DOCSLIB.ORG

Surveying a World of Advanced Threats

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Surveying a World of Advanced Threats Chapter 1 Surveying a World of Advanced Threats In This Chapter ▶ Distinguishing between basic and advanced threats ▶ Recognizing three types of cyberenemies ▶ Counting the cost of data breaches It’s getting rough out there. I’m not kidding. In more than two decades of observing the effects of enterprise and government data breaches, I’ve never seen anything like today’s threat landscape. The sheer number of recent high-profile cyberattacks is staggering. The bad guys clearly have the upper hand, and it seems like there’s nothing that any of us can do about it. Given the efficacy of modern-day threats, today’s informa- tion security professionals are judged not only on how well they can block known threats but also on how quickly they can uncover, identify, and mitigate unknown threats. Unfortunately, too many security professionals lack the tools andCOPYRIGHTED training needed to stay ahead MATERIAL in this cyberarms race. In this chapter, I distinguish between basic and advanced cyberthreats while exploring common variations of advanced threats along the way. I also cite recent data-breach statistics, describe three types of cyberenemies, and review high-profile commercial and government cyberattacks that recently made international headlines. But first, allow me to clarify the differences between basic and advanced threats. 004_9781118658765-ch01.indd4_9781118658765-ch01.indd 3 77/1/13/1/13 112:452:45 PMPM 4 Advanced Threat Detection For Dummies Contrasting Basic and Advanced Threats The following are key characteristics of basic and advanced cyberthreats: ✓ Basic threats are known threats against known operat- ing system (OS) or application-level vulnerabilities. They are commonly detected by traditional signature-based network- and endpoint-security defenses, including intru- sion prevention systems (IPSs), secure web and e-mail gateways, and antivirus platforms. ✓ Advanced threats are unknown threats against unknown OS or application-level vulnerabilities. They can’t be detected by traditional signature-based defenses. Better network security devices can detect unknown threats (or new variants of known threats) that target known vulner- abilities, but I still classify those threats as basic. Obviously, as the name suggests, advanced threats are far more difficult to detect. Traditional security defenses that rely on pattern-matching signatures for detection are useless for detecting advanced threats. Don’t get me wrong — traditional defenses such as firewalls, IPSs, and secure web and e-mail gateways are your front line in a defense-in-depth (layers of security defenses) strategy. But you can’t rely on these tech- nologies exclusively for detecting today’s advanced threats. (Jump to Chapter 2 to find out why.) Before delving into some of the advanced threats that endan- ger today’s organizations, take a few minutes to reacquaint yourself with some basic threats that have been around for years. Basic Threats: Oldies but Baddies The basic cyberattacks described in this section generally don’t pose huge threats to enterprises and government agen- cies because they’re largely mitigated by traditional network 004_9781118658765-ch01.indd4_9781118658765-ch01.indd 4 77/1/13/1/13 112:452:45 PMPM Chapter 1: Surveying a World of Advanced Threats 5 and endpoint security solutions. If you fail to take them seri- ously, however, any of them could be your downfall. Worms, Trojans, and viruses A computer worm is malware that exploits the vulnerabilities of a computer’s OS (typically, Microsoft Windows) to self- propagate via the internal network to which the computer is linked. Worms are dangerous to any network because they can be used to exfiltrate data or otherwise harm computer systems. They also consume large amounts of bandwidth, causing degradations in network performance. Unlike a virus (discussed later in this section), a worm doesn’t attach itself to computer programs or files. A Trojan (or Trojan horse) is malware disguised as a legitimate software application to trick a user into installing it on a com- puter. Unlike computer worms, Trojans can’t propagate to other vulnerable computers on their own. Instead, they join networks of other infected computers (called botnets; see the next section), wait to receive instructions from the attacker, and then transfer stolen information. Trojans are commonly delivered by means of social media and spam e-mails; they may also be disguised as installers for games or applications. A computer virus is malicious code that attaches itself to a program or file so that it can spread from one computer to another, leaving infections as it propagates. Unlike a worm, a virus can’t travel without a human helper — in this case, a user who sends (usually unknowingly) an infected program or file to another user. Spyware and botnets Spyware is a form of malware that covertly aggregates user information without the user’s knowledge and forwards it to the perpetrator via the Internet. Sometimes, spyware is employed for the purpose of advertising (in which case it’s called adware and displays pop-up ads). At other times, it’s used to collect confidential information such as usernames, passwords, and credit-card numbers. Typically, spyware is secretly bundled into shareware or freeware. 