By Cat Yong
Intel Security’s second annual tech forum in Kuala Lumpur saw over 100 participants from different functions and a diverse range of industries, in attendance.
Intel Security’s Southeast Asia MD, Craig Nielsen keynoted the event, calling to attention that the way malware attacks have evolved really calls for a change in security strategies.
This is also reflected in the way that Intel now has tighter integration with its Security group, and has come up with new solutions to enable this change in approach to security, for any organisation.
He observed, “The security challenge is all around Asia. But too many vendors are driving campaigns, just to get the purchase order (instead of working towards true outcomes).”
Intel Security however recommends businesses to redefine their security strategies, taking into account building for resilience and agility with a security connected approach, protecting complex, high-performance assets with visionary security features, and also looking to enable a next-generation architecture for integrated protection.
All these need to be done within a holistic risk framework.
The Intel Security Connected Tech Forum this year, also saw two Intel Security CTOs present to the audience, about real-life security situations, and not-yet-released Intel Security solutions that are going to debut in the next few years, if not later this year.
New trends, new vulnerabilities
With trends like cloud, mobility and the Internet of Things, attack vectors have increased tremendously. Every single device that every single person’s life revolves around, is a shining beacon for hackers to infiltrate, so a near-future forecast, that there will be 10 devices for every person on the planet, is chilling.
Intel Security CTO for Security Connected, part of the global Office of the CTO, Michael Sentonas commented, “In the last three hours, five of the world’s largest hosting companies were hacked. Every step of our usage of technology is being compromised. It’s a daily challenge we all have to face.”
It’s also becoming truer that just a single attack now, involves so many different parts and different technologies of an organisation. Sentonas said, “There are a number of different ways the attacker moves inside an organisation and compromises it. They have time to do this, and lots of opportunities to find entry points into an organisation. They have no shortage of technologies at their disposal.”
For example, attackers can leverage the cloud to enable their viruses to spread farther, faster.
“They only have to get it right once,” Sentonas pointed out.
Increase context awareness
Defense against this however, is fragmented and silo-ed. Sentonas observed, “Solutions don’t integrate well, and they take too much time to deploy and manage. An attacker has time on their hand and only needs to find one weakness to be successful.”
In view of this, Intel Security’s strategy is to be a leading security advisor. “We don’t have a security product for every part of your network, but we believe all security technologies have to integrate and interoperate as though they were from the same vendor,” said Sentonas.
One way to be able to do this is by sharing security events all across the network, in real-time.
Sentonas described the McAfee Data Exchange Layer (DXL) as something that originated out of the CTO office three years ago. “It is a messaging fabric that connects all of the security industry’s technologies, and allows them all to ‘talk’ using a common language.”
This in turn, also enables something like McAfee’s Threat Intelligence Exchange (TIE). This is a repository of sorts, where all the information from over 700 researchers and intelligence gathered from endpoints and systems, reside at. Not to mention, there are 3rd party feeds into the exchange, as well.
Other upcoming tech
There are interesting features waiting to be unleashed when one has visibility into and capability to do something about architectures at the software and hardware level.
TrueKey is another piece of technology that Sentonas described, “… leverages facial recognition to eliminate use of passwords. We want to extend it to include use of other biometric authentication methods like thumbprint and voice, as this could potentially eliminate a massive category of identity based attacks.”
Another solution, the McAfee Advanced Threat Defence (ATD) appliance converts advanced malware analysis intelligence – from the network edge right up to the endpoint – into action. For example, it acts upon information to shut down command and control communications, quarantine compromised systems, block additional instances of similar attacks and assesses damage.
“Intelligence that the ATD gathers, is also shared with other security vendors and is put into the threat info depository (TIE),” said Sentonas.
Responding to threats in real-time
According to Sentonas, endpoint detection and real-time rapid response, is a growing market that would persist this year and the next.
There are some solutions in this space but they are not necessarily the easiest to use or complete.
Some Endpoint detection and response (EDR) solutions as an example, do not keep a database of historical reports which means they only help if you find an issue as it is happening, or when an attacker is carrying out their attack. What about an attacker that was on your network last week stealing your data but may not be active today? How does that solution help?
But, the McAfee Active Response persistently monitors critical events and state changes at endpoints, stores the information, and sets traps and triggers to alert for similar events in the future.
“We have use cases where we can query 100,000 machines in 60 seconds, to quickly determine what is going on in every point of your organisation. You can detect and respond to security breaches from one single console.
“For example, it will check for users who run the malware, terminate the connection and alert the users. I can set rules for detection and based on this, it will let me know when a bad file lands in my environment,” said Sentonas.
All this is made possible by the DXL which is built into all point products by Intel Security.
Phishing scams
During the tech forum, Intel Security’s APAC CTO, Sean Duca also presented about a phishing scam upon a large Australian telco recently. The attack occurred in the guise of an email from Australia’s government-owned incumbent entity, Australia Post, that prompted the user to click a link.
Looking at the nature of the attack, Duca opined that more than just one solution had a role to play.
“Only 18-percent of code runs in the sandbox (for security researchers to observe and analyse),” he said.
“That attack required five different engines – blacklisting, reputation management, sandboxing, dynamic code analysis, and signature scanning – to address it.”
This is just one of countless more situations to come, where a number of solutions have to work together to beat the attack.
But for it to be effective, there is need for a single party to orchestrate all the defense solutions so that the optimal effect can be achieved, in the quickest time possible.
– to be continued-
