Security threats Toolkit
Story: Gumblar attack worse than Conficker, experts warn
Whitelisting provides a convenient way to manage critical risk.
A Whitelisting approach has gained prominence in recent years with hackers bypassing traditional perimeters to penetrate business critical data and systems.
As illustrated by the Gumblar attack, there is a new group of cybercriminals who are taking advantage of the weaknesses that arise from the dynamic threat environment. The reason why security incidents continue to rise is because the bad guys have evolved their attack methods to outwit our security defenses faster than we have responded to their attacks. They target organisations by making slight adjustments and tweaks to continually fool the signature based AV, firewalls and IPS technologies that most organisations have built their security defences around.
Previously, the prevailing thought was that it would be much easier to manage security at the gateway than individually locking down 1,000 endpoints. Today, security cannot be managed at the gateway because there are too many ways to get around these network-based defenses in this day and age. Organisations must secure the endpoint and manage what executables are running on that endpoint by adopting a whitelisting approach. More organisations will continue to look at alternative solutions outside of the traditional technologies such as AV and firewalls to manage critical risk.
Full Talkback thread
