The Anti-Virus Guy

I am in danger of pigeon-holing, type-casting myself as The Anti-Virus Guy. That doesn’t bother me too much, when I see how the Heartland and Hannaford Brothers data breaches remained effective and undiscovered due to undetected malware. According to the 2009 Verizon Data Breach Investigations Report, 38% of data theft utilized malware (67% were aided by significant errors). According to the 2009 CSI Computer Crime and Security survey, 74% of companies experinced malware infections in 2005, with that number decreasing to 50% in 2008 but returning to 64% in 2009.

My statistically unsupported speculation (but confirmed by reviews of the Heartland, Hannaford and other breaches): most data theft can be described by the following scenario:

1. a mistake was exploited (misconfiguration or vulnerability left unpatched),
2. the network was hacked,
3. malware was installed and
4. data collected.

From this you learn that finding and fixing configuration errors and applying patches are required measures. Finding the intrusions, undetected malware and data exfiltration are also required measures.

If you have a highly mobile workforce, anti-virus software should be considered as an intrusion detection system.

Intrusion detection systems detect anomalies, typically restricting their focus to anomalous network activity. They detect anomalies; anomalies which may have been caused due to an intruder, although they rarely are. Intrusion detection systems rely upon a person to investigate and determine the appropriate action.

Anti-virus software detects malware, typically spyware or Trojan horse software. A virus (malicious code inserted in a host program) is rare. Anti-virus software has expanded its scope to include a broader range of software that you may not want running.

Learning where the detected malware came from helps you to block access to that location and helps you to learn what other programs arrived from that location. Treat malware detection alerts as suspicious activity to investigate and take appropriate action.

In a mobile workforce you cannot rely upon your network monitoring equipment to inform you about anomalous conditions. Your network-based intrusion detection system can scan internal network traffic including traffic on VPN connections. Other network traffic is outside its scope. Nonetheless, you can still gather information about anomalous events through your anti-virus software.

Related links:

• Lessons from the Heartland Data Breach
• Is Anti-Virus Dead?
• Web Browser Forensics
• Why Blacklist?
• Fellow Malware Travelers
• How Anti-Virus Vendors Could Improve Detection

---

Possibly related posts: (automatically generated)

• Revisiting Incident Response
• Linklist – July 27, 2007