Check Point provides multiple protections against ... » Check Point has announced that its network security products offer multiple protections against the ... Tyco UAE and CNL Software partner for major UAE pr... » CNL Software has partnered for an iconic security management project with Tyco Fire & Security UAE, ... Cubic unveils new corporate branding » SAN DIEGO, Calif.: Cubic Corporation has introduced its new corporate brand identity. The name Cubic... Taxware acquires VAT Resource...enhances value add... » Wilmington, MA.: axware, a global provider of sales, use and value added tax (VAT) compliance softwa... Courion expands international footprint with two n... » London, UK: Courion has announced two new hires in the UK and the Middle East to help boost its stra... Skyscape sponsors race across America team in supp... » London: Skyscape Cloud Services Limited has announced that it is supporting the London Pride Spinhal... gateprotect becomes a Member of the German Allianc... » Hamburg: gateprotect AG Germany, Germany’s leading independent IT security specialist, has been admi... Building big ideas from small bricks: COPA-DATA la... » Since the beginning of April, LEGO bricks have been taking over the desks and offices of students, e... HeartBleed Vulnerabil​ity Overshadow​s Patch Tuesd... » In this blog Wolfgang Kandek, CTO, Qualys, detailS the vulnerability in OpenSSL and how it can be... Forensic experts team up with Teesside University ... » Leading forensic experts and law enforcement professionals recently gathered to find out how Tee...

CLICK HERE TO

Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.

READ MORE

Subscribe to Vigilance Weekly

Information Security Header

Sharik is a Trojan which injects itself into legitimate processes, and adds registry entries for an added level of persistence. The infection also sends information about the victim's PC to a remote server. The threat can also receive commands from a known CnC server to download further malicious files. The point of origin in this case is almost always a compromised website, as discussed previously in a Zscaler blog. At the time of research, Chris Mannon, a researcher, Zscaler ThreatLabZ, had not pinpointed the initial infection for this threat. The end result of the Trojan infection appears to be identical to past iterations of this threat.

 

Threat protection needs a greater context today

Traditional security scanning doesn’t work when threats are either net-new or polymorphic in order to evade signatures. That kind of attack shows that it is time for a security paradigm shift. When dealing with previously unknown malware, security shields have to provide the ability to look into a greater context. Signature-based approaches are deemed to fail, as they depend on an understanding of patterns that suggest an attack, and therefore are incapable of detecting new threats. If security systems lack threat histories and known patterns that can be detected, they won’t succeed with nowadays advanced threats.

Enterprises increasingly face advanced persistent threats (APTs) that may leverage previously unknown attack techniques and vulnerabilities. Attacks are increasingly multi-part and sophisticated, sometimes combining APTs and zero-day threats. Behavioural analysis is an important technique for identifying previously unknown threats because this approach does not rely on signatures. Well-executed behavioural analysis can also result in low false-positives compared to traditional pattern matching or signature-based approaches because suspicious activity is observed over a period of time and confirmed.

With behavioural analysis solutions, a binary file is permitted to run in a controlled environment, and its behaviour is monitored and analyzed. Identification of suspicious behaviour—such as the downloading of malware, accessing the file system, logging keystrokes, etc.— allows for the identification of malicious content, even if the sample or techniques leveraged have never been previously observed.

The integration of big data, static analysis and behavioural analysis provides a fuller context for threat protection. By combining behavioural analysis and big data analysis in a cloud-based environment, historical transactions can be linked to with the latest intelligences derived from data mining in the cloud.

Enterprises will continue to encounter APTs that leverage previously unknown attack techniques and vulnerabilities. Only if they manage to adapt and embrace new technologies they will be able keep pace with the evolving threat landscape. Context-based behavioural analysis is essential for protection against modern threats, especially in a work environment that is driven by mobility and always-on mentality of staff, which leads to a greater exposure to security risks.