Blocking zero-day application exploits: A new approach for APT prevention
by George Tubin - Senior security strategist at Trusteer - Wednesday, 3 April 2013.
In the event that malware is somehow able to install on an endpoint device, a second and different layer of protection should be implemented to prevent the malware from accomplishing its goal of stealing information. This mechanism also uses the concept of whitelisting and applies it to data exfiltration states. In other words, it monitors and only allows legitimate external communication to be transmitted from the endpoint device.

When information-stealing malware enters the endpoint through an email attachment, a web download or infected media, it attempts to use data exfiltration techniques to communicate stolen data and credentials to the Internet. For example, malware can compromise a legitimate application process, creating a “zombie” process that looks authentic, or directly send data to an external IP address.

With this second layer of security, applications that exhibit data exfiltration states are restricted from communicating with the Internet or other processes but are permitted to perform other, more benign operations such as printing and file access. Restricted applications are then further analyzed and either whitelisted or removed if found malicious.

Automated management

The key to implementing Stateful Application Control is making it highly manageable so that it requires no end user intervention and minimal IT staff involvement. This can only be accomplished through a sizeable network of endpoints that enable new, legitimate application and data exfiltration states to be detected, whitelisted and immediately pushed out to all protected endpoints via the cloud. Additionally, corporations should be able to whitelist specific tools that would otherwise be restricted due to the nature of their operation.


Email scammers stole $215M from businesses in 14 months

Posted on 29 January 2015.  |  In 14 months there have been nearly 1200 US and a little over 900 non-US victims of BEC scams, and the total money loss reached nearly $215 million.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Jan 30th