Story image

Cisco NZ: Malware by any other name...

12 Sep 14

John-Paul Sikking, Cisco NZ security specialist, takes a look at the attack continuum.

Malware is any software used to disrupt systems, gather information or gain access to private computer systems.

We are familiar with many types of malware: viruses, trojans and worms.

Modern malware expands on these types and includes spyware, ransomware and even scareware. Malware is also used to gain a foothold in your, or your customer's, network and become what we call an advanced persistent threat (APT).

The industrialisation of hacking

Today’s malware is targeted, extremely sophisticated and highly lucrative. Criminals are well aware that the penalties, if caught, are significantly less for cybercrimes than for traditional crimes.

Often it is a lot safer for them too, with more return for less risk.

And these criminals are having success.

Cisco's 2014 Annual Security Report, found that 100% of the companies being monitored for malware on their networks had network traffic that went to known malware sites.

Even though these findings were based on global organisations, it is safe to say New Zealand organisations are equally affected.

The high penetration of malware in networks means we have to think about security differently: If you made the assumption that you, or your customer, is already compromised, would you do your security differently?

The attack continuum

Modern malware is designed to evade detection techniques. Malware will change itself when it replicates so signature detection will no longer recognise the file. It is also able to detect if sandbox protection is in place and take measures to look normal.

Therefore we need to assume that our defences are not absolute. We need to take a much wider view of security in the context of both our defence-in-depth strategy and of the attack continuum.

The attack continuum views an attack across its entire life:

* Before the attack – this is our defensive position. We use traditional tools and architectures to minimise our vulnerabilities, including firewalls, patching and network segmentation.

* During the attack – we identify that an attack is occurring, then deploy a countermeasure to block the threat. Technologies like intrusion prevention, web and email content security and current anti-malware solutions (known as ‘sandboxing’) are used here.

* After the attack – this is the ‘clean-up’ phase, where we want to get back to operational status as quickly as possible and, hopefully, identify and prosecute the attacker. This includes our disaster recovery processes, but also includes forensic capabilities and advanced malware solutions.

What do we do now?

System integrators need to help organisations understand the threat landscape and assist with solutions that cover the attack continuum.

The new security model means that SIs need to expand the scope of their services and solutions.

Organisations need to have visibility of threats throughout their networks and the security tools to defend, block and even retrospectively eradicate them.

They need to know threats may have entered their networks as legitimate traffic, but have changed their personas and become malicious over time.

Vendors are delivering a multi-layered threat-centric security model, which includes integrated solutions across the attack continuum but also understands the key security fundamentals required to be able to protect our networks.

Let’s have a proper security conversation with our customers, and not just sell them a shiny new security toy.

By John-Paul Sikking, Cisco NZ security specialist

Kiwis make waves in IoT World Cup
A New Zealand company, KotahiNet, has been named as a finalist in the IoT World Cup for its River Pollution Monitoring solution.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
How SMBs can use data to drive business outcomes
With the right technology, companies can capture consumer, sales, and expense data, and use it to evaluate and construct future plans.
Survey shows that IoT is RoI across Asia Pacific
A recent Frost & Sullivan survey across Australia, Hong Kong and Singapore shows that IoT deployment improves business metrics by around 12%.
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Security platform provider Deep Instinct expands local presence
The company has made two A/NZ specific leadership hires and formed several partnerships with organisations in the region.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.