Emulating the enemy

July 2013 Information Security

‘Know your enemy as well as you know yourself’ is a frequently-quoted statement in IT security. However, one of the problems facing businesses in South Africa is that they seem to have new adversaries lining up every day to launch attacks, disrupt operations and stealthily siphon confidential data using a wide array of malware.

Cybercrime has become big business and just like any other business sector, criminals are looking to boost their revenues and grow their market share. This means targeting hundreds, even thousands of companies with their attacks, to increase the likelihood of success. The attack technique most commonly used is stealthy malware, which is designed to be hard to detect and operate below the radar of IT departments.

To give a sense of how this is now happening on an industrial scale, in 2012 an average of 70 000 to 100 000 new malware samples were created and distributed every day. This is over 10 times more per day than in 2011, and over 100 times more than 2006. It is impossible for conventional anti-malware approaches to keep pace with this massive growth. Check Point’s 2013 Security Report found that 63% of organisations were infected with bots, and more than half were being infected with new malware at least once a day.

The code for the majority of these new infections is concealed in common file types that we all use for business, e-mails, Word documents, PDFs, Excel spreadsheets and so on. Hacker toolkits exist that can obscure these executable scripts, to disguise their malicious actions, which may mean changing the registry on a user’s computer, or downloading an executable file which can then infect the network. With the growing volumes of traffic on corporate networks and the volume of new malware being introduced and hiding in plain sight in innocuous-looking files, organisations are vulnerable to a multitude of attacks. Even though layered defences using intrusion prevention and intrusion detection systems can help to block some malware actions, these still do not stop infections reaching the network and spreading across it.

The sheer number and complexity of new attacks means we cannot hope to know everything about the enemy, however we can at least understand the enemies’ intent, and the methods of attack they are likely to use. This can reveal vital intelligence that can be used to identify and nullify new risks.

Just as SA’s border control will use a range of techniques to observe the people entering and identify those who pose a threat, new security techniques have made it possible to scrutinise the e-mails, files and data entering a network and isolate malicious files at the network edge so that infection does not occur, and without impacting on the flow of business.

This is done using a technique called threat emulation. Rather like a border control’s X-ray scanners, the technique makes it possible to look inside suspect files arriving at the gateway, and inspect their contents in a virtualised, quarantined area known as a ‘sandbox’. In the sandbox, the file is opened and monitored for any unusual behaviour in real time, such as attempts to make abnormal registry changes or network connections. If its behaviour is found to be suspicious or malicious, it is blocked and quarantined; preventing any possible infection before it can reach the network and cause damage.

A 2012 study showed 85% of breaches from cyber attacks took weeks or more to be discovered. If companies could share information about emerging threats online when they are identified, and before they infect networks, rates of infection could drop dramatically.

For more information contact Check Point South Africa, +27 (0)11 319 7267, [email protected], www.checkpoint.com





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Managed security solutions for organisations of all sizes
Information Security
Cyberattackers have become significantly more sophisticated and determined, targeting businesses of all sizes. PwC’s Global Digital Trust Insights Survey 2025 Africa and South Africa highlights the urgent need for organisations to implement robust cyber risk mitigation strategies.

Read more...
Multiple IoT devices targeted
Information Security Residential Estate (Industry)
Mirai remains one of the top threats to IoT in 2025 due to widespread exploitation of weak login credentials and unpatched vulnerabilities, enabling large-scale botnets for DDoS attacks, data theft and other malicious activities.

Read more...
Local-first data security is South Africa's new digital fortress
Infrastructure Information Security
With many global conversations taking place about data security and privacy, a distinct and powerful message is emerging from South Africa: the critical importance of a 'local first' approach to data security.

Read more...
Sophos launches advisory services to deliver proactive cybersecurity resilience
Information Security News & Events
Sophos has launched a suite of penetration testing and application security services, designed to identify gaps in organisations’ security programs, which is informed by Sophos X-Ops Threat Intelligence and delivered by world-class experts.

Read more...
Kaspersky highlights biometric and signature risks
Information Security News & Events
AI has elevated phishing into a highly personalised threat. Large language models enable attackers to craft convincing emails, messages and websites that mimic legitimate sources, eliminating grammatical errors that once exposed scams.

Read more...
Software security is a team sport
Information Security Infrastructure
Building and maintaining secure software is not a one-team effort; it requires the collective strength and collaboration of security, engineering, and operations teams.

Read more...
Stronger cloud protection
Kaspersky Information Security Products & Solutions
Kaspersky has announced the release of an enhanced version of its Kaspersky Cloud Workload Security, delivering advanced protection for hybrid and multi-cloud environments.

Read more...
AttackIQ enters South Africa with key appointment
Information Security News & Events
AttackIQ, a provider of continuous security validation and exposure management, has announced its entry into the South African market with the appointment of Luke Cifarelli as its country manager.

Read more...
Managed security solutions for organisations of all sizes
Information Security News & Events
Cyber attackers have become significantly more sophisticated and determined, targeting businesses of all sizes. PwC’s Global Digital Trust Insights Survey 2025 Africa and South Africa highlights the urgent need for organisations to implement robust cyber risk mitigation strategies.

Read more...
Data resilience at VeeamON
Technews Publishing SMART Security Solutions Infrastructure Information Security
SMART Security Solutions attended the VeeamON Tour in Johannesburg in August to learn more about data resilience and Veeam’s initiatives to enhance data protection, both on-site and in the cloud.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.