Ted Plumis, Vice President of World Wide Channel... » London, UK: Imperva Inc. has announced that Ted Plumis, vice president of World Wide Channels for Im... PixAlert launches integrated OCR capability to str... » PixAlert has introduced integrated, optical character recognition (OCR) capability to their portfoli... Blesma Chief Executive leads team to scale ne... » This summer, former Brigadier and Blesma Chief Executive, Barry Le Grys, will be leading a team of a... Championship teams unite in support of injured s... » Nottingham Forest and Bolton Wanderers players and fans pulled out all the stops on Saturday in supp... AdaptiveMobile launches SS7 Protection to sec... » DUBLIN & DALLAS: AdaptiveMobile has launched SS7 Protection – a new product that secures mobile oper... Portal wins 2015 IBM Beacon Award for Outstandin... » UK: Portal was named a winner of a 2015 IBM Beacon Award for Outstanding Solution for Midsize Busine... Moxa's new EDR-810 Firmware to support transpare... » Munich: Moxa has released a new firmware for the EDR-810 industrial 8+2G multiport secure router to ... Cubic receives additional $2.9 million training or... » SAN DIEGO, Calif.: Cubic Corporation has been awarded a contract modification valued at more than $2... Defence Secretary hails UK military for mission in... » Photo: MoD DEFENCE Secretary, Michael Fallon, has said that UK personnel have made a vital contribu... Quantum's Stornext cuts complexity with workload s... » SAN JOSE, Calif.: Quantum Corp. has announced a video surveillance solution certified with Milestone...

CLICK HERE TO

Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.

READ MORE

Subscribe to Vigilance Weekly

Information Security Header

Sharik is a Trojan which injects itself into legitimate processes, and adds registry entries for an added level of persistence. The infection also sends information about the victim's PC to a remote server. The threat can also receive commands from a known CnC server to download further malicious files. The point of origin in this case is almost always a compromised website, as discussed previously in a Zscaler blog. At the time of research, Chris Mannon, a researcher, Zscaler ThreatLabZ, had not pinpointed the initial infection for this threat. The end result of the Trojan infection appears to be identical to past iterations of this threat.

 

Threat protection needs a greater context today

Traditional security scanning doesn’t work when threats are either net-new or polymorphic in order to evade signatures. That kind of attack shows that it is time for a security paradigm shift. When dealing with previously unknown malware, security shields have to provide the ability to look into a greater context. Signature-based approaches are deemed to fail, as they depend on an understanding of patterns that suggest an attack, and therefore are incapable of detecting new threats. If security systems lack threat histories and known patterns that can be detected, they won’t succeed with nowadays advanced threats.

Enterprises increasingly face advanced persistent threats (APTs) that may leverage previously unknown attack techniques and vulnerabilities. Attacks are increasingly multi-part and sophisticated, sometimes combining APTs and zero-day threats. Behavioural analysis is an important technique for identifying previously unknown threats because this approach does not rely on signatures. Well-executed behavioural analysis can also result in low false-positives compared to traditional pattern matching or signature-based approaches because suspicious activity is observed over a period of time and confirmed.

With behavioural analysis solutions, a binary file is permitted to run in a controlled environment, and its behaviour is monitored and analyzed. Identification of suspicious behaviour—such as the downloading of malware, accessing the file system, logging keystrokes, etc.— allows for the identification of malicious content, even if the sample or techniques leveraged have never been previously observed.

The integration of big data, static analysis and behavioural analysis provides a fuller context for threat protection. By combining behavioural analysis and big data analysis in a cloud-based environment, historical transactions can be linked to with the latest intelligences derived from data mining in the cloud.

Enterprises will continue to encounter APTs that leverage previously unknown attack techniques and vulnerabilities. Only if they manage to adapt and embrace new technologies they will be able keep pace with the evolving threat landscape. Context-based behavioural analysis is essential for protection against modern threats, especially in a work environment that is driven by mobility and always-on mentality of staff, which leads to a greater exposure to security risks.