Malware Defense-in-Depth 2.0

A practical approach to secure your enterprise against viruses,

worms and rootkits

Aa’ed Alqarta

The ProblemSecurity defenses can’t keep up

with latest threatsMalware is penetrating the

network and infecting computersAntivirus software is not a silver

bullet for all threatsWe are losing the war against

malware

What is a Malware?According to NIST, “Malware (NIST, 2005) refers to a

program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system (OS) or of otherwise annoying or disrupting the victim.”

NIST: National Institute of Standards and Technology

Types of MalwaresVirusesWormsBackdoorsSpywaresBots “Botnets”RootkitsRansomware

Top Malware Targets

Attack AnatomyAttackers discover vulnerabilities and

write exploits for them (e.x JS)They infect web sites to attack visitorsA visitor browse the site and

immediately get infected A virus will be installed in the

background and infect the client software

Infected computers will attack internal clean machines (Workstations/Servers)

Web URL FilteringEnable AV scanning for malicious

files/URLsBlock access to malicious

categories (Porn/Hacking/Downloads/Video/P2P/Torrent/Blogs/Infected Hosts/IM)

Block downloads of executables (exe/dll/com)

Inspect SSL traffic for malicious traffic

Application Control (Whitelisting)Allow business approved applications

only◦Office, Accounting, Finance, …etc

Protect critical system files from modifications

Block any unapproved applications (including malwares)

The ability to block zero-day malware if AV is not detecting it

Monitoring of all applications usage in the net

Device Control

Block the usage of removable drives (Flash / IPod / H.D / Camera)

If you should allow Flash drives in the network:

- Use “Secure” Flash disks (Encryption, AV, Password

- Disable “Autorun” and block exe/Autorun.inf

Network Access ControlOnly allows compliance computers

in the network◦AV is running and updated◦FW is running◦Latest Service Pack◦Domain User

Quarantine infected computers in a separate “Remediation Environment” ◦WSUS, AV Server, Proxy

FW Best PracticesNo “Any Any” rulesOut-bound SMTP for Exchange

servers onlyHTTP/HTTPS/FTP are a good start

for end userBlock Infected computersEnabled outbound denied logging

Case Study: Conficker/DownadupWindows Server service vulnerability

(MS08-067)W32.Downadup A, B, C, EPropagates through network file

shares, flash disksDisables User Accounts in ADBlocks access to security sites and MS

updatesStops security tools and softwares

“self-protection”

SummaryUse a good antivirus which has a

high detection ratePatch OS + 3rd party applicationsUse Application Whitelisting +

Device ControlBlock access to malicious, media,

downloads, and blogs Network segmentationsWeb content filtering policy

Thank You

E-mail me: a.qarta@gmail.com http://extremesecurity.blogspot.com

Malware Defense-in-Depth 2.0

Technology

Defense-in Depth - CSM-ACE Dicussion 3 Panelist … · Defense In Depth • The concept of defense in depth is to manage all kinds of risk with diverse defensive strategies; physical

Table of Contents...organizational defense-in-depth strategy by isolating malware, ransomware and other threats where they can’t harm corporate network or user devices. It transparently

Malware & Targeted Attacks: 8 Step Defense Plan

Malware Introduction and Defense

Real Time Malware Defense System in LINUX

Defense in Depth: How Application Whitelisting Can ... · Defense in Depth: How Application Whitelisting Can Increase Your Desktop Security. Defense in Depth: How Application Whitelisting

Ransomware: Defense in Depth with VMware

Defense in Depth: In Depth · Defense in Depth: Consider your users’ threat model - Antipattern: Planning for only your organization’s security needs - Pattern: Consider every

Controlling Modern Malware - Palo Alto Networks · Controlling Modern Malware Introducing WildFire: the Next-Generation of Malware Defense ... send them to WildFire for analysis

Targeted Defense for Malware & Targeted Attacks

Bio g defense in depth presentation

DC970 Presents: Defense in Depth

Computer Network Defense Coursemadlinux.com/cndc/01 - Malware-Labs-Worksheets (Vista AGM).pdf · CNDC Computer Network Defense Course - Exploit and Malware Analysis - Fort McCoy,

Mobile Malware Evolution, Detection and Defense

Defense in Depth - conexxus.org · Defense in Depth (aka Layered Approach) “Defense in Depth” is the use of multiple computer security techniques to mitigate the risk of one component

Exploiting Similarity Between Variants to Defeat Malware · Impact of Variation on Malware Defense Adds layer of complication defense was bad enough before variant flood now malware

CS5261 Information Security CS 526 Topic 15 Malware Defense Topic 15: Malware Defense

Offensive malware usage and defense

Android Malware Exposed - An In-depth Look at its Evolution

PDF 7.1 Defense in Depth(1)