Support Center

Security Solution

 

Antivirus software

Antivirus, anti-virus, or AV software is computer software used to prevent, detect and remove malicious computer viruses. Most software described as antivirus also works against other types of malware, such as malicious Browser Helper Objects(BHOs), browser hijackers, ransomware, keyloggers, backdoors, rootkits, trojan horses, worms, malicious LSPs, dialers,fraudtools, adware and spyware. Computer security, including protection from social engineering techniques, is commonly offered in products and services of antivirus software companies. This page discusses the software used for the prevention, detection, and removal of malware threats, rather than computer security implemented by software methods.

A variety of strategies are typically employed. Signature-based detection involves searching for known patterns of data withinexecutable code. However, it is possible for a computer to be infected with new malware for which no signature is yet known; and malware is often modified to change its signature without affecting functionality. To counter such so-called zero-day threats, heuristics can be used. One type of heuristic approach, generic signatures, can identify variants by looking for slight variations of known malicious code in files. Some antivirus software can also predict what a file will do by running it in asandbox and analyzing what it does to see if it performs any actions which could be malicious.

Antivirus software has some drawbacks. It can impair a computer's performance. Inexperienced users can be lulled into a false sense of security when using the computer, considering themselves to be totally protected, and may have problems understanding the prompts and decisions that antivirus software presents them with. An incorrect decision may lead to a security breach. If the antivirus software employs heuristic detection, it must be fine-tuned to minimize misidentifying harmless software as malicious (false positive). Antivirus software itself usually runs at the highly trusted kernel level of the operating system to allow it access to all the potential malicious process and files, creating a potential avenue of attack

 

Identification method

One of the few solid theoretical results in the study of computer viruses is Frederick B. Cohen's 1987 demonstration that there is no algorithm that can perfectly detect all possible viruses. 

There are several methods which antivirus software can use to identify malware:

• Signature based detection is the most common method. To identify viruses and other malware, antivirus software compares the contents of a file to a dictionary of virus signatures. Because viruses can embed themselves in existing files, the entire file is searched, not just as a whole, but also in pieces. 

• Heuristic-based detection like malicious activity detection, can be used to identify unknown viruses.

• File emulation is another heuristic approach. File emulation involves executing a program in a virtual environment and logging what actions the program performs. Depending on the actions logged, the antivirus software can determine if the program is malicious or not and then carry out the appropriate disinfection actions.

Signature-based detection

Traditionally, antivirus software heavily relied upon signatures to identify malware. This can be very effective, but cannot defend against malware unless samples have already been obtained and signatures created. Because of this, signature-based approaches are not effective against new, unknown viruses.

As new viruses are being created each day, the signature-based detection approach requires frequent updates of the virus signature dictionary. To assist the antivirus software companies, the software may allow the user to upload new viruses or variants to the company, allowing the virus to be analyzed and the signature added to the dictionary. 

Although the signature-based approach can effectively contain virus outbreaks, virus authors have tried to stay a step ahead of such software by writing "oligomorphic", "polymorphic" and, more recently, "metamorphic" viruses, which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match virus signatures in the dictionary. 

Heuristics

Some more sophisticated antivirus software uses heuristic analysis to identify new malware or variants of known malware.

Many viruses start as a single infection and through either mutation or refinements by other attackers, can grow into dozens of slightly different strains, called variants. Generic detection refers to the detection and removal of multiple threats using a single virus definition. For example, the Vundo trojan has several family members, depending on the antivirus vendor's classification. Symantec classifies members of the Vundo family into two distinct categories, Trojan.Vundo and Trojan.Vundo.B. 

While it may be advantageous to identify a specific virus, it can be quicker to detect a virus family through a generic signature or through an inexact match to an existing signature. Virus researchers find common areas that all viruses in a family share uniquely and can thus create a single generic signature. These signatures often contain non-contiguous code, using wildcard characters where differences lie. These wildcards allow the scanner to detect viruses even if they are padded with extra, meaningless code. A detection that uses this method is said to be "heuristic detection."

Rootkit detection

Main article: Rootkit

Anti-virus software can attempt to scan for rootkits; a rootkit is a type of malware that is designed to gain administrative-level control over a computer system without being detected. Rootkits can change how the operating system functions and in some cases can tamper with the anti-virus program and render it ineffective. Rootkits are also difficult to remove, in some cases requiring a complete re-installation of the operating system. 

Real-time protection

Real-time protection, on-access scanning, background guard, resident shield, autoprotect, and other synonyms refer to the automatic protection provided by most antivirus, anti-spyware, and other anti-malware programs. This monitors computer systems for suspicious activity such as computer viruses, spyware, adware, and other malicious objects in 'real-time', in other words while data loaded into the computer's active memory: when inserting a CD, opening an email, or browsing the web, or when a file already on the computer is opened or executed

 

DLP

 

Data loss prevention (DLP) is a strategy for making sure that end users do not send sensitive or critical information outside of the corporate network. The term is also used to describe software products that help a network administrator control what data end users can transfer.

Adoption of DLP, variously called data leak prevention, information loss prevention or extrusion prevention, is being driven by insider threats and by more rigorous state privacy laws, many of which have stringent data protection or access components.

DLP software products use business rules to examine file content and tag confidential and critical information so that users cannot disclose it. The software can be useful for identifying and tagging well-defined content (such as Social Security or credit cards numbers) but tends to fall short when an administrator is trying to identify other sensitive data such as intellectual property. To implement enterprise DLP software successfully, personnel from all levels of management need to be actively involved in creating the business rules for tags.

