Security Connected Framework

Recently Dmitri Alperovitch, McAfee’s VP of Threat Research, published a blog about Operation Shady RAT. In the blog and corresponding mcafee.com/activate product key whitepaper www.mcafee.com/activate download he details an investigation of targeted intrusions www.mcafee.com/activate into over 70 global companies www.mcafee/activate, governments, and non-profit organizations over the last five years that appear to be sourced from a single actor or group. The targeted attacks used a combination of known attack components such as remote access tools or RATS and spearphishing.

Since the release of this information, there have been www.mcafee/activate questions regarding mitigation techniques for these types of attacks; we’ll look at some now.

It’s important to note that there is no single product that can be plugged in that will stop spearphishing, protect sensitive data, thwart malware mcafee.com/activate product key, put an end to malicious insiders, etc. Instead there are mcafee.com/activate product key several solutions across endpoint www.mcafee/activate, network, data security as well as security management that can and should be used in a connected framework to enrich each www.mcafee.com/activate other and thus mitigate risk, increase ROI, and create greater efficiencies regarding incident detection, prevention www.mcafee.com/activate download, and response. Let’s take a look at some of these controls.

Endpoint Controls

Endpoint controls are likely www.mcafee.com/activate the most intuitive solutions for addressing malware, and while they are well known in general, they warrant readdressing here www.mcafee/activate. Endpoint security suites can use a combination of techniques such as blacklisting and dynamic whitelisting www.mcafee.com/activate download to prevent known  www.mcafee.com/activate and unknown malware and even prohibit its installation.

Whitelisting is particularly mcafee.com/activate product key useful against unknown threats because it can prohibit the installation of any unauthorized www.mcafee.com/activate software. Simply put, what isn’t explicitly allowed will be denied. It can also help detect and prevent inadvertent downloads of malicious programs. Many endpoint controls are able to look at the network www.mcafee/activate activity traversing the TCP/IP stack as well as the system internals www.mcafee.com/activate download, and correlate that information in order to determine if there is nefarious system activity and or network activity emblematic www.mcafee.com/activate of command and control.

Why is this important when addressing Shady RAT? The endpoint is ground zero. Regardless of the attack vector www.mcafee.com/activate download, the victim, or the data that was to be stolen, the first goal of Shady RAT was the compromise of an endpoint www.mcafee.com/activate. Once one endpoint was compromised it could be used to compromise other endpoints across the network www.mcafee/activate. By applying controls at the endpoint not only is the exploitation of vulnerabilities and installation of malware at the mcafee.com/activate product key endpoint stopped, but also the level of penetration in terms of number of systems compromised can be reduced.

Network Controls

There are several algorithms specific to targeted attacks, sometimes called APTs that can be leveraged in both mcafee.com/activate product key firewall and IPS solutions.  These algorithms are designed to detect signs of attacks based on inbound and outbound activity www.mcafee/activate. Additionally, to address www.mcafee.com/activate download common breaches that occur through email and web, specialized anti-malware engines utilizing proactive scanning can www.mcafee.com/activate block obfuscated code that is common in most sophisticated malware as it passes through email and web conduits.

Network controls can also www.mcafee.com/activate download be utilized to not only detect malicious behavior such as RAT activity, but also de-obfuscate evasive traffic www.mcafee.com/activate that is seen in command and control channels for analysis. When these solutions are enriched with threat intelligence information, discussed later in this blog, they can even become aware of threats www.mcafee/activate before they touch their network and therefore employ filtering, redirection, etc. to not only mitigate the security risks mcafee.com/activate product key, but even have a positive impact on network and system performance because these assets are busy processing malicious bits.