Fileless Network Protection

Fileless network protection is a key element to device security and an important part of a layered security strategy. The days of protecting yourself from bad actors using a single AntiVirus (AV) solution are behind us. Attackers can easily avoid detection from signature based software. We discuss just a few of the techniques commonly employed by cyber criminals and explain how these can be prevented with a layered approach to security and fileless based protection.

Signature Based Detection

Traditional AV security products rely on signatures to detect and remove threats. This fingerprinting technology looks at every file on your device and generates a unique identification number, or signature. This signature is then compared to a database of known bad actors. When a match is found the offending file is removed.

These products scan your filesystem and current processes looking for bad signatures. However, it is important to understand the limitations of this technique in terms of device and data protection.

Firstly, the bad actor needs to be identified. Just like in the real world, after a break-in, the police have to arrive at the scene, investigate and take fingerprints and then compare them to a list of known criminals. This is no different in the digital world. It takes teams of people to identify, analyze and classify the problem.

Secondly, after it has been verified it can be added to a database and made available to clients. This takes time. Typically, the best case scenario is around 4 hours. It is usually significantly longer, sometimes 24 hours or more.

The problem is that most cyber attacks do most damage within the first few hours, spreading across the globe rapidly. Recent examples include WannaCry and Petya. Protection is based upon prior knowledge of the attacker. Naturally, cyber criminals are aware of this and are now specifically designed to avoid this entire process.

They now use fileless techniques to download random payloads and signatures to completely avoid detection.

Behavioral Profiling

Rather than focus on identifying attackers by their fingerprints, BlackFog looks at the characteristics of what makes an attacker different than a normal application. BlackFog focuses on analyzing network traffic to detect unusual behavior. A great example of this is the use of the Dark Web for stealing and activating software.

Typically, attackers use Fileless techniques to avoid detection and either download or execute remote payloads with the purpose of stealing data. To do this it is necessary to connect to a remote server. Since this needs to remain anonymous to avoid detection, it is usually performed over the Dark Web. By blocking:

1. Fileless execution
2. The Dark Web
3. Remote targets

The attacker can be stopped at each stage of the cycle.

There are many other techniques BlackFog uses to stop cyber criminals, and these will be the topic of future articles.