Feeds

Automatic graylisting of unwanted software

Maximum security, minimal effort

3 Big data security analytics techniques

According to Gartner's Security Software Forecast on 30 March, 2005, "revenue for the security software sector will grow at a compound annual growth rate of 16.2 per cent through 2009, with new license revenue reaching $11.4bn." This double-digit growth indicates that current solutions to today's problems are simply not working.

Today's solutions

Today's solutions to the problem of unwanted software take a narrow view and typically target just one problem, such as spyware. This requires IT administrators to install and manage an increasing number of agents on their systems. Furthermore, most products depend on perpetually out-of-date "black list" technology that compares executable files against a "known bad" list of bit patterns or behavior signatures. This approach leaves systems exposed to new, unknown, and potentially unwanted software.

Other products use a "white list" approach that limits systems to a "known good" list of executable files. While this approach provides the best protection in theory, these solutions are often overly restrictive and the administration of white lists is daunting.

When these approaches fail, the result is late detection, false alarms, and complexity. Furthermore, none of these approaches gives IT visibility and control over all the executables in their infrastructure. Clearly, what is needed is a solution that enables administrators to see and monitor what has arrived, when it has arrived, who has executed it, and where it is now.

Introducing automatic graylists

So far what we have learned is that black lists are eternally incomplete and white lists are difficult to maintain in dynamic environments. In desktop environments, new applications, plug-ins, and Active-X components - wanted or unwanted - appear frequently and do not yet exist in a black or white list. Both approaches require additional information to increase security coverage and reduce administrative burden.

Now there is a powerful new mechanism to control unwanted software that integrates with existing IT processes, called an automatic graylist. Unlike other alternatives that attempt to detect what's wrong or bad, automatic graylists track new unknown files - before they have been classified - and help automate their approval. When combined with white lists and black lists, automatic graylists overcome the drawbacks of today's other endpoint security solutions while providing the best possible protection.

Automatic graylists do not rely on malware signatures or behavioral patterns and allow the customer, not the vendor, to decide what software is appropriate and approved to run on their infrastructure.

In this new model, new application files are detected in real time as soon they appear on systems and are automatically added to the automatic graylist. They can be easily approved or banned, based on current security policy. This supports a dynamic environment, allowing the administrator to define the appropriate security policy for groups of desktops, laptops, and servers. With this information, IT professionals can create policies that automatically track and control software that has not been centrally rolled out or pre-approved by IT. When applied on a network-wide basis, this automatic graylist approach provides the best protection against unwanted software without a complex or costly administrative burden.

For host groups where graylisted software is blocked, this approach provides zero-day protection as new, unknown files are effectively put on probation. For example, enterprise customers could block new files for a period of time, e.g. 30 days, after which time the files are dropped from the automatic graylist. This buys customers time to react while anti-virus signatures catch up with new zero-day attacks.

Be prepared

IT managers, security managers, and executives are watching with mounting concern as unwanted software on enterprise endpoints increases. Furthermore, current security products offer, at best, limited protection against these applications and the costly damage associated with them. Current technologies do not provide enough early detection and lockdown capabilities to deal with new unknown and potentially malicious code, which is typically the most disruptive. And enterprises cannot respond quickly enough to avoid harm.

Now, with the approach of automatic graylists, security administrators for the first time ever have gained visibility and control over unwanted files that install and execute on user systems.

Copyright © 2005, SecurityFocus

Dr. Todd Brennan is Chief Technology Officer of Bit9, a security company that focuses on endpoint systems. Dr. Brennan also founded Okena, which dealt with emerging computer threats and was acquired by Cisco in 2003. He has been a research staff member at MIT Lincoln Laboratory, and he holds Ph.D. and M.S. degrees in Electrical and Computer Engineering from the University of Wisconsin.

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.