer applications.

But even without this capability, an intelligent use of a

quality of service (QoS) capability as part of your network

defences can provide an answer to the port-hopping problem.

Instead of blocking Kazaa all together, which it would recognise

and port hop to bypass, the QoS can reduce the throughput to

such a low level that the user no longer wants to use the

peer-to-peer application - without triggering port hopping.

Finally, it's important not to overlook the fact that someone

has to work out which anti-malware tools are best placed to

counter the latest blended threat and to manage all of your

security protection. By bringing together all the logging

facilities of your firewall, IDP, email, content filtering and

so on, reporting is clearer and fault finding is easier and

quicker. It is also quicker and easier for signatures and

defences to be updated and monitored.

So, if a unified approach to protection is the answer, how can

this be implemented? It almost goes without saying that the best

place to put this protection is at the network gateway -

blocking threats before they get onto the network provides the

most reliable solution. That's not to say there is not an

on-going role for protection at the desktop and sever level, but

it is to say that, for most networks, protection at this level

should be the secondary and not primarily layer of defence.

Several vendors are now offering threat protection appliances

that can provide the essentials of anti-virus, anti-spam,

content filtering, IDP and VPN. The market has now matured to

the point where such appliances can provide the same level of

protection as stand-alone security components, without

compromising on any particular aspect.

Grab this articles

<h1>Future Blended Threats</h1> On the face of it, the IT community is blessed with a competitive, customer focused and responsive anti-malware industry offering 24 hour operations centres, updates and patches to quickly block any new viruses or attacks. And even accepting that handling these patches in-house can be a bit of a nightmare for customers you can nonetheless say that this works reasonably well - can't you? There is a problem with this view, and it stems from the tendency to put security protection into neat little compartments. Anti-virus updated - check - spyware protection in place - check - and when all the boxes are ticked you can relax and feel protected. Except that threats don't always fit so neatly into well-defined packages. Blended threats are increasingly common, and need a holistic approach to block effectively. Blended threats use numerous ways of spreading, whether it's email, SQL, Netbios or whatever, and it requires a blended defence to stop them. One of the more uncomfortable facts that we, as an industry, need to face is that the revenues being generated from 'compartmentalised' anti-malware applications can amount to a powerful vested interest- Vendors are frequently providing protection solutions against single threats or multiple solutions against multiple threats, and implying that customers are safe, when the real story is more complex. In particular, the difference between viruses and spam grows ever smaller. Should phishing be classified as spam or as a virus? Is an email with links to offensive porn just spam, or should it be handled by your content filtering protection before it even gets to the user? We've also seen virus writers using spamming techniques to speed the delivery of their viruses, and viruses used to create "zombie" PCs to help in spam distribution. The crux of the matter is that we don't want spam or viruses. If anti-virus and anti-spam protection is separated, some viruses and spam will fall between the two. A well-configured firewall and up-to-date anti-virus protection can deal with many threats. However, if you have a service that you need to have open, such as HTTP, SQL or VoIP, then the firewall cannot work effectively, as this traffic must be let through. In this case, the firewall and anti-virus are not enough. You now need to tie in intrusion detection/prevention (IDP) to prevent exploits like SQHell. If you are running virtual private networks (VPNs), they need to be restricted and scanned in the same way that a physical port should be scanned and restricted. This means that VPNs should be integrated with a firewall, IDP, anti-spam and anti-virus. As well as coping with these blended threats, by linking together different aspects of security, the overall performance can be improved. For example, anti-spam protection works better if it has access to a database of suspect URLs that it can filter for. By tying the anti-spam engine to a content filtering database like SurfControl, its effectiveness can be enhanced. Another headache for security firms has been the port hopping capability of peer-to-peer applications like Kazaa. If you block the port that Kazaa is using, it can simply move to use another port. In practice, this makes it very difficult to stop by simply blocking ports. On more sophisticated appliances, intrusion detection capabilities can specifically block peer-to-peer applications. But even without this capability, an intelligent use of a quality of service (QoS) capability as part of your network defences can provide an answer to the port-hopping problem. Instead of blocking Kazaa all together, which it would recognise and port hop to bypass, the QoS can reduce the throughput to such a low level that the user no longer wants to use the peer-to-peer application - without triggering port hopping. Finally, it's important not to overlook the fact that someone has to work out which anti-malware tools are best placed to counter the latest blended threat and to manage all of your security protection. By bringing together all the logging facilities of your firewall, IDP, email, content filtering and so on, reporting is clearer and fault finding is easier and quicker. It is also quicker and easier for signatures and defences to be updated and monitored. So, if a unified approach to protection is the answer, how can this be implemented? It almost goes without saying that the best place to put this protection is at the network gateway - blocking threats before they get onto the network provides the most reliable solution. That's not to say there is not an on-going role for protection at the desktop and sever level, but it is to say that, for most networks, protection at this level should be the secondary and not primarily layer of defence. Several vendors are now offering threat protection appliances that can provide the essentials of anti-virus, anti-spam, content filtering, IDP and VPN. The market has now matured to the point where such appliances can provide the same level of protection as stand-alone security components, without compromising on any particular aspect. More <a href="http://www.articlesroom.com">free articles</a> from <a href="http://www.articlesroom.com">http://www.articlesroom.com</a>

Subscribe Now

Sponsors

Categories

Home / Computers / Malware

Future Blended Threats

Grab this articles

Related articles

Newest Articles

Most Popular Articles