Symantec unveils new technologies to fight targeted attacks

• Protection at the gateway, endpoint and data centre
• Vulnerable SMEs being used to target enterprises

SYMANTEC has announced new additions to protect organisations from targeted attacks, including Disarm technology in Symantec Messaging Gateway and the addition of Network Threat Protection in Symantec Endpoint Protection for Mac computers.
 
Defending against sophisticated targeted attacks is now the norm, and it’s not just large companies that are being impacted, the company said in a statement.
 
Targeted attacks are growing significantly among businesses with fewer than 250 employees. Small businesses globally are the target of 31% of all attacks, according to the 2013 Internet Security Threat Report.
 
Small companies are an attractive target for cybercriminals as they have fewer security safeguards and often have business relationships with larger companies which may be the ultimate target of attackers.
 
“One of the main concerns for chief information security officers (CISOs) and IT managers today is safeguarding their organisations against evolving targeted attacks, which have become an established part of the threat landscape,” said Josephine Hoh (pic, right), country director, Symantec Malaysia.
 
“The new technologies, combined with our comprehensive solution portfolio, will protect organisations in Malaysia from threats at the gateway, on the endpoint and in the data centre,” she added.
 
Protection at the gateway
 
Developed by Symantec Research Labs, Symantec’s advanced research division, the new Disarm technology in Symantec Messaging Gateway 10.5 uses a first-of-a-kind technique to protect companies from targeted attacks.
 
Most targeted attacks are now delivered in the form of malicious but seemingly innocuous documents delivered over email, the company said. Each such malicious document, e.g., a PDF, DOC or XLS file, contains an embedded attack, and when a victim simply views the document, his or her computer is automatically and silently compromised.
 
Traditional protection technologies attempt to scan documents for suspicious characteristics. The problem is that many of these document-based attacks are purposefully crafted so they don’t look suspicious, and as a result, they go undetected.
 
“Disarm technology takes a whole new approach. Instead of scanning the document, it essentially makes a digital harmless carbon copy of every incoming email attachment/ document, delivering this carbon copy to the recipient, rather than the original, potentially malicious document,” said David Rajoo (pic above, left), principal consultant at Symantec Malaysia.
 
“The result is that the recipient is never exposed to the attacker’s malicious attachment,” he added.
 
Symantec claims that Disarm technology would have blocked 98% of attacks that exploit zero-day document vulnerabilities thus far in 2013 – these are attacks that were entirely unknown and would therefore have likely evaded all traditional scanners, heuristics, emulators and even Virtual Execution (VX) solutions.
 
Protection at the endpoint
 
Symantec said it has added its advanced Network Threat Protection technology to the Mac version of the Symantec Endpoint Protection 12.1.4.
 
“Many Mac users think they’re impervious to attacks, and as a result don’t take security seriously. But the reality is that this makes Mac users a potential goldmine for targeted attackers,” said Rajoo.
 
“Symantec’s Network Threat Protection technology intercepts incoming network traffic before it can impact the Mac computers, looking for targeted attack exploits and automatically blocking them,” he added.
 
Network Threat Protection technology uses a patented, application-level, protocol-aware Intrusion Prevention System to not only identify and block known attacks, but also identify and block many unknown or day-zero attacks.
 
Protection at the data centre
 
The company also offers Symantec Critical System Protection (CSP), a server lockdown solution designed to protect both physical and virtual infrastructure.
 
Organisations can install and configure CSP so it only allows known-legitimate activities on your servers and blocks all other (anomalous) activities.
 
If targeted attackers do compromise a server, they must – by definition – perform activities that will deviate from the norm in order to access sensitive data on the machine, or elsewhere in the data centre.
 
CSP automatically detects and blocks those deviations, stopping the attack automatically. Only approved software programs are allowed to run, and those programs are only allowed to perform approved behaviors, access approved resources, etc.
 
Related Stories:
 
Malware targeting small businesses: Symantec report
 
Are you prepared for the next threat cycle?
 
Cyber-attacks greater national threat than physical attacks: Survey
 
‘Apple has its head in the sand’
 
 
For more technology news and the latest updates, follow us on Twitter, LinkedIn or Like us on Facebook.