004_9781118658765-ch01.indd4_9781118658765-ch01.indd 5 77/1/13/1/13 112:452:45 PMPM 6 Advanced Threat Detection For Dummies A botnet is a group of Internet-connected computers on which malware is running (bots). Bots are often used to commit denial-of-service attacks (attacks that overload a server’s pro- cessing power), relay spam, steal data, and/or download addi- tional malware to the infected host computer. The person who controls a botnet — the bot herder or botmaster — typically uses web servers called command-and- control (CnC) servers. CnC servers have only one job: control- ling bots. Social engineering attacks Social engineering attacks are extremely common, especially the two types discussed in this section: phishing and baiting. As I discuss later in this chapter, these attacks are often incor- porated into advanced threats. Phishing Phishing is an attempt to steal confidential information — usernames, passwords, credit-card numbers, Social Security numbers, and so on — via e-mail by masquerading as a legiti- mate organization. After clicking a seemingly innocent hyper- link in the e-mail, the victim is directed to enter personal information on an imposter website that looks almost identi- cal to the one it’s emulating. Phishing has two common variants: ✓ Spear phishing targets specific people within an organiza- tion, using information about them collected from social media sites such as Facebook, LinkedIn, and Twitter. ✓ Whaling is phishing that targets the senior executives of a given organization. Baiting Baiting occurs when a criminal casually drops a USB flash drive or CD-ROM in a public area (perhaps a parking lot or cybercafé) within close proximity of the targeted organiza- tion. The media device is labeled with enticing words such as Product Roadmap or Proprietary & Confidential to spark the finder’s interest. When the victim inserts the device into her computer, it instantly installs malware on the computer. 004_9781118658765-ch01.indd4_9781118658765-ch01.indd 6 77/1/13/1/13 112:452:45 PMPM Chapter 1: Surveying a World of Advanced Threats 7 Buffer overflows and SQL injections These two common techniques exploit vulnerabilities in web applications: ✓ A buffer overflow attack is a painfully common cyber- threat in which a malicious hacker knowingly writes more data into a memory buffer than the buffer is designed to hold. Data subsequently spills into adjacent memory, causing the application to execute unauthor- ized code that may grant the hacker administrative privi- leges or possibly even crash the system. ✓ In an SQL injection attack, the attacker enters SQL state- ments into a web form in an attempt to get the form to pass an unauthorized SQL command to the database. If successful, the attack can give its perpetrator full access to database content such as credit-card numbers, Social Security numbers, and passwords. Advanced Threats: Emerging Dangers Now that you’re up to speed on basic threats, it’s time to explore the advanced threats that are making headlines today. Advanced persistent threats Advanced persistent threats (APTs) — also known as advanced targeted attacks (ATAs) — are sophisticated, multivectored (perpetrated through multiple channels) cyberattacks in which an attacker gains unauthorized network access and stays undetected for a long period. To date, the goal of APTs generally has been data theft, but more extreme conse- quences, including kinetic damage, are possible. APTs target organizations in industries that handle high- value information, such as financial institutions, government agencies and contractors, and companies that have valuable 004_9781118658765-ch01.indd4_9781118658765-ch01.indd 7 77/1/13/1/13 112:452:45 PMPM 8 Advanced Threat Detection For Dummies intellectual property in such sectors as technology, pharma- ceuticals, and energy. To help illustrate the nature of an APT, I break down the com- ponents of the acronym: ✓ Advanced: Attackers use a full spectrum of computer- intrusion technologies and techniques, often exploiting unreported vulnerabilities in OSs and applications. Many of these threats are undetectable by traditional security systems. ✓ Persistent: After a network is breached, the perpetrator operates low and slow to remain undetected. Patience is key as he quietly maps the network and connects to each host (often in the middle of the night) until the ultimate target has been identified. ✓ Threat: The attacker initiates each APT with a specific objective in mind and won’t stop until he achieves that objective. He’s skilled, highly motivated, and well funded. Chapter 2 explores APTs in considerably more detail and also provides an overview of the APT threat life cycle. Zero-day threats A zero-day threat is a cyberattack on an OS or application vulnerability that’s unknown to the general public.
