Welcome to The UltraTech Zone Sign in | Join | Help

Talking Out Loud with ASB

Views on Life, Technology and Everything, by ASB (aka Logik!)...

My Profile

Andrew S. Baker (ASB)

News

  • Platform: CS v2.1 SP2...

    Get a FREE phishing filter for your domain!

    Who links to my website?

    Pando Pro

It’s Time to Re-evaluate Host-based Security

I’ve said it for a few years now, but host-based antivirus is really not working out anymore.  Not with its reliance on signatures to detect malware.

Broken SecurityRecently, several prominent antivirus vendors have experienced problems with faulty virus definitions: 

Although all of these vendors have promised the obvious improvements to their QA and testing processes (and I have no reason to believe that they are insincere), there is no sign that these problems will diminish over time.  Instead, it is pretty clear that there will be more problems as the massive increase of malware is forcing vendors to push out updates faster and faster.

There are several problems with malware protection which relies on signatures:

  1. Malware writers are using sophisticated toolkits which reduce the skill and time needed to produce effective malware – both new and variants.
     
  2. Polymorphic malware regularly gets around signature detection, forcing AV vendors to constantly push out new signatures – several times per day!
      
  3. There are many kinds of malware that are still not properly detected by up-to-date AV solutions with current definitions.
     

Where does this leave us?  Host-based antivirus products are using up more and more CPU cycles to process an ever-growing list of viruses, yet are still unable to keep up with the onslaught of new malware.   To make matters worse, the constant creation and release of new definition files is stressing the quality assurance (QA) process for antivirus vendors.   We have reached the place where IT professionals are considering turning off automatic AV updates, and deploying labs to test the updates before release.

In short, the odds of timely detection continues to drift downward every so slowly, while the risk of friendly fire from the AV solution itself creeps upward ever so steadily.  (The McAfee update issue had an impact on its clients that rivaled a major virus attack.)

We are long overdue for a different approach.

 
Application Whitelisting

Companies such as Bit9, CoreTrace, and Lumension have been pushing application whitelisting for years now.  Microsoft has also provided this technology via AppLocker in Vista, Windows 7 and Server 2008Even some of the major AV players have purchased or developed application whitelisting technology, but they have not been actively pushing it into the mainstream.  They need to start.

Better yet, we as IT leaders and professionals need to start evaluating and deploying the technologies that better address information security concerns in 2010 and beyond, allowing us to make better use our limited budgets and resources.

Application whitelisting is a good idea, because for every environment, there are less items that fall into the “known good” category than bad code that you don’t want to run.  Just consider the difference in a firewall rule-set that assumes a "deny all that has not been explicitly opened" stance vs one that tries to explicitly prevent access to all bad protocols and ports. 

The frequency of change in the “allow list”, particularly in corporate environments, will be greatly reduced as compared to the “bad list”.  This automatically minimizes the chance for error.   It also means that the processing power needed to evaluate the former list will be far less than that needed to evaluate the current lists of malware in today’s signature-based AV products.

 
Mitigating Code-Enabled Data

I think that we really have to weigh the disadvantage of code-enabled data files and either abandon them outright (queue lots of whining), or at least ensure that there are centrally controlled configuration options for enabling or disabling the automation features of productivity applications.

For instance, consider how diminished the threat of macro-embedded documents has become since Microsoft enabled much better controls over macro security, including turning them off by default, and allowing them to be set via policies.  Remember when macro viruses were the most common threat vector?  We need to do the same for PDF exploits.

Getting a better handle on security at the host level entails not only controlling which application can run, but determining in what context, and with what functionality it can run at any given time.  If we can get vendors to provide us with centralized controls regulating all of the features they integrate into their apps, then each person and each organization can determine what level of risk to assume for any given application – and in the event of an emergency, the problematic feature can be disabled or otherwise impaired on as a stopgap.

All of these options will sufficiently mitigate external risks without simultaneously increasing risks from errors.  And they will consume less processing power and generate less application conflicts than our current antimalware solutions.

 
Using the Right Technology

Signature-based security devices still have their place within the enterprise – mostly at the perimeter.  (And even there, their days are numbered.)  But at the desktop, they are increasingly causing more pain than gain, and it is time for us to change our approach, lest we find ourselves slipping further and further behind the malware writers.

And whitelisting need not concern itself with every executable.  Each organization can determine just how much to watch and keep track of, balancing performance, productivity and security according to a risk profile that they select.

Yes, there will be a few challenges to address in order to see mainstream use of whitelisting technology – including the integration of such technology into the patch management process – but, the gains will be well worth it.  Environments that have moved in this direction are already seeing significant ROI just in terms of recovering lost administrator time from managing the AV process and from recovering from broken antivirus definitions.

If you haven’t looked at Microsoft’s AppLocker technology, or at the technology from one of the other vendors, you owe it to yourself and your organization to start evaluating, testing and ultimately deploying.  Those who get ahead of the curve in the next 9-15 months will save themselves and their organizations significantly vs those who keep using the same old methods, even as the nature and intensity of the threat landscape has changed dramatically.

Blacklisting is out.  Whitelisting is in.  Please get with the program.

Share Post:

Comments

BrainWave Technology Tidbits said:

I’ve said it for a few years now, but host-based antivirus is really not working out anymore.  Not

# May 10, 2010 2:47 PM

Steve Wolfe said:

I agree, white listing is definitely a viable approach, however, somewhere in the back of my mind I envision if white listing deals a severe blow to malware - the really smart malware designers will be begin working on application GUID theft - think of it has identity theft at the bit level.

Andrew, very good well written article.

# May 11, 2010 7:22 AM

Logik! said:

Thanks, Steve.

I believe that whitelisting will be a significant deterrent to most of the prevalent forms of malware we experience today.  However, this will not the final salvo.  The malware writers will adjust, and we'll need to adjust to deal with their new attacks.

The key is that we won't have time to even catch up if we don't start moving away from our high levels of reliance on signatures at the host-level today.

-ASB: http://xeesm.com/AndrewBaker

# May 11, 2010 7:35 AM
Anonymous comments are disabled

About Logik!

Andrew S. Baker aka ASB aka Logik!

Andrew S. Baker is a business-savvy, hands-on IT leader with expertise in mentoring people, mitigating risk, and integrating technology to drive innovation and maximize business results. He creates competitive advantage for organizations through effective IT leadership: implementation of processes and controls, and architecture of robust business solutions.

Mr. Baker has successfully led a number of high-performance technology teams in designing, deploying and maintaining secure, cost-effective computing environments for well-known companies, including Warner Music Group, The Princeton Review, Bear Stearns, About.com, and Lewco Securities.

For over a decade, Andrew has exhibited thought leadership on technology and business topics via mailing lists, technical forums, blogs, and professional networking groups, along with contributions to podcasts, webinars, and over 20 technical/business magazine articles. He also serves on several boards and committees for non-profit organizations, and within the Seventh-day Adventist church.

His personal interests include Astronomy, Basketball, Bible Study, Chess, Comics, Computers, Family Life Ministries, Reading, Strategy/Role Playing games, and Professional Networking...

A summary of Andrew's current résumé is available here, and he can be reached on a variety of social and professional networks, including LinkedIn, Facebook and Twitter.