Cisco NZ: Malware by any other name...

John-Paul Sikking, Cisco NZ security specialist, takes a look at the attack continuum.

Malware is any software used to disrupt systems, gather information or gain access to private computer systems.

We are familiar with many types of malware: viruses, trojans and worms.

Modern malware expands on these types and includes spyware, ransomware and even scareware. Malware is also used to gain a foothold in your, or your customer's, network and become what we call an advanced persistent threat (APT).

The industrialisation of hacking

Today’s malware is targeted, extremely sophisticated and highly lucrative. Criminals are well aware that the penalties, if caught, are significantly less for cybercrimes than for traditional crimes.

Often it is a lot safer for them too, with more return for less risk.

And these criminals are having success.

Cisco's 2014 Annual Security Report, found that 100% of the companies being monitored for malware on their networks had network traffic that went to known malware sites.

Even though these findings were based on global organisations, it is safe to say New Zealand organisations are equally affected.

The high penetration of malware in networks means we have to think about security differently: If you made the assumption that you, or your customer, is already compromised, would you do your security differently?

The attack continuum

Modern malware is designed to evade detection techniques. Malware will change itself when it replicates so signature detection will no longer recognise the file. It is also able to detect if sandbox protection is in place and take measures to look normal.

Therefore we need to assume that our defences are not absolute. We need to take a much wider view of security in the context of both our defence-in-depth strategy and of the attack continuum.

The attack continuum views an attack across its entire life:

* Before the attack – this is our defensive position. We use traditional tools and architectures to minimise our vulnerabilities, including firewalls, patching and network segmentation.

* During the attack – we identify that an attack is occurring, then deploy a countermeasure to block the threat. Technologies like intrusion prevention, web and email content security and current anti-malware solutions (known as ‘sandboxing’) are used here.

* After the attack – this is the ‘clean-up’ phase, where we want to get back to operational status as quickly as possible and, hopefully, identify and prosecute the attacker. This includes our disaster recovery processes, but also includes forensic capabilities and advanced malware solutions.

What do we do now?

System integrators need to help organisations understand the threat landscape and assist with solutions that cover the attack continuum.

The new security model means that SIs need to expand the scope of their services and solutions.

Organisations need to have visibility of threats throughout their networks and the security tools to defend, block and even retrospectively eradicate them.

They need to know threats may have entered their networks as legitimate traffic, but have changed their personas and become malicious over time.

Vendors are delivering a multi-layered threat-centric security model, which includes integrated solutions across the attack continuum but also understands the key security fundamentals required to be able to protect our networks.

Let’s have a proper security conversation with our customers, and not just sell them a shiny new security toy.

By John-Paul Sikking, Cisco NZ security specialist