Load more

Recommended publications
  • The Most Common Blunder People Make When the Topic of a Computer Virus Arises Is to Refer to a Worm Or Trojan Horse As a Virus
    Trojan And Email Forging 1) Introduction To Trojan&viruses: A Trojan horse, or Trojan, in computing is a generally non-self-replicating type of malware program containing malicious code that, when executed, carries out actions determined by the nature of the Trojan, typically causing loss or theft of data, and possible system harm. The term is derived from the story of the wooden horse used to trick defenders of Troy into taking concealed warriors into their city in ancient Anatolia, because computer Trojans often employ a form of social engineering, presenting themselves as routine, useful, or interesting in order to persuade victims to install them on their computers.[1][2][3][4][5] A Trojan often acts as a backdoor, contacting a controller which can then have unauthorized access to the affected computer.[6] While Trojans and backdoors are not easily detectable by themselves, computers may appear to run slower due to heavy processor or network usage. Malicious programs are classified as Trojans if they do not attempt to inject themselves into other files (computer virus) or otherwise propagate themselves (worm).[7] A computer may host a Trojan via a malicious program a user is duped into executing (often an e-mail attachment disguised to be unsuspicious, e.g., a routine form to be filled in) or by drive-by download. The Difference Between a Computer Virus, Worm and Trojan Horse The most common blunder people make when the topic of a computer virus arises is to refer to a worm or Trojan horse as a virus. One common mistake that people make when the topic of a computer virus arises is to refer to a worm or Trojan horse as a virus.
    [Show full text]
  • Chapter 3: Viruses, Worms, and Blended Threats
    Chapter 3 Chapter 3: Viruses, Worms, and Blended Threats.........................................................................46 Evolution of Viruses and Countermeasures...................................................................................46 The Early Days of Viruses.................................................................................................47 Beyond Annoyance: The Proliferation of Destructive Viruses .........................................48 Wiping Out Hard Drives—CIH Virus ...................................................................48 Virus Programming for the Masses 1: Macro Viruses...........................................48 Virus Programming for the Masses 2: Virus Generators.......................................50 Evolving Threats, Evolving Countermeasures ..................................................................51 Detecting Viruses...................................................................................................51 Radical Evolution—Polymorphic and Metamorphic Viruses ...............................53 Detecting Complex Viruses ...................................................................................55 State of Virus Detection.........................................................................................55 Trends in Virus Evolution..................................................................................................56 Worms and Vulnerabilities ............................................................................................................57
    [Show full text]
  • Cyber-Crime, Securities Markets and Systemic Risk, Joint Staff
