Application exploit prevention allows for more stable, effective and manageable endpoint security than the traditional application control approaches. This is because there are far fewer and more static application states to analyze and maintain, as compared to the multitude of application files that other application control approaches must inspect and manage.
In the event that malware is somehow able to install on an endpoint device, a second and different layer of protection should be implemented to prevent the malware from accomplishing its goal of stealing information. This mechanism also uses the concept of whitelisting and applies it to data exfiltration states. In other words, it monitors and only allows legitimate external communication to be transmitted from the endpoint device.
When information-stealing malware enters the endpoint through an email attachment, a web download or infected media, it attempts to use data exfiltration techniques to communicate stolen data and credentials to the Internet. For example, malware can compromise a legitimate application process, creating a “zombie” process that looks authentic, or directly send data to an external IP address.
With this second layer of security, applications that exhibit data exfiltration states are restricted from communicating with the Internet or other processes but are permitted to perform other, more benign operations such as printing and file access. Restricted applications are then further analyzed and either whitelisted or removed if found malicious.
The key to implementing Stateful Application Control is making it highly manageable so that it requires no end user intervention and minimal IT staff involvement. This can only be accomplished through a sizeable network of endpoints that enable new, legitimate application and data exfiltration states to be detected, whitelisted and immediately pushed out to all protected endpoints via the cloud. Additionally, corporations should be able to whitelist specific tools that would otherwise be restricted due to the nature of their operation.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.