Please note that this is a page from a previous version of Continuity Central and is no longer being updated.

To see the latest business continuity news, jobs and information click here.

Business continuity information

Emulating the enemy

Threat emulation is a critical technique in achieving more effective network security. Terry Greer-King explains why.

‘Know your enemy as well as you know yourself’ is a frequently-quoted maxim in IT security. However, one of the problems facing businesses is that they seem to have new adversaries lining up every day to launch attacks, disrupt operations and stealthily siphon confidential data, using a bewildering array of malware. All of which makes ‘knowing the enemy’ a huge task.

Cybercrime has become big business and, just like any other business sector, criminals are looking to boost their revenues and grow their market share. This means targeting hundreds, even thousands of companies with their attacks, to increase the likelihood of success. The attack technique most commonly used is stealthy malware, which is designed to be hard to detect and operate below the radar of IT teams.

To give a sense of how this is now happening on an industrial scale, in 2012 an average of 70,000 to 100,000 new malware samples were created and distributed every day. This is over 10 times more per day than in 2011, and over 100 times more than 2006. It’s impossible for conventional anti-malware approaches to keep pace with this massive growth. Check Point’s 2013 Security Report found that 63 percent of organizations were infected with bots, and more than half were being infected with new malware at least once a day.

Hiding in plain sight

The code for a majority of these new infections is concealed in common file types that we all use for business: emails, Word documents, PDFs, Excel spreadsheets and so on. Hacker toolkits exist that can obscure these executable scripts, to disguise their malicious actions – which may mean changing the registry on a user’s computer, or downloading an executable file which can then infect the network. With the growing volumes of traffic on corporate networks, and the volume of new malware being introduced and hiding in plain sight in innocuous-looking files, organizations are vulnerable to zero-day attacks. And even though layered defences using IPS and IDS can help to block some malware actions, these still do not stop infections reaching the network and spreading across it.

So the sheer number and complexity of new attacks means we cannot hope to know everything about our enemies. However, we can at least understand our enemies’ intent, and the methods of attack they are likely to use. This can reveal vital intelligence that can be used to identify and nullify new risks.

Just as a country's border control will use a range of techniques to observe the people entering and identify those who pose a threat, new security techniques have made it possible to scrutinise the emails, files and data entering a network, and isolate malicious files at the network edge so that infection does not occur, and without impacting on the flow of business.

Observe, emulate, share, defend

This is done using a technique called threat emulation. Rather like a border control’s X-ray scanners, the technique makes it possible to look inside suspect files arriving at the gateway, and inspect their contents in a virtualized, quarantined area known as a ‘sandbox.’ In the sandbox, the file is opened and monitored for any unusual behaviour in real time, such as attempts to make abnormal registry changes or network connections. If its behaviour is found to be suspicious or malicious, it is blocked and quarantined; preventing any possible infection before it can reach the network and cause damage.

Following detection and blocking of a file in this way, organizations should be able to share information about the new threat, to help others avoid infection too. This helps to spread the knowledge acquired about a new enemy, in much the same way that global health organizations collaborate to fight emerging diseases – closing the time window between the discovery of a new attack, and the ability to defend against it.

After all, a 2012 study showed 85 percent of breaches from cyber-attacks took weeks or more to be discovered. If companies could share information online about emerging threats when they are identified, and before they infect networks, rates of infection could drop dramatically. This would helping the wider business community to know at least a little about a common enemy, before it can attack them. Perhaps emulation could become one of the strongest methods for securing against new threats.


Terry Greer-King is the UK managing director for Check Point Software Technologies. He has over 12 years of experience in the IT security sector and channel sales, and more than 30 years in technology sales and management. www.checkpoint.com

•Date: 22nd May 2013 • World •Type: Article • Topic: ISM

Business Continuity Newsletter Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.

How to advertise How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here