Virus Prevention Without Signatures

w w w. i s s . n e t
Virus Prevention Without Signatures
Copyright © 2005 Internet Security Systems, Inc. All rights reserved worldwide
TAhead of the threat.Virus Prevention Without Signatures An ISS Whitepaper 1
ww ww ww.. ii ss ss .. nn ee tt
Introduction
Viruses have been on the attack for more than 20 years, and the cost of dealing with them is escalating. Too many malcode (maliciouscode) attacks by viruses, worms, Trojans and the like are breaking through today's most prevalent system defenses - Antivirus (AV)programs. It is time for the next generation of virus prevention. This whitepaper will discuss the full impact of virus disasters and whathistorically has been done to combat the problem. It will show how ISS' new Virus Prevention System (VPS) represents a quantum leapin preemptive protection. Finally, it will show how VPS fits into a layered protection strategy, providing protection at the host/desktopand at the gateway.
The Very Real Threat of Virus Attacks
1In 2004, virus disasters increased 12 percent, although 99 percent of those surveyed had AV protection in place. The average cost of recovery increased more than 40 percent last year, to $130,000 per incident. It also took longer to recover: 7 more person days - a 25 percent increase - bringing the average time for full recovery to 31 person days.
The 2004 ICSA Labs survey polled only a handful of the number of businesses operating in the United States today. This report states:"Respondents in our survey historically underestimate costs by a factor of 7 to 10." If the full impact of a virus attack could be calculated,the costs would be astronomical - lost data and lost sales, customer dissatisfaction or breaches of confidentiality, employee downtime,increased network administration workload and system repair, to name a few. As the survey put it, "Based on the dollars reported,...2complete cost of recovery would be in the range from $900,000 to more than $5,000,000 (in total costs of recovery alone)."
Even with firewall and Antivirus protection in place, virus attacks can penetrate network security defenses. It can take hours, sometimesdays, for traditional AV vendors to create a virus update. Add to this the time it takes for an organization to test the update, distribute itto all their systems and make it available to their remote laptop populations, and the whole signature update process can take days orweeks. During this waiting period, organizations' critical assets are exposed and at risk.
3Andreas Marx of AV-Test.org, a worldwide security software testing organization based in Germany, has published studies onAntivirus response times. A February 2004 test measured how long it took 23 traditional AV vendors to come up with updates to
1 ICSA Labs Virus Prevalence Survey 2004, www.icsalabs.com. A virus disaster is defined as "an incident in which 25 or more machines experienced a single virus at or about the same time," and/or incidents "that caused organizations significant damage or monetary loss."2 Ibid.3 www.avtest.org
TTAAhheeaadd ooff tthhee tthhrreeaatt..Virus Prevention Without Signatures An ISS Whitepaper 2
w w w. i s s . n e t
combat four viruses: Dumaru.Y, MyDoom.A, Bagle.A and Bagle.B. According to AV-Test.org data, these are the average lag times for4each program during the test period:
Average Antivirus Vendor Response TimeThe top two AV vendors averaged more than 26hours to respond to the threats.
What business can afford to wait that long for an effective virus update? Just one infected PC can easily reproduce at least 10 copies ofthe virus per second; exponentially, a virus can propagate worldwide in a matter of minutes. Because of the amount of time it takes todeliver, test and deploy signature updates, the window of exposure can extend from 7 to 30 hours - and that degree of risk should beunacceptable to any company.
Nevertheless, businesses have been forced to settle for less-than-adequate security solutions because, until recently, the industry didn'tknow what it didn't have - a preemptive choice.
4 "How Long Must You Wait for an Anti-Virus Fix?" by Brian Livingston, February 23, 2004;http://itmanagement.earthweb.com/columns/executive_tech/print.php/3316511.See also www.avtest.org.
TAhead of the threat.Virus Prevention Without Signatures An ISS Whitepaper 3
w w w. i s s . n e... [download for more]