    Staff Working Paper: [SWP2/2013] Cyber-crime, securities markets and systemic risk 16 July, 2013 Joint Staff Working Paper of the IOSCO Research Department and World Federation of Exchanges Author: Rohini Tendulkar (IOSCO Research Department) Survey: Grégoire Naacke (World Federation of Exchanges Office) and Rohini Tendulkar This Staff Working Paper should not be reported as representing the views of IOSCO or the WFE. The views and opinions expressed in this Staff Working Paper are those of the author and do not necessarily reflect the views of the International Organisation of Securities Commissions or the World Federation of Exchanges, or its members. For further information please contact: [email protected] IOSCO Staff Working Paper July 2013 Contents About this Document ................................................................................................................ 2 Executive Summary ................................................................................................................... 3 Introduction .............................................................................................................................. 6 Understanding the Cyber-Crime Risk ...................................................................................... 11 Systemic risk scenarios ........................................................................................................ 22 A Focus on The World’s Exchanges ......................................................................................... 23
    [Show full text]
  • TROJANS, WORMS, and SPYWARE This Page Intentionally Left Blank
    TROJANS, WORMS, AND SPYWARE This page intentionally left blank TROJANS, WORMS, AND SPYWARE A Computer Security Professional’s Guide to Malicious Code Michael Erbschloe AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Elsevier Butterworth–Heinemann 200 Wheeler Road, Burlington, MA 01803, USA Linacre House, Jordan Hill, Oxford OX2 8DP, UK Copyright © 2005, Elsevier Inc. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Permissions may be sought directly from Elsevier’s Science & Technology Rights Department in Oxford, UK: phone: (+44) 1865 843830, fax: (+44) 1865 853333, e-mail: [email protected]. You may also complete your request on-line via the Elsevier homepage (http://elsevier.com), by selecting “Customer Support” and then “Obtaining Permissions.” Recognizing the importance of preserving what has been written, Elsevier prints its books on acid-free paper whenever possible. Library of Congress Cataloging-in-Publication Data Application submitted. British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. ISBN: 0-7506-7848-8 For information on all Butterworth–Heinemann publications visit our website at http://books.elsevier.com/security 03 04 05 06 07 08 09 10 9 8 7 6 5 4 3 2 1 Printed
    [Show full text]
  • Meeting the Cyber Security Challenge
    Research Series 01.2012 - Newidea 7 - 2012 GCSP avenue de la Paix 7bis Meeting the P. O. Box 1295 CH - 1211 Geneva 1 T + 41 22 906 16 00 Cyber Security Challenge F + 41 22 906 16 49 [email protected] www.gcsp.ch Gustav Lindstrom Impartial, Inclusive, Influential The opinions and views expressed in this document do not necessarily reflect the position of the Swiss authorities or the Geneva Centre for Security Policy. Copyright © Geneva Centre for Security Policy, 2012 Meeting the Cyber Security Challenge Gustav Lindstrom GCSP Geneva Papers — Research Series n° 7, June 2012 The Geneva Centre for Security Policy The Geneva Centre for Security Policy (GCSP) is an international training centre for security policy based in Geneva. An international foundation with over forty member states, it offers courses for civil servants, diplomats and military officers from all over the world. Through research, workshops and conferences it pro- vides an internationally recognized forum for dialogue on timely issues relating to security and peace. The Geneva Papers and l’Esprit de Genève With its vocation for peace, Geneva is the city where international organizations, NGOs, and the academic community, working together, have the possibility of creating the essential conditions for debate and concrete action. The Geneva Pa- pers intend to serve the same goal by promoting a platform for constructive and substantive dialogue. Geneva Papers – Research Series The Geneva Papers – Research Series is a new set of publications offered by the GCSP. It complements the Geneva Papers – Conference Series that was launched in 2008, whose purpose is to reflect on the main issues and debates of an event organized by the GCSP.
