It’s Time to Re-Evaluate Host-Based Security

Updated: September 07, 2010

There are several problems with malware protection which relies on signatures:

1. Malware writers are using sophisticated toolkits which reduce the skill and time needed to produce effective malware - both new and variants.
   
   
2. Polymorphic malware regularly gets around signature detection, forcing AV vendors to constantly push out new signatures - several times per day!
   
   
3. There are many kinds of malware that are still not properly detected by up-to-date AV solutions with current definitions.

Where does this leave us? Host-based antivirus products are using up more and more CPU cycles to process an ever-growing list of viruses, yet are still unable to keep up with the onslaught of new malware. To make matters worse, the constant creation and release of new definition files is stressing the quality assurance (QA) process for antivirus vendors. We have reached the place where IT professionals are considering turning off automatic AV updates, and deploying labs to test the updates before release.

In short, the odds of timely detection continues to drift downward every so slowly, while the risk of friendly fire from the AV solution itself creeps upward ever so steadily. (The McAfee update issue had an impact on its clients that rivaled a major virus attack.)

We are long overdue for a different approach.

Application Whitelisting

Companies such as Bit9, CoreTrace, and Lumension have been pushing application whitelisting for years now. Microsoft has also provided this technology via AppLocker in Vista, Windows 7 and Server 2008. Even some of the major AV players have purchased or developed application whitelisting technology, but they have not been actively pushing it into the mainstream. They need to start.

Better yet, we as IT leaders and professionals need to start evaluating and deploying the technologies that better address information security concerns in 2010 and beyond, allowing us to make better use our limited budgets and resources.

Application whitelisting is a good idea, because for every environment, there are less items that fall into the "known good" category than bad code that you don't want to run. Just consider the difference in a firewall rule-set that assumes a "deny all that has not been explicitly opened" stance vs one that tries to explicitly prevent access to all bad protocols and ports.

The frequency of change in the "allow list", particularly in corporate environments, will be greatly reduced as compared to the "bad list". This automatically minimizes the chance for error. It also means that the processing power needed to evaluate the former list will be far less than that needed to evaluate the current lists of malware in today's signature-based AV products.

Mitigating Code-Enabled Data

I think that we really have to weigh the disadvantage of code-enabled data files and either abandon them outright (queue lots of whining), or at least ensure that there are centrally controlled configuration options for enabling or disabling the automation features of productivity applications.

For instance, consider how diminished the threat of macro-embedded documents has become since Microsoft enabled much better controls over macro security, including turning them off by default, and allowing them to be set via policies. Remember when macro viruses were the most common threat vector? We need to do the same for PDF exploits.

Getting a better handle on security at the host level entails not only controlling which application can run, but determining in what context, and with what functionality it can run at any given time. If we can get vendors to provide us with centralized controls regulating all of the features they integrate into their apps, then each person and each organization can determine what level of risk to assume for any given application - and in the event of an emergency, the problematic feature can be disabled or otherwise impaired on as a stopgap.

All of these options will sufficiently mitigate external risks without simultaneously increasing risks from errors. And they will consume less processing power and generate less application conflicts than our current antimalware solutions.

Using the Right Technology

Signature-based security devices still have their place within the enterprise - mostly at the perimeter. (And even there, their days are numbered.) But at the desktop, they are increasingly causing more pain than gain, and it is time for us to change our approach, lest we find ourselves slipping further and further behind the malware writers.

And whitelisting need not concern itself with every executable. Each organization can determine just how much to watch and keep track of, balancing performance, productivity and security according to a risk profile that they select.