Identifying & Thwarting Malicious Intrusions

WW HH II TT EE PP AA PP EE RR
IIddeennttiiffyyiinngg aanndd TThhwwaarrttiinngg
MMaalliicciioouuss IInnttrruussiioonnss
© 2008 MX Logic, Inc. All rights reserved. v. 051908 720.895.5700 : INFO@MXLOGIC.COM : WWW.MXLOGIC.COMWWhhiittee PPaappeerrIdentifying and Thwarting Malicious Intrusions z page 1
Introduction
Information is the lifeblood of today's organizations and this critical resource is TThhee ppuurrppoossee ooff tthhiiss wwhhiitteeat risk. The Internet exposes it to a malignancy posed by global gangs of cyber ppaappeerr iiss ttoo hheellpp bbuussiinneesssscriminals seeking to steal sensitive data for profit. A criminal attack can alsomodify/delete sensitive data, or limit or deny access to critical information ddeecciissiioonn mmaakkeerrss ttoo bbee mmoorreeneeded to manage a business. eeffffeeccttiivvee iinn ppllaannnniinngg
Cyber criminals constantly launch sophisticated new attacks seeking profits mmaallwwaarree ddeeffeennsseess..from stolen information, with new exploit variants numbering hundreds ofthousands yearly. The impact of a successful attack ranges fromembarrassment when sensitive data is posted on public Internet sites, to costlynotifications of affected parties, regulatory fines, lost consumer confidence andpotential legal liability. The worst case is a business dead in the water, unableto access information needed to manage operations.
Many businesses, focused on profitable operations, lack the resources to investin the deep skills needed to protect critical information and infrastructure fromsophisticated attacks. Often a business does not recognize when they are underattack, or have the skills to locate the ensuing infections. Fewer still have theknow-how to remedy infections to prevent their embarrassing spread tobusiness partners or customers.
There is help for businesses seeking to mitigate the risk posed by cybercriminals. Vigilant defenses can detect attacks as they are launched andeliminate the threats before any damage is done. Layers of infrastructuresafeguard identity and remove infections before they spread their malignancy,or repair the damage from an attack underway.
In all cases, a proper defense against malicious information attacks begins witheducation, to understand the nature of the threat. The purpose of this whitepaper is to help business decision makers to be more effective in planningmalware defenses by providing education on:
z The types of malware, classified by behaviorz How malware is distributed and controlledz How cyber criminals blend these elements into attacks
© 2008 MX Logic, Inc. All rights reserved. v. 051908 720.895.5700 : INFO@MXLOGIC.COM : WWW.MXLOGIC.COMWWhhiittee PPaappeerrIdentifying and Thwarting Malicious Intrusions z page 2
Types of Malware Threats
Malware Definition (www.wikipedia.com): Software designed to infiltrate ordamage a computer system without the owner's informed consent. Acombination of the words "malicious" and "software", it is used by computerprofessionals to refer to a variety of forms of hostile, intrusive, or annoyingsoftware or program code. TThhee IInntteerrnneett iiss ppllaagguueedd wwiitthhmmaannyy ddiiffffeerreenntt ttyyppeess ooffThe Internet is plagued with many different types of malware. Malware types,such as viruses, worms, Trojans, spyware, adware, and rootkits are classified mmaallwwaarree.. according to their behavior, or infection characteristics, and propagationtechniques. MMaallwwaarree ttyyppeess,, ssuucchh aassDifferent types of malware behave in unique ways ? launching spam, spreading vviirruusseess,, wwoorrmmss,, TTrroojjaannss,,infection, or stealing sensitive information. Malware also has unique distribution ssppyywwaarree,, aaddwwaarree,, aannddmethods. Some newer malware types are narrowly targeted and spread slowlyto avoid detection. Classic malware attacks are quickly and widely distributed, rroooottkkiittss aarree ccllaassssiiffiieeddleading to a very dangerous Internet. Consider: aaccccoorrddiinngg ttoo tthheeiirr bbeehhaavviioorr,,
z The Storm virus was first seen in January 2007 and has infected an oorr iinnffeeccttiioonn cchhaarraacctteerriissttiiccss,,1estimated 20 million computers. aanndd pprrooppaaggaattiioonn tte... [download for more]