Fileless network protection is a key element to device security and an important part of a layered security strategy. The days of protecting yourself from bad actors using a single AntiVirus (AV) solution are behind us. Attackers can easily avoid detection from signature based software. We discuss just a few of the techniques commonly employed by cyber criminals and explain how these can be prevented with a layered approach to security and fileless based protection.
Signature Based Detection
Traditional AV security products rely on signatures to detect and remove threats. This fingerprinting technology looks at every file on your device and generates a unique identification number, or signature. This signature is then compared to a database of known bad actors. When a match is found the offending file is removed.
These products scan your filesystem and current processes looking for bad signatures. However, it is important to understand the limitations of this technique in terms of device and data protection.
Firstly, the bad actor needs to be identified. Just like in the real world, after a break-in, the police have to arrive at the scene, investigate and take fingerprints and then compare them to a list of known criminals. This is no different in the digital world. It takes teams of people to identify, analyze and classify the problem.
Secondly, after it has been verified it can be added to a database and made available to clients. This takes time. Typically, the best case scenario is around 4 hours. It is usually significantly longer, sometimes 24 hours or more.
The problem is that most cyber attacks do most damage within the first few hours, spreading across the globe rapidly. Recent examples include WannaCry and Petya. Protection is based upon prior knowledge of the attacker. Naturally, cyber criminals are aware of this and are now specifically designed to avoid this entire process.
They now use fileless techniques to download random payloads and signatures to completely avoid detection.
Behavioral Profiling
Rather than focus on identifying attackers by their fingerprints, BlackFog looks at the characteristics of what makes an attacker different than a normal application. BlackFog focuses on analyzing network traffic to detect unusual behavior. A great example of this is the use of the Dark Web for stealing and activating software.
Typically, attackers use Fileless techniques to avoid detection and either download or execute remote payloads with the purpose of stealing data. To do this it is necessary to connect to a remote server. Since this needs to remain anonymous to avoid detection, it is usually performed over the Dark Web. By blocking:
- Fileless execution
- The Dark Web
- Remote targets
The attacker can be stopped at each stage of the cycle.
There are many other techniques BlackFog uses to stop cyber criminals, and these will be the topic of future articles.
Related Posts
The Hidden Crisis: How Stress is Forcing 1 in 4 Chief Information Security Officers to Quit
A Hidden Crisis A Chief Information Security Officer (CISO) has always had huge responsibility. But with increased cyberthreats and a growing workload, security leaders are under siege. According to research we [...]
Ransomware Detection: Effective Strategies and Tools
What ransomware detection tools and techniques should businesses be using in order to improve their security?
Understanding Double Extortion Ransomware: Prevention and Response
What is double extortion ransomware and what should firms know in order to protect against this threat?
Key Steps for Effective Enterprise Data Protection
How must firms adapt to a challenging enterprise data protection landscape in 2023 and beyond?
Is Transparency Important Beyond Compliance After a Cyberattack?
Understand whether transparency following a cyberattack matters beyond compliance - with real-life examples like Uber's cover-up. Learn the benefits and risks of transparency - from trust building to reputation risk.
A quarter of cybersecurity leaders want to quit
A new research study commissioned by BlackFog reveals that 24% of cybersecurity leaders are looking to leave their jobs due to stress and high demands.