Once DLP software tools have been deployed, an end user who accidentally or maliciously attempts to disclose confidential information that's been tagged will be denied. In addition to being able to monitor and control endpoint activities, DLP tools can also be used to filter data streams on the corporate network and protect data at rest.

 

 

 

Unified threat management

Unified threat management (UTM) is a solution in the network security industry, and since 2004 it has gained currency as a primary network gateway defense solution for organizations. In theory, UTM is the evolution of the traditional firewall into an all-inclusive security product able to perform multiple security functions within one single appliance: network firewalling, network intrusion prevention and gateway antivirus (AV), gateway anti-spam, VPN, content filtering, load balancing, data leak prevention and on-appliance reporting.

The worldwide UTM market was approximately worth $1.2 billion in 2007, with a forecast of 35-40% compounded annual growth rate through 2011. The primary market of UTM providers is the SMB and enterprise segments, although a few providers are now providing UTM solutions for small offices/remote offices. The term UTM was originally coined by market research firm IDC. The advantages of unified security lie in the fact that rather than administering multiple systems that individually handle antivirus, content filtering, intrusion prevention and spam filtering functions, organizations now have the flexibility to deploy a single UTM appliance that takes over all their functionality into a single rack mountable network appliance.

History

UTM solutions emerged of the need to stem the increasing number of attacks on corporate information systems via hacking/cracking, viruses, worms - mostly an outcome of blended threats and insider threats. Also, newer attack techniques target the user as the weakest link in an enterprise, the repercussions of which are far more serious than imagined.

Data security and unauthorized employee access have become major business concerns for enterprises today. This is because malicious intent and the resultant loss of confidential data can lead to huge financial losses as well as corresponding legal liabilities. It needs to be mentioned that enterprises have only now begun to recognize the fact that user ignorance can lead to security being compromised out of their internal networks. 

The main advantages of UTM solutions are simplicity, streamlined installation and use, and the ability to update all the security functions concurrently. 

The goal of a UTM is to provide a comprehensive set of security features in a single product managed through a single console. Integrated security solutions evolved as a logical way to tackle the increasingly complex blended internet threats impacting organizations.

The UTM market has shown notable growth recently with a 20.1% increase in 2009 following up a 32.2% increase in 2008, according to Frost and Sullivan.

Transition from point to integrated security solutions

Traditional point solutions, which were installed to solve major threat and productivity issues, are difficult to deploy, manage and update, which increases operational complexities and overhead costs. Instead, organizations of today demand an integrated approach to network security and productivity that combines the management of traditionally disparate point technologies.

All these disadvantages can lead to situations where organizations deploy reduced security and inferior policies at remote locations. UTM's can help overcome these problems.

How UTM secures the network

A single UTM appliance simplifies management of a company's security strategy, with just one device taking the place of multiple layers of hardware and software. Also from one single centralized console, all the security solutions can be monitored and configured.

In this context, UTMs represent all-in-one security appliances that carry a variety of security capabilities including firewall, VPN, gateway anti-virus, gateway anti-spam, intrusion prevention, content filtering, bandwidth management, application control and centralized reporting as basic features. The UTM has a customized OS holding all the security features at one place, which can lead to better integration and throughput than a collection of disparate devices.

For enterprises with remote networks or distantly located offices, UTMs are a means to provide centralized security with control over their globally distributed networks.

Key advantages

1. Reduced complexity: Single security solution. Single Vendor. Single AMC

2. Simplicity: Avoidance of multiple software installation and maintenance

3. Easy Management: Plug & Play Architecture, Web-based GUI for easy management

4. Reduced technical training requirements, one product to learn.

5. Regulatory compliance

Key Disadvantages

1. Single point of failure for network traffic, unless HA is used

2. Single point of compromise if the UTM has vulnerabilities

3. Potential impact on latency and bandwidth when the UTM cannot keep up with the traffic

Role of user identity

Identity-based UTM appliances are the security solutions offering comprehensive protection against blended threats. While simple UTMs identify only IP addresses in the network, identity-based UTMs provide discrete identity information of each user in the network along with network log data. They allow creation of identity-based network access policies for individual users, delivering visibility and control on the network activities. The identity-based feature of such UTMs runs across the entire feature set, enabling enterprises to identify patterns of behavior by specific users or groups that can signify misuse, unauthorized intrusions, or malicious attacks from inside or outside the enterprise. 

The strength of UTM technology is that it is designed to offer comprehensive security while being easy to manage. Enterprises get complete network information in hand to take proactive action against network threats in case of inappropriate or suspicious user behavior in the network. As identity-based UTMs do not depend on IP addresses, they provide comprehensive protection even in dynamic IP environments such as DHCP and WI-Fi and especially in a scenario where multiple users share the same computer.[3]

Regulatory compliance

One feature of UTM appliances is that they provide security technology that can handle the increasingly regulatory environment across the world. Regulatory compliances like HIPAA, GLBA, PCI-DSS, FISMA, CIPA, SOX, NERC, FFIEC require access controls and auditing that meet control data leakage. UTMs that provide identity-based security give visibility into user activity while enabling policy creation based on the user identity, meeting the requirements of regulatory compliances.

Identity-based UTMs deliver identity-based reports on individual users in the network. This offers short audit and reporting cycles and facilitate the meeting of regulatory compliance requirements in enterprises.