Story image

Different approach to malware detection needed – VMware

06 Dec 2018

Article by VMware Asia-Pacific and Japan vice president and chief technology officer Bruce Davie 

With no end in sight for major security breaches, it seems assured that security spending will continue to rise. 

In 2019, cyber attacks will continue to have a significant impact, raising the urgency of an approach to security that goes beyond “more of the same”.

The internet was designed with the objective of making it easy for computers across the world to communicate with each other. 

Indeed, it has proven extraordinarily successful in achieving connectivity at scale.

Unfortunately, as its designers acknowledge, security was not part of the design.

Hence, as enterprises accumulate more data and become more connected, there is increasing motivation to consider architectures in which security is built in from the outset.

Enterprises across the region can achieve fundamentally better security by adopting one of the foundational concepts of computer science, the principle of least privilege, combined with newer technologies like network virtualisation, to achieve an intrinsically secure architecture.

For example, in a well-documented hack of a retailer, credentials provided to a heating and cooling contractor were used to ultimately gain access to the payments network. 

This is a clear demonstration of how least privilege has not been applied – the contractors’ credentials provided much more privilege than what was needed to do the job.

Such wide-open network access is commonplace, in large part because technologies to apply least privilege to networking – such as network virtualisation and microsegmentation – have only become available relatively recently and are still gaining widespread adoption.

In a related development, security needs to move away from the traditional approach of chasing after arbitrary forms of malware.

There are many millions of different strains of malware designed with the explicit goal of escaping detection.

Chasing after malware is analogous to looking for a needle in a haystack.

A better approach is to focus on “known good” – ensuring that the code running on enterprise systems is the correct code that was provisioned to run, and nothing more.

We can move from chasing bad to ensuring good.

Again, the concept is not new, but new technologies are making this feasible.

For example, modern data centres use automation tools to provision software, giving us access to a manifest of the expected good behaviour.

Virtualisation gives us an enforcement point from which to observe the behaviour and ensure it conforms to what is expected.

Machine learning algorithms can also play a role. 

Machine learning systems are poor at extrapolation – they recognise what they have seen before, whether being used for image classification or to observe the software running in a data centre.

Thus, machine learning is unlikely to recognise new forms of malware that were not part of the training dataset. 

Conversely, these algorithms can be trained with reference datasets on how non-compromised applications and processes behave.

They can be trained to monitor “known good” behaviour and alert or take other pre-emptive actions when unexpected behaviour, indicative of a breach, is observed.

With IDC predicting that more than 50% of security alerts will be handled by AI-powered automation by 2022, machine learning is ready for primetime, but we must be acutely aware of its strengths and limitations.

Finally, while least privilege and ensuring good are key principles, enterprises in the Asia-Pacific region cannot ignore other basic cyber hygiene practices like patching, encryption of data at rest and in motion, and multi-factor authentication.

One of the most serious compromises of corporate data that was widely reported in 2017 happened because the company failed to patch for known vulnerabilities.

In fact, the Online Trust Alliance reported earlier this year that 93% of breaches are preventable through good cyber hygiene.

SecOps: Clear opportunities for powerful collaboration
If there’s one thing security and IT ops professionals should do this year, the words ‘team up’ should be top priority.
Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.