    [Show full text]
  • The Roles and Responsibilities for Defending the Nation from Cyber Attack
    S. HRG. 115–597 THE ROLES AND RESPONSIBILITIES FOR DEFENDING THE NATION FROM CYBER ATTACK HEARING BEFORE THE COMMITTEE ON ARMED SERVICES UNITED STATES SENATE ONE HUNDRED FIFTEENTH CONGRESS FIRST SESSION OCTOBER 19, 2017 Printed for the use of the Committee on Armed Services ( Available via the World Wide Web: http://www.govinfo.gov/ U.S. GOVERNMENT PUBLISHING OFFICE 36–192 PDF WASHINGTON : 2019 VerDate Nov 24 2008 11:07 May 02, 2019 Jkt 000000 PO 00000 Frm 00001 Fmt 5011 Sfmt 5011 Y:\REIER-AVILES\2017\2017 HEARINGS TO BE PRINTED\36192.TXT WILDA COMMITTEE ON ARMED SERVICES JOHN MCCAIN, Arizona, Chairman JAMES M. INHOFE, Oklahoma JACK REED, Rhode Island ROGER F. WICKER, Mississippi BILL NELSON, Florida DEB FISCHER, Nebraska CLAIRE MCCASKILL, Missouri TOM COTTON, Arkansas JEANNE SHAHEEN, New Hampshire MIKE ROUNDS, South Dakota KIRSTEN E. GILLIBRAND, New York JONI ERNST, Iowa RICHARD BLUMENTHAL, Connecticut THOM TILLIS, North Carolina JOE DONNELLY, Indiana DAN SULLIVAN, Alaska MAZIE K. HIRONO, Hawaii DAVID PERDUE, Georgia TIM KAINE, Virginia TED CRUZ, Texas ANGUS S. KING, JR., Maine LINDSEY GRAHAM, South Carolina MARTIN HEINRICH, New Mexico BEN SASSE, Nebraska ELIZABETH WARREN, Massachusetts LUTHER STRANGE, Alabama GARY C. PETERS, Michigan CHRISTIAN D. BROSE, Staff Director ELIZABETH L. KING, Minority Staff Director (II) VerDate Nov 24 2008 11:07 May 02, 2019 Jkt 000000 PO 00000 Frm 00002 Fmt 8486 Sfmt 8486 Y:\REIER-AVILES\2017\2017 HEARINGS TO BE PRINTED\36192.TXT WILDA C O N T E N T S OCTOBER 19, 2017 Page THE ROLES AND RESPONSIBILITIES FOR DEFENDING THE NATION FROM CYBER ATTACK .................................................................................................................
    [Show full text]
  • An Intelligence Based Model for the Prevention of Advanced Cyber-Attacks
    An Intelligence based Model for the Prevention of Advanced Cyber-Attacks Olawale Surajudeen Adebayo Associate Professor (Dr.) Normaziah Bintin 1 AbdulAzeez Computer Science Department, International Islamic Computer Science Department, International Islamic University Malaysia, 2CSS Department, Federal University University Malaysia of Technology Minna, Nigeria [email protected] [email protected], [email protected], [email protected] Abstract — The trend and motive of Cyber-attacks have gone Nimda, Conficker, Code Red etc.), and APTs (Advanced beyond traditional damages, challenges to information stealing Persistent Threat which is a sophisticated cyber-attack that for political and economic gain. With the recent APT (Advance employs advanced stealth techniques to remain undetected Persistent Threat), Zero-day malware, and Blended threat, the over times) [17]. The important cyber-attacks considered in task of protecting vita infrastructures are increasingly becoming this research are Malware and APTs (Andvanced Persistent difficult. This paper presents an intelligence based technique that combined the traditional signature based detection with the next Threats). generation based detection. The proposed model consists of virtual execution environment, detection, and prevention module. Next Generation Security is a security that is meant to deal The virtual execution environment is designated to analyze and with the recent next generation threats and cyber-attacks. New execute a suspected file contains malware while other module Generation Security is a defence strategy that capable of not inspect, detect, and prevent malware execution based on the only scanning and detecting but also preventing the feature intelligent gathering in the central management system (CMS). escalation of occurrence of next generation threats like zero- The model based on Next Generation Malware Detection of day malware, polymorphic and blended malware.
