Private companies, organizations and even the federal government spend billions every year on various forms of perimeter security. Between firewalls, IPS/IDS devices, endpoint detection solutions, sandboxing, direct security information and event management (SIEM) monitoring and traditional antivirus and antimalware installations, most organizations seem to be bristling with protections that should make them secure – at least on paper. But the truth is, unfortunately, very different.
Successful malware infections are on the rise, as are the losses sustained by companies trying to defend against today’s most advanced threats.
Many of today’s most advanced persistent threats (APTs) and cutting-edge malware programs are created specifically to get around traditional protection. They are designed so that they never need to make use of known servers and domains, and don’t ever check in to the same place twice. Like real-life spies who never backtrack to the same meeting location, this new breed of malware can stay one step ahead of any protection scheme that has to rely on knowing pervious behavior.
In fact, the only way to detect and defeat this kind of advanced threat is by employing powerful data analytics. Protection can’t simply follow behind the malware, hoping to somehow catch up. In this industry perspective, GovLoop and HPE have partnered to discuss solutions to prevent issues like these – solutions that can analyze the malware’s communications, identify it as such even if it never touches a blacklisted site and enable analysts to neutralize the core program before it can do any harm.
