Blocking zero-day application exploits: A new approach for APT prevention
by George Tubin - Senior security strategist at Trusteer - Wednesday, 3 April 2013.
In the event that malware is somehow able to install on an endpoint device, a second and different layer of protection should be implemented to prevent the malware from accomplishing its goal of stealing information. This mechanism also uses the concept of whitelisting and applies it to data exfiltration states. In other words, it monitors and only allows legitimate external communication to be transmitted from the endpoint device.

When information-stealing malware enters the endpoint through an email attachment, a web download or infected media, it attempts to use data exfiltration techniques to communicate stolen data and credentials to the Internet. For example, malware can compromise a legitimate application process, creating a “zombie” process that looks authentic, or directly send data to an external IP address.

With this second layer of security, applications that exhibit data exfiltration states are restricted from communicating with the Internet or other processes but are permitted to perform other, more benign operations such as printing and file access. Restricted applications are then further analyzed and either whitelisted or removed if found malicious.

Automated management

The key to implementing Stateful Application Control is making it highly manageable so that it requires no end user intervention and minimal IT staff involvement. This can only be accomplished through a sizeable network of endpoints that enable new, legitimate application and data exfiltration states to be detected, whitelisted and immediately pushed out to all protected endpoints via the cloud. Additionally, corporations should be able to whitelist specific tools that would otherwise be restricted due to the nature of their operation.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th