Protection and Security

Today, hackers and cyber criminals are more sophisticated than ever. These individuals use the same tools that businesses use to defend their network to develop their attacks. One example might involve a trojan picked up by an employees personal activities - by downloading a file disguised as a card or other attachment - for example. The trojan resides on the users machine until released into the business network. It resides there until the company protective software catches up with it.

There are two distinct types of protective software in use - actually more, since some combine both types. One type of protection is "signature-based" In this method, an analyst examins the code, makes a determination of its intent, and creates a "signature" for it. The signature is sent via a software update to their subscribers, and when it is installed, the computer is protected from that threat. This process takes time, and during this time the network is at risk. When only signature-based detection is used a criminal can test their attacks using the same software and it's  most recent updates to re-design their code to get around the protection.

Behavioral "heuristic-based" detection is the other method for isolating malicious files. It does not use a human analyst to review the file. Instead, the security software runs files and checks for possible criminal or maliscious behavior. The software uses pre-defined rules (called heuristics) that are smart enough to know what malicious behaviors look like in an operating system. When a suspect behavior is detected, the malicious file is quarantined, thereby rendering it inoperative. The heuristic method is a proactive measure designed to catch new and unrecognized attacks.

Most modern security solutions today use a mix of signature and heuristic detection methods. A solution that features predominately heuristic detection methods, backed up by signature-based detection, provide the best form of security.

News Headlines