Scram, Spam
Finally, there's a way to determine who's trustworthy, and who isn't, on the Internet
- By Daniel Ryan
- May 01, 2008
Imagine if 100 people knocked on
your front door each day, but fewer
than 10 of them were trustworthy.
The rest were crooks, con artists and
aspiring criminals. That’s the situation facing
today’s Internet users. Some skeptics
believe there is no stopping bot networks,
phishing schemes and digital scams.
The threat landscape can be intimidating.
On a typical day, the Internet hosts as
many as 450,000 new individual zombies
and tens of thousands of zombie networks.
Each zombie network, in turn,
generates the bulk of today’s Internet
spam—which clogs corporate and personal
e-mail systems.
In many cases, 95 percent of Internet
mail is spam, according to Secure
Computer Corp. researchers.
“I’ve spoken to clients where spam
represents 97 percent of e-mail,” said
Peter Firstbrook, research director at
Gartner Inc.
A Hostile Threat Environment
This constant barrage threatens e-commerce
and online communications. Some
users have stopped opening unsolicited emails
from sources they don’t recognize,
said Russell Dean Vines, author of the
best-selling book “Phishing: Cutting the
Identity Theft Line.”
Other users have scaled back or halted
plans to use e-commerce service. In the
United Kingdom, for instance, nearly
one-third of users cite security fears as
the main reason for not using the Internet
to manage their finances, according to a
survey of 200 consumers conducted by
BT Group PLC in 2005.
Organizations that continue to fight
today’s threats with the same old security
tools are in for a rude awakening.
“We’ve reached an inflection point
with Internet security,” Vines said.
“People are taking a step back and saying,
‘What can I do differently?’ ”
Evolving Security
Chief information security officers must
embrace the next generation of threat
detection and threat mitigation.
In the first generation of IT security,
organizations relied heavily on antivirus
signatures as part of a reactive security
strategy. Those signatures were useful
and helpful, but they didn’t help organizations
combat new viruses and threats
that lacked documented signatures.
Antivirus signatures are similar to
criminal fingerprints. It’s difficult to identify,
track and stop a thief using fingerprints
if he has yet to leave any prints at a
crime scene. Likewise, you can’t use digital
signatures to combat a virus if the
virus’ signature has yet to be documented.
Signatures are binary, and that is a problem. When a security company writes
a signature for a virus threat, it has to
match the virus exactly. As viruses mutate
and new ones emerge, companies that
write signature-based security programs
face a never-ending race to stay current.
A second generation of security technology—
known as heuristics—is more
flexible than signature-based technology.
Heuristics is based on value and checks
for anomalous behavior. These products
represented a solid step in the right direction,
offering supplemental security—but
there also were some downsides.
First, heuristics products that tracked
anomalous behavior sometimes led to
false positives—much in the way that
profiling can lead law enforcement officials
to interrogate and sometimes arrest
innocent parties. The other problem
involved traffic. In order to keep data
moving at a reasonable rate across a network,
businesses can’t afford to analyze
every piece of information that flows
across the network fabric.
Faced with the limitations of first- and
second-generation security products,
CISOs have been seeking third-generation
solutions that focus on behaviorbased
security.
Rethinking Protection
For some organizations, the threat landscape
is overwhelming. Many vendors
are answering the call for help with socalled
proactive security products.
Dozens of vendors claim they can keep
you ahead of the threat curve with products
that anticipate problems before they
occur. A few now claim they have zeroday
threat protection, which means they
claim to safeguard networks from newly
discovered exploits. These and other
claims are creating noise and confusion
in the security marketplace.
Still, savvy CISOs have discovered
the power of what we can only now call a
sub-zero threat protection system. Instead
of sitting back and waiting for attackers
to come knocking, CISOs are leveraging
a reputation-based system—a third-generation
security solution that identifies
who can be trusted and who cannot.
To understand how a reputation-based
system works, consider the world of financial
credit scores. In the 1960s, there was
no such thing as a credit score. You were
either a good risk or a bad risk for the
lender. There was no gray area for financial
lenders to make informed decisions.
To improve the lending system, financial
firms invented credit scoring systems
based on a history of business transactions,
personal transactions and personal
payment patterns. Suddenly, loans could
have variable terms and interest rates
based on financial credit scores.
Apply that same example to the IT
security market. Security developers have
borrowed a page from financial companies,
making available a threat reputation
scoring system based on Internet entities.
The threat reputation system scans all
IPs, domains, URLs, e-mail messages
and images, and pinpoints how trustworthy
they are by looking at their behavior—
and their reputation—in real time.
Then, the system accurately categorizes
them. Instead of simply placing Internet
entities into trusted and untrusted buckets,
the system ranks Internet entities on a
confidence scale that’s similar to the
credit score model used by financial
lenders. This mitigates false positives
within the system.
For more than four years, the global
system known as TrustedSource has been
in development, and now, more than
20,000 companies worldwide are counting
on the advanced security system to
protect against threats before they can
enter the network.
“This isn’t something you build
overnight,” said Roger Miller, president
of Network Aware. “It takes considerable
time, money and brainpower. Plus, you
need an existing global network in place
that allows you to collect and analyze all
of the data you’re going to need for a true
threat reputation system.”
Know the Options
Here’s how to separate fact from fiction as
you evaluate potential threat reputation.
The reputation system has to be the first
line of defense. Rather than sitting deep
within the heart of your network, a threat
reputation system sits on its edge and
stamps out problems before they have a
chance to touch the internal network.
Imagine, for instance, 100,000 emails
hitting the threat reputation system.
In this scenario, the application
typically blocks and destroys 60,000 of the messages based purely on IP and
domain reputation, calculated based on
real-time behavior. And the protection
doesn’t end there. The system stops an
additional 15 percent or so of the
messages based on image and message
type. And finally, another 15 percent
of messages are blocked based on
in-depth heuristics.
“So, only about 10 percent of the mail
directed at your network actually makes it
into the networks,” said Ed Golod, president
of Revenue Accelerators Inc.
Looking ahead, this edge approach is
the only way to protect networks and
scale internal systems. Ironically, by
adding more servers and horsepower to a
network without a threat reputation system
in place, users only increase the
capacity to receive more spam—and the
threats that come with it, such as phishing
and other for-profit hacker schemes.
A Unique System
When designed correctly, threat reputation
systems resemble massive, global intelligent
grid networks that rapidly collect and
share information across the system.
Admittedly, a handful of security
companies collect virus- and spam-related
data. But those collection systems are
fairly rudimentary and are mostly used
for antivirus research reports.
“It’s fine when an antivirus company
starts describing a new virus threat that
can exploit a software hole,” Miller said.
“But that’s old school. A new school
threat reputation system will need to dig
much deeper.”
Think of the global system as a learning
and information-sharing network.
When one node within the system
detects an anomaly or new threat, it
passes on the information to every other
node—much like a body’s immune system
broadcasts the need for more white
blood cells when an infection attempts
to enter the system.
During a typical month,
TrustedSource monitors billions of
Internet transactions. Thanks to its global
breadth and depth, the solution blocks
up to 83 percent of mail volume and
more than 90 percent of spam before
anti-spam software even needs to kick
in. Globally, it blocks 6.2 terabytes of
spam daily.
Avoid False Positives
Some security vendors are designing
systems based on overly simplistic good
or bad methodologies. If the content is
deemed to be from a trusted source, it’s
allowed to enter the network. But if it’s
deemed bad, it’s blocked. That strategy
may have worked in the 1990s. But that
black-and-white approach ignores the
reality of today’s Internet traffic.
Simply put, there’s a broad gray area
that can’t be ignored. For instance, you
don’t want to block traffic from an entire
Internet service provider if only one of
its relays fails the reputation test.
“You want a system that delivers
accurate results, and you want to avoid
false positives,” Firstbrook said. “If you
start blocking entire ISPs, you can wind
up doing collateral damage.”
The threat reputation network has to
have a rich object classification system
that allows you to extensively define
each threat you’re facing. For instance,
the system should be granular enough
to indicate that you want to block selected
e-newsletters without labeling them
as spam.
Find the Experts
To be sure, more big technology
providers are dabbling in IT security.
For those Goliaths, security is often a
check mark they need to have when discussing
overall product portfolios with
customers.
Still, even Firstbrook concedes that
big, broad technology companies will
have a difficult time designing in-depth,
global threat reputation systems.
“Those broad companies are doing a
lot of great things, but it’s challenging for
them to get really focused on something
like threat reputation,” Firstbrook said.
This solution seems to be a breakthrough
technology that enables organizations
to minimize vulnerabilities,
threats and risk often before they exist or
can do damage. As a result, potential
hackers, spammers, phishers and other
attackers are halted in
their tracks.