News

02:47 PM
Connect Directly
RSS
E-Mail
50%
50%

In-House Malware Analysis: Why, How To Do It

In-depth malware analysis can be part of a comprehensive vulnerability management strategy. Here's how to get started.

Vulnerability management translates into reduced risk, not invulnerability. Your antivirus and intrusion detection/prevention systems can't detect and stop every piece of malware. Even as our security programs mature and our security tools become more sophisticated, attackers have gotten too good at getting into our networks.

A layered defense-in-depth requires enterprises to augment their vulnerability management, malware prevention, and intrusion detection programs with malware analysis. The goal: to identify and assess threats on the corporate network and respond quickly to contain and mitigate the impact and remediate the damage.

Enterprises surely can reduce risk through a program that follows a regular vulnerability management cycle of prioritized, risk-based patching, patch validation, configuration management, and monitoring for systems that may be missed or fall out of compliance. But more than 4,500 vulnerabilities were identified in 2010, and systems remain vulnerable despite diligent efforts. There are numerous good reasons for this, many of them related to the practical problems surrounding patch management.

While most companies have a vulnerability management program in place, there's a strong case to be made for an in-house malware analysis initiative as well. The two programs are complementary: Malware analysis combined with vulnerability management helps enterprises evaluate which systems are vulnerable, the scope of the threat, and how to determine where it has or will spread, so you can respond quickly to contain it.

"Malware analysis is a useful skill for incident response," says Jim Clausing, technical consultant, network security at AT&T and an incident handler at the SANS Internet Storm Center. "It's not necessarily my job to figure out everything malware does. I need to understand enough of it so I can help defend the enterprise."

That means enterprises don't necessarily have to dive deep into reverse engineering of malware found on their networks and develop their own signatures to protect against further incursions. The kind of detailed static malware analysis performed by security vendors and labs is time-consuming and expensive, even if you have the right expertise in house. Some companies contract with third parties, but that too is expensive and usually reserved for only the most urgent events.

Read the rest of this article on Dark Reading.

Comment  | 
Print  | 
More Insights
Cartoon
Slideshows
Audio Interviews
Archived Audio Interviews
Jeremy Schulman, founder of Schprockits, a network automation startup operating in stealth mode, joins us to explore whether networking professionals all need to learn programming in order to remain employed.
White Papers
Register for Network Computing Newsletters
Current Issue
2014 State of Unified Communications
2014 State of Unified Communications
If you thought consumerization killed UC, think again: 70% of our 488 respondents have or plan to put systems in place. Of those, 34% will roll UC out to 76% or more of their user base. And there’s some good news for UCaaS providers.
Video
Twitter Feed