The mutating malware monster demands new defenses
Connecting state and local government leaders
Revised guidance from NIST on defending against malware reflects the evolution of malicious code, which is becoming more complex, dangerous and difficult to detect.
Malicious code has evolved over the past eight years, becoming more complex, dangerous and difficult to detect, and often relying on social engineering to begin an attack. Those changes are reflected in recently updated anti-malware guidelines from the National Institute of Standards and Technology.
Special Publication 800-83, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, has been revised throughout with guidance to help organizations better understand and mitigate the risks. It addresses both preventing and responding to infections of malicious code as part of a larger risk-management process.
Malware is becoming more difficult to detect, and consequently the infections can be more widespread than in the past. “Unlike most malware threats several years ago, which tended to be fast-spreading and easy to notice, many of today’s malware threats are more stealthy,” the authors write. They are designed to quietly spread through a system, gathering exfiltrating information over time.
The revised document, first published in 2005, is a companion to SP 800-61, the Computer Security Incident Handling Guide, which was published in a new revision in August 2012. Malware is addressed in its own publication because it remains the most common external threat to government systems. SP 800-83 focuses on desktop and laptop protection. NIST has published separate guidance for managing security in mobile devices in SP 800-124.
NIST defines malware as any program covertly inserted into another program with the intent to compromise the confidentiality, integrity or availability of the victim’s data, applications or operating system. The publication identifies several forms of malware, including:
- Viruses, self-replicating code that can be executed by either an operating system or an application.
- Worms, self-replicating programs that can execute without user intervention.
- Trojans, non-replicating programs hidden in otherwise legitimate software.
But the rise of more complex attacks that combine these different categories has made the distinctions largely irrelevant today, the authors say. “Many, if not most, instances of malware today are blended attacks,” they write. “Current malware also relies heavily on social engineering.”
The resulting threats, sometimes called Advanced Persistent Threats (a term that already is going out of style because many of the exploits they employ are neither advanced nor new), can be difficult to detect and to remove from infected systems. Web-based exploits can search for and exploit any of a number of vulnerabilities found on a browser. This bundling makes distinctions between types of malware less useful in responding to them.
“At one time, there were largely different procedures for handling incidents of each malware category; now there is largely one set of procedures for handling all malware incidents,” the authors write.
Agencies should develop and implement a risk-based malware incident prevention program based on the attack vectors that are most likely to be used against them. These should include preventive methods suited to the agency and address policy, awareness training, vulnerability and threat mitigation as well as defensive architecture. Other measures to consider include:
- Preventive measures to ensure consistent and effective protection throughout the organization. Policies for these should be general enough to provide flexibility, but specific enough to be clear and enforceable.
- Awareness and training programs that include guidance on both prevention and response to malware incidents.
- Vulnerability mitigation programs with documented policy, processes and procedures. Choose the most appropriate method for mitigating a vulnerability based on the organization’s needs and structure.
- Threat mitigation procedures to detect and stop malware before it reaches its target. This can include antivirus software as well as other controls that can be found in SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations.
- Defensive architecture methods to reduce the impact of malware that gets past perimeter defenses. Sandboxing, using different types of browsers for different tasks, and separating applications and operating systems through virtualization can help mitigate impact.
Finally, SP 800-61 describes a multiphase incident response process that should be applied, which includes preparation; detection and analysis; containment, eradication and recovery; and post-incident assessment of lessons learned.
Defending against malware is an open-ended process that will require constant evaluation and refinement, the authors say. “Today’s malware is often harder to detect, more damaging and harder to remove than previous generations of malware. And there is no indication that this evolution is at an end.”
NEXT STORY: Belkin brings secure KVM to DisplayPort