Paul Henry’s 2011 Malware Trends

31
Paul Henry’s 2011 Malware Trends

TAGS:

description

Join security and forensics expert, Paul Henry, to learn about the latest malware trends and more importantly, practical steps you can take to better protect your organization from evolving threats. Learn:• How social media and removable devices have become new, targeted paths into your network• Why traditional defenses are not effective in the unending arms race with financially motivated “bad guys”• How to ensure an effective depth-in-defense security strategy that includes application whitelisting

Transcript of Paul Henry’s 2011 Malware Trends

Page 1: Paul Henry’s 2011 Malware Trends

Paul Henry’s 2011 Malware Trends

Page 2: Paul Henry’s 2011 Malware Trends

Today’s Speaker

2

Paul HenrySecurity & Forensics AnalystMCP+I, MCSE, CCSA, CCSE, CFSA, CFSO, CISSP,-ISSAP, CISM, CISA, CIFI, CCESANS Institute Instructor

Page 3: Paul Henry’s 2011 Malware Trends

Today’s Agenda

Shift in IT Risk and Threat Landscape

2011 Malware Trends

Practical Steps to Prevent Malware

Q&A

Page 4: Paul Henry’s 2011 Malware Trends

Ask a Question Via Twitter

In addition to asking questions via the Webcast interface, you can also ask

questions via the Twitter hashtag:

#malware2011

4

Page 5: Paul Henry’s 2011 Malware Trends

The Shifting IT Risk and Threat Landscape… and the Impact to Your Information

Page 6: Paul Henry’s 2011 Malware Trends

Shift in Information that is Targeted

•Market for stolen data is saturated» Then - Stolen personally identifiable information sold on the black market for up

to $15 per record

» Now - Credit card data has dropped to about 20 cents per record

•New, more valuable target is now intellectual property (IP)» Revenue-generating information» Much larger impact and value – organization versus individuals

6

Page 7: Paul Henry’s 2011 Malware Trends

Web Applications are the Leading Attack Path

The applications we use today for productivityCollaborative / Browser-based / Open Source

Social Communities, Gadgets, Blogging and Widgets open up our networks to increasing risk everyday.

7

Source: Verizon, 2010 Data Breach Investigations Report

Page 8: Paul Henry’s 2011 Malware Trends

Endpoint Security Today

Organizations do not feel more secure than they did last year.

This is mainly due to the use of ineffective technology solutions when better, more effective and efficient

technologies exist but are not heavily implemented.

8

Page 9: Paul Henry’s 2011 Malware Trends

2011 Malware Trends

Page 10: Paul Henry’s 2011 Malware Trends

1. Social Media is Top Delivery Vehicle

2. Improved Hacking Tools Available in the Wild

3. Malware Continues to Be Ahead of Traditional Defenses

4. DDoS Attacks and Fake AV Continue to Increase

5. Stuxnet is a Game Changer5

Page 11: Paul Henry’s 2011 Malware Trends

Trend #1: Social Media as a Delivery Vehicle for Malware

Q. What do click jacking, spear phishing and passwords sent in the clear all have in common?

R. You will find them daily on Facebook

» Focus on the end game and not the delivery vehicle

» Prevent the malware from running and you are good to go

Source: Verizon, 2010 Data Breach Investigations Report

11

Page 12: Paul Henry’s 2011 Malware Trends

Click Jacking On Facebook

12

Page 13: Paul Henry’s 2011 Malware Trends

Spear Phishing On Facebook

13

Page 14: Paul Henry’s 2011 Malware Trends

Sniffing Passwords On Facebook

14

Page 15: Paul Henry’s 2011 Malware Trends

Be Sure to Change to HTTPS

Account>Account Settings>Account Security and select the secure browsing / HTTPS checkbox and your FB visit including your login will be encrypted

15

Page 16: Paul Henry’s 2011 Malware Trends

Trend 2: Better Tools For The Bad Guys

16

Page 17: Paul Henry’s 2011 Malware Trends

Trend 3: Traditional Defenses are Not Keeping Up

17

Page 18: Paul Henry’s 2011 Malware Trends

Trend 4: DDoS and Fake AV Attacks on the Rise

•DDoS Continues to Evolve

18

Page 19: Paul Henry’s 2011 Malware Trends

Trend 4: DDoS and Fake AV Attacks on the Rise

19

•Increase in Fake AV Attacks

Page 20: Paul Henry’s 2011 Malware Trends

Why Question Big Money In Fake AV?

Over 500,000 Unique Fake AV Binaries in the last Q of 2010

20

Page 21: Paul Henry’s 2011 Malware Trends

Trend 5: Stuxnet – A Game Changer

21

Page 22: Paul Henry’s 2011 Malware Trends

It Is Not Over Yet

22

Page 23: Paul Henry’s 2011 Malware Trends

Summary of Trends

•Greater volume of personal information and intellectual property – greater chance of success

•Social Media is today’s vector of choice

•Removable devices are an often under-rated threat

•It is cheaper and easier to produce a threat than a defense, so it is not going to get any better in the foreseeable future

•New threats on the horizon include increases in ad injection and site redirection – implied trust on the Internet is long gone…

23

Page 24: Paul Henry’s 2011 Malware Trends

Practical Steps to Prevent Malware

Page 25: Paul Henry’s 2011 Malware Trends

Focus on the Endgame, Not the Delivery Method

•Every threat we discussed today requires a bad guy to execute code on the user’s PC

•The bad guys regularly outsmart defenders with new innovative delivery methods – It’s an arms race you cannot win

•If the application is not explicitly authorized and proven to be trusted, then why would you let it execute?

