Going Beyond Layered Security to Respond Rapidly to Advanced Cyber Threats

IT organizations have never been as well equipped to deal with sophisticated security threats as they are today. But at the same time, IT organizations have never been at greater risk.

Despite putting in place policies, controls, technologies and so on, cyber adversaries have never been in a greater position of strength. According to DLT partner, ForeScout, attackers are increasingly coordinated and have a wealth of resources to draw from, including hacking communities, organized crime, and nation states.

Advanced Persistent Threats Pose a Big Risk

Some of the biggest threats today have over-matched traditional security technologies. These “advanced persistent threats” (APTs) include zero-day threats, propagating worms, and low-and-slow attacks, each of which defy most detection mechanisms and keep CISOs increasingly on their toes.

The most popular and successful of these APTs for the cybercriminal is the zero-day attack says ForeScout in its “CISO Guide: Advanced Threat Prevention”. A zero-day vulnerability refers to a hole in software, known to the vendor, that can be exploited by hackers before the vendor becomes aware and fixes it. Recent examples include Adobe software and the Java platform. Once uncovered, these vulnerabilities can be used for sabotage or cyber espionage. In fact, governments are the primary buyers in the zero-day exploits underground market.

There are no patches for zero-day vulnerabilities and no signatures to zero-day attacks. “Given that there is often a considerable delay between the attack and methods to identify the new attack, neither the attacks nor the resulting exploits can be addressed in a timely manner using conventional security methods,” says ForeScout.

Layered Security Approach Was the Best Option

It’s a problem that has left network and systems managers with little option but to deploy layered defense strategies in the hope of thwarting the individuals behind these attacks. These include firewalls, antivirus, white-listing, email security, web security gateways, SIEM, deep packet inspection and analysis, network intrusion prevention and access control, and so on.

Each layer has a role to play in protection the IT environment, albeit with pros and cons. For example, most advanced threat protection systems simply identify the presence of an advanced threat, issuing an alert that can easily be ignored by a busy IT security manager – a mistake that can cost millions of dollars.

Rather than chase the latest threats and develop new signatures to address, ForeScout has come up with an alternative approach. Through ForeScout ActiveResponse™, IT can now detect and prevent the propagation of malware or hackers inside the network.  ActiveResponse does not rely on signatures to detect zero-day threats. Strictly speaking, ForeScout ActiveResponse analyzes network behavior, but it is quite unlike other behavior-based approaches in that it does not produce false positives, nor does it require any tuning period or maintenance.

When deployed in an IT environment, here are just a few of benefits that ActiveResponse delivers:

  • Preempt and block zero-day attacks. ActiveResponse was able to detect and block attacks such as Zeus, Stuxnet and FLAME before any company had developed a signature for these attacks.
  • Stop low-and-slow attacks. Unlike traditional IPS systems, which have a time-out period built into their attack signatures, ActiveResponse has no time-out period allowing it to be effective against the low-and-slow attacker who conducts malicious activity over long periods of time – without immediate detection..
  • Reduce APT risks. ActiveResponse reduces the risk of APTs in two ways. First, it blocks APTs, like Stuxnet, that attempt to spread over the network. Second, it can thwart the ability of APTs, like Operation Aurora to detect and steal information over the network or use each infected machine as a launching point for subsequent theft of data over the network.

It’s no Honeypot

Unlike traditional honeypots, ForeScout ActiveResponse, doesn’t “play” with the attacker in order to learn the nature of the attack, but continues replying until the malicious intent is proven and then blocks the attacker. Honeypots are labor intensive too. They require setting up and maintaining an environment that can be used to analyze attack patterns and objectives. As such, it is materially more labor intensive and requires significant operator expertise. In contrast, ActiveResponse technology is easily configured, requiring almost no administration and nominal expertise — they are “set and forget”

Check out the white paper CISO Guide: Advanced Threat Prevention to learn more about the APT threat, why traditional technologies fall short, and where ForeScout can help agencies respond more rapidly.