    [Show full text]
  • Cyber-Security Threat Characterisation a Rapid Comparative Analysis
    CHILDREN AND FAMILIES The RAND Corporation is a nonprofit institution that helps improve policy and EDUCATION AND THE ARTS decisionmaking through research and analysis. ENERGY AND ENVIRONMENT HEALTH AND HEALTH CARE This electronic document was made available from www.rand.org as a public INFRASTRUCTURE AND service of the RAND Corporation. TRANSPORTATION INTERNATIONAL AFFAIRS LAW AND BUSINESS NATIONAL SECURITY Skip all front matter: Jump to Page 16 POPULATION AND AGING PUBLIC SAFETY SCIENCE AND TECHNOLOGY Support RAND TERRORISM AND Browse Reports & Bookstore HOMELAND SECURITY Make a charitable contribution For More Information Visit RAND at www.rand.org Explore RAND Europe View document details Limited Electronic Distribution Rights This document and trademark(s) contained herein are protected by law as indicated in a notice appearing later in this work. This electronic representation of RAND intellectual property is provided for non-commercial use only. Unauthorized posting of RAND electronic documents to a non-RAND Web site is prohibited. RAND electronic documents are protected under copyright law. Permission is required from RAND to reproduce, or reuse in another form, any of our research documents for commercial use. For information on reprint and linking permissions, please see RAND Permissions. This report is part of the RAND Corporation research report series. RAND reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND reports undergo rigorous peer review to ensure high standards for research quality and objectivity. EUROPE Cyber-security threat characterisation A rapid comparative analysis Neil Robinson, Luke Gribbon, Veronika Horvath, Kate Robertson Prepared for the Center for Asymmetric Threat Studies (CATS), Swedish National Defence College, Stockholm The research described in this document was prepared for the Center for Asymmetric Threat Studies (CATS), Swedish National Defence College, Stockholm.
    [Show full text]
  • Design, Analysis, and Evaluation
    An Anomaly Behavior Analysis Methodology for the Internet of Things: Design, Analysis, and Evaluation Item Type text; Electronic Dissertation Authors Pacheco Ramirez, Jesus Horacio Publisher The University of Arizona. Rights Copyright © is held by the author. Digital access to this material is made possible by the University Libraries, University of Arizona. Further transmission, reproduction or presentation (such as public display or performance) of protected items is prohibited except with permission of the author. Download date 02/10/2021 07:40:12 Link to Item http://hdl.handle.net/10150/625581 1 AN ANOMALY BEHAVIOR ANALYSIS METHODOLOGY FOR THE INTERNET OF THINGS: DESIGN, ANALYSIS, AND EVALUATION By Jesus Horacio Pacheco Ramirez Copyright Jesus Horacio Pacheco Ramirez 2017 A Dissertation Submitted to the Faculty of the DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING In Partial Fulfillment of the Requirements For the Degree of DOCTOR OF PHILOSOPHY In the Graduate College THE UNIVERSITY OF ARIZONA 2017 2 THE UNIVERSITY OF ARIZONA GRADUATE COLLEGE As members of the Dissertation Committee, we certify that we have read the dissertation prepared by Jesus Horacio Pacheco Ramirez entitled “An Anomaly Behavior Analysis Methodology for the Internet of Things: Design, Analysis, and Evaluation” and recommend that it be accepted as fulfilling the dissertation requirement for the Degree of Doctor of Philosophy _______________________________________________________Date: June 08, 2017 Dr. Salim Hariri _______________________________________________________Date: June 08, 2017 Dr. Ali Akoglu _______________________________________________________Date: June 08, 2017 Dr. Gregory Ditzler Final approval and acceptance of this dissertation is contingent upon the candidate's submission of the final copies of the dissertation to the Graduate College. I hereby certify that I have read this dissertation prepared under my direction and recommend that it be accepted as fulfilling the dissertation requirement.
    [Show full text]
  • Security Policies and Procedures.Pdf
    ptg16525539 Security Program and Policies: Principles and Practices Second Edition ptg16525539 Sari Stern Greene 800 East 96th Street, Indianapolis, Indiana 46240 USA Security Program and Policies: Principles and Practices, Editor-in-Chief Second Edition Dave Dusthimer Sari Stern Greene Acquisitions Editor Betsy Brown Copyright ® 2014 by Pearson Education, Inc. Development Editor All rights reserved. No part of this book shall be reproduced, stored in a retrieval system, or Box Twelve, Inc. transmitted by any means, electronic, mechanical, photocopying, recording, or otherwise, without written permission from the publisher. No patent liability is assumed with respect to the use of the information contained herein. Although every precaution has been taken in Managing Editor the preparation of this book, the publisher and author assume no responsibility for errors or Sandra Schroeder omissions. Nor is any liability assumed for damages resulting from the use of the information contained herein. Project Editor Seth Kerney ISBN-13: 978-0-7897-5167-6 ISBN-10: 0-7897-5167-4 Copy Editor Bart Reed Library of Congress Control Number: 2014932766 Indexer Printed in the United States of America Heather McNeill Second Printing: July 2015 Proofreader Anne Goebel ptg16525539 Trademarks Technical Editors All terms mentioned in this book that are known to be trademarks or service marks have Ronald Gonzales been appropriately capitalized. Pearson IT Certification cannot attest to the accuracy of this Tatyana Zidarov information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark. Publishing Coordinator Vanessa Evans Warning and Disclaimer Interior Designer Every effort has been made to make this book as complete and as accurate as possible, but Gary Adair no warranty or fitness is implied.
