In-House Malware Analysis: Why, How To Do It

Vulnerability management translates into reduced risk, not invulnerability. Your antivirus and intrusion detection/prevention systems can't detect and stop every piece of malware. Even as our security programs mature and our security tools become more sophisticated, attackers have gotten too good at getting into our networks.

A layered defense-in-depth requires enterprises to augment their vulnerability management, malware prevention, and intrusion detection programs with malware analysis. The goal: to identify and assess threats on the corporate network and respond quickly to contain and mitigate the impact and remediate the damage.

Enterprises surely can reduce risk through a program that follows a regular vulnerability management cycle of prioritized, risk-based patching, patch validation, configuration management, and monitoring for systems that may be missed or fall out of compliance. But more than 4,500 vulnerabilities were identified in 2010, and systems remain vulnerable despite diligent efforts. There are numerous good reasons for this, many of them related to the practical problems surrounding patch management.

While most companies have a vulnerability management program in place, there's a strong case to be made for an in-house malware analysis initiative as well. The two programs are complementary: Malware analysis combined with vulnerability management helps enterprises evaluate which systems are vulnerable, the scope of the threat, and how to determine where it has or will spread, so you can respond quickly to contain it.

"Malware analysis is a useful skill for incident response," says Jim Clausing, technical consultant, network security at AT&T and an incident handler at the SANS Internet Storm Center. "It's not necessarily my job to figure out everything malware does. I need to understand enough of it so I can help defend the enterprise."

That means enterprises don't necessarily have to dive deep into reverse engineering of malware found on their networks and develop their own signatures to protect against further incursions. The kind of detailed static malware analysis performed by security vendors and labs is time-consuming and expensive, even if you have the right expertise in house. Some companies contract with third parties, but that too is expensive and usually reserved for only the most urgent events.

Read the rest of this article on Dark Reading.