Security threats Toolkit
Story: Fannie Mae contractor indicted for planting malware
WHITELIST IT - AND KEEP MALWARE OUT!
One of the first steps people think about in cases like this is - why don't they have appropriate anti-virus programs in place - the reality is that these are only the first step to security. There is value, since these programs perform a thorough cleaning of existing (or known) virus and malware infections, returning the systems to a
relatively stable state. BUT, they are typically just behind the current day and computers are vulnerable to newly released viruses or attacks until the code is identified and the anti-virus agents are updated on every machine – a process that can take weeks.
Here we have a custom piece of malware being created so there is no way the traditional approach would have worked and this therefore turns many computers that are exposed to the malware into zombie machines, running background programs that carry out widespread attacks or tapping into business communications and databases. In order to restore the "status quo" any infected computers must be completely wiped and rebuilt to clear the operating system of the malware, causing downtime, overloading
IT, and impacting productivity.
The alternative approach – ensuring that only approved and valid applications run on every computer – requires a shift in mindset from defense to offense.
In this example, we see that the traditional approaches to endpoint protection have become ineffective in today’s dynamic computing environments. A whitelist solution provides the means to take
charge of your information environment by making the shift from focusing only on what you know is bad to allowing only what you know to be good. Knowing what applications you have, and which you need, is half the battle. By defining the necessary
applications in a whitelist and authorising them to run on the appropriate computers, you automatically place everything else on a virtual blacklist. Simply put, any executable – whether a business application, a video driver, or a web browser plug-in – not specified on the whitelist cannot load and run. Controlling exactly which applications can run on each computer keeps information secure while offering many other operational benefits.
Full Talkback thread