    [Show full text]
  • CA Threat Portfolio Technology Brief
    TECHNOLOGY BRIEF: CA THREAT MANAGEMENT SOLUTIONS The CA Threat Management Solutions Table of Contents Executive Summary SECTION 1: CHALLENGE 2 The Security Threat Landscape Security Threats Productivity Threats SECTION 2: OPPORTUNITY 4 Types of Malicious Software Viral Threats Spyware and Other Non-Viral Threats Blended Threats SECTION 3: BENEFITS 8 An Effective Threat Strategy Yields Multi-Fold Benefits Business Benefits of the CA Threat Management Solutions SECTION 4: CONCLUSIONS 12 SECTION 5: REFERENCES 12 ABOUT CA Back Cover Copyright © 2007 CA. All rights reserved. All trademarks, trade names, service marks and logos referenced herein belong to their respective companies. This document is for your informational purposes only. To the extent permitted by applicable law, CA provides this document “As Is” without warranty of any kind, including, without limitation, any implied warranties of merchantability or fitness for a particular purpose, or non-infringement. In no event will CA be liable for any loss or damage, direct or indirect, from the use of this document including, without limitation, lost profits, business interruption, goodwill or lost data, even if CA is expressly advised of such damages. Executive Summary Challenge Businesses are critically dependent upon their IT systems and failure to counter threats to IT systems can not only result in damage to network, systems and data, but can also affect the reputation of your business. Threats to computer systems affect both system security and productivity. Viruses and spyware are the main threats to business IT systems, but blended threats, where different types of malicious software are used in combination, are now very common.
    [Show full text]
  • Definitive Guide to Next-Generation Threat Protection
    Definitive GuideTM to Next-Generation Threat Protection Winning the War Against the New Breed of Cyber Attacks Steve Piper, CISSP Compliments of: FOREWORD BY: David DeWalt About FireEye FireEye is the leader in stopping today’s new breed of cyber attacks, such as zero-day and APT attacks, that bypass traditional defenses and compromise over 95% of networks. The FireEye platform supplements signature-based firewalls, IPS, anti-virus, and gateways, and provides the world’s only cross-enterprise, signature-less protection against Web and email threat vectors as well as malware resident on file shares. It is the industry’s only integrated platform that stops attacks across every stage of an attack life cycle, from exploit to exfiltration. Using its patented Virtual Execution technology engine across its platform, FireEye is uniquely able to protect against today’s new breed of cyber attacks. FireEye solutions are deployed in over 40 countries and more than 25% of the Fortune 100. • Ranked #4 on the Deloitte 2012 Technology Fast 500™ North America • Awarded the Wall Street Journal 2012 Technology Innovation Award • Inducted into JPMorgan Chase Hall of Innovation Definitive GuideTM to Next-Generation Threat Protection Winning the War Against the New Breed of Cyber Attacks Steve Piper, CISSP Foreword by David DeWalt Definitive Guide™ to Next-Generation Threat Protection Published by: CyberEdge Group, LLC 1997 Annapolis Exchange Parkway Suite 300 Annapolis, MD 21401 (800) 327-8711 www.cyber-edge.com Copyright © 2013, CyberEdge Group, LLC. All rights reserved. Definitive Guide™ and the CyberEdge Press logo are trademarks of CyberEdge Group, LLC in the United States and other countries.
    [Show full text]