25

Page 26: Paul Henry’s 2011 Malware Trends

Rethink Your Patch Strategy

Source:

1 - SANS Institute

26

•The top security priority is “patching client-side software”1

» Streamline patch management and reporting across OS’s AND applications

•Patch and defend is not just a Microsoft issue» More than 2/3 of today’s

vulnerabilities come from non-Microsoft applications

26

Page 27: Paul Henry’s 2011 Malware Trends

Ensure Depth-in-Defense with Application Whitelisting

27

Learned(Adaptive)

Allow Known Good; Block Everything Else

Block Known Bad; Allow Everything Else

•Approach to endpoint security must be based on Defense-In-Depth

» Antivirus shifts to after-the-fact cleanup» Application whitelisting provides more effective

endpoint security » And it is evolving in its flexibility and manageability

to ensure improved productivity

Gartner Research

27

Page 28: Paul Henry’s 2011 Malware Trends

Manage the Removable Devices in Your Environment

*Worldwide State of The Endpoint Report 2009

Without Enforcement, Your Policy has No Teeth!

2828

Page 29: Paul Henry’s 2011 Malware Trends

Consolidate Your Endpoint Security Technologies

•Multiple Consoles•3-6 different management consoles on average

•Agent Bloat•3-10 agents* installed per endpoint•Decreased network performance

•Lack of Control•54% of IT security professionals cite managing the complexity of security as their #1 challenge•Decreasing visibility-disparate data•Ad-hoc monitoring of security posture

•43% of existing access rights were either excessive or should have been retired

•Increasing TCO of Point Technologies•Integration & MaintenanceLumension Global State of The Worldwide Endpoint 2009

29

Page 30: Paul Henry’s 2011 Malware Trends

Q&A

Page 31: Paul Henry’s 2011 Malware Trends

Global Headquarters8660 East Hartford Drive

Suite 300

Scottsdale, AZ 85255

1.888.725.7828

[email protected]

mailto:[email protected]

Ms Henry’s – Kindergarten Class

Ms Henry’s – Kindergarten Class

Philippians (Week 1) Matthew Henry’s Concise …morninggloriesbiblestudy.com/Philippians booklet.pdfPhilippians (Week 1) Matthew Henry’s Concise Commentary Introduction to Philippians

Philippians (Week 1) Matthew Henry’s Concise …morninggloriesbiblestudy.com/Philippians booklet.pdfPhilippians (Week 1) Matthew Henry’s Concise Commentary Introduction to Philippians

Malware & Anti-Malware

Malware & Anti-Malware

Henry’s Book Response on “ Who Were The Beatles ?”

Henry’s Book Response on “ Who Were The Beatles ?”

Mr. Henry’s US VA History Class, 2013 - 2014

Mr. Henry’s US VA History Class, 2013 - 2014

Decorate HORRiD HENRY’s birthday cake! · Decorate HORRiD HENRY’s birthday cake! Add colourful candles, icing, and even a message! Horrid Henry stories by ...

Decorate HORRiD HENRY’s birthday cake! · Decorate HORRiD HENRY’s birthday cake! Add colourful candles, icing, and even a message! Horrid Henry stories by ...

Affiliate WebAffiliate Web-based Malwarebased Malware · Affiliate WebAffiliate Web-based Malwarebased Malware Paul O Baccas (paul.baccas@sophos.com) 1st O b 2008October, 2008. This

Affiliate WebAffiliate Web-based Malwarebased Malware · Affiliate WebAffiliate Web-based Malwarebased Malware Paul O Baccas ([email protected]) 1st O b 2008October, 2008. This

Malware Detection by HTTPS Traffic Analysis · 2017-01-23 · Malware Detection by HTTPS Traffic Analysis Paul Prasse 1, Gerrit Gruben , Jan Kohout2, Lukas Machlika2, Tom´as Pevnˇ

Malware Detection by HTTPS Traffic Analysis · 2017-01-23 · Malware Detection by HTTPS Traffic Analysis Paul Prasse 1, Gerrit Gruben , Jan Kohout2, Lukas Machlika2, Tom´as Pevnˇ

Optimal Experimental Designs for Estimating Henry’s Law ...

Optimal Experimental Designs for Estimating Henry’s Law ...

Mr. Henry’s Social Studies 7 Class, 2011 - 2012

Mr. Henry’s Social Studies 7 Class, 2011 - 2012

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Henry’s 6 wives

Henry’s 6 wives

Ms Henry’s – Kindergarten Class Welcome, Grown-ups!

Ms Henry’s – Kindergarten Class Welcome, Grown-ups!

Malwaremoutane.net/RMLL2013/day_1/linux_malware.pdf · Linux malware presentation @r00tbsd – Paul Rascagnères from Malware.lu Darkleech/Chapro Analysis – Reversing xor_decrypt_string

Malwaremoutane.net/RMLL2013/day_1/linux_malware.pdf · Linux malware presentation @r00tbsd – Paul Rascagnères from Malware.lu Darkleech/Chapro Analysis – Reversing xor_decrypt_string

Patrick Henry’s Speech to the Virginia Convention

Patrick Henry’s Speech to the Virginia Convention

Patrick Henry’s “Speech to the Virginia Convention”

Patrick Henry’s “Speech to the Virginia Convention”

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Horrid Henry’s Underpants

Horrid Henry’s Underpants

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators