Protecting your online Privacy – Known Vulnerabilities

Cyber Privacy is an important subset of your computer security regime which includes Anti-Virus, Anti-Malware and perimeter defense tools like Firewalls and Intrusion Prevention Systems (IPS). Most security products today focus on resolving problems based on known vulnerabilities and inbound traffic whereas Privacy is concerned specifically with data loss prevention.

This two part series discusses the different types of defense mechanisms available and how they differ from BlackFog’s approach to threat detection and prevention.

Firewalls are perimeter defense tools that have been the cornerstone of threat prevention for well over a decade. They can block specific ports, endpoints and known vulnerabilities effectively. Since they exist at the gateway they provide an invisible layer of detection for devices within the network.

The challenge for firewalls and most perimeter defense tools is that they only work against well known vulnerabilities and attack vectors. Cyber threats have evolved considerably and now focus on completely different vectors to carry out their attacks. Instead of targeting known channels for weakness (which is always the first stage) they focus on specific channels and protocols that are already open.

Since primary access to the Internet is through a web browser, cyber attacks now focus on weaknesses in browsers and the HTTP/S protocol itself. With more than 80% of your exposure to the Internet through this mechanism cyber criminals utilize this to target you and effectively bypass firewall rules. By leveraging this open port (typically 80 or 443) cyber criminals are able to create tunnels through your network and communicate back to their command and control servers (C&C servers) at will.

In contrast to firewalls, anti-virus (AV) tools focus on the device itself. These tools are great at removing the problem once it is discovered. While clearly and important part of your toolkit once you have been infected they do little to prevent problems in the first place.

Anti-virus tools use a technique known as signature detection. When threats have been discovered researchers fingerprint the files, providing a unique signature that can be used to detect these problems on your device. The signatures are then added to a database which is then sent back to all the clients running the vendor’s software ready for the next detection scan.

Like perimeter defense tools, anti-virus tools focus on known vulnerabilities and therefore cannot adapt to future threats. In the next article we will explain how BlackFog approaches the problem of data loss and privacy protection using preventative techniques.