BlackFog 4.2 offers a new feature called “execution prevention” within the settings. This option provides a new technique for preventing malware execution.
Typically, organizations and previous editions of BlackFog utilized a whitelisting approach, whereby execution of rogue malware was prevented by blocking execution in specific directories such as temporary folders or application data directories. Whilst very effective at preventing malware, the downside was that many legitimate applications often used these locations as well. Even though this is against guidelines, companies such as Google and Microsoft’s own applications sometimes used this method, meaning that when you installed a new application that used these directories you had to whitelist the files. Users found this to be invasive so we decided to develop a new approach.
We have eliminated whitelisting in favor of process monitoring and application validation. This is a behavioral technique for detecting malicious activity. The principle behind this technique is that malware often masquerades as other applications, spawns from system processes and executes in certain ways. In these scenarios we introspect all of the processes to see if they are being hijacked, replicated or simply spoofed. As with the data exfiltration rules, this is done in real-time.
Ultimately this will lead to less false positives and ensure more accurate protection than whitelisting can ever provide. In addition, this will protect execution across the entire device rather than specific directories.
Related Posts
Lake Dallas ISD Chooses BlackFog to Prevent Data Exfiltration
Lake Dallas ISD serves about 4,000 students in Denton County uses BlackFog's anti data exfiltration to protect the school district and ensure data doesn’t end up in the hands of cybercriminals.
Wizard Spider: Taking A Look At The Notorious Russian Cybercrime Group
Wizard Spider is a notorious Russian cybercrime group which is part of a larger cyber-cartel known as the Ransom Cartel or Maze Cartel.
Ransomware Focus: LockBit Attacks in 2024
Latest information on all LockBit attacks both disclosed and undisclosed in 2024
Ongoing: New Ransomware Gangs in 2024
Ransomware gangs continue to break records and BlackFog will track all new ransomware gangs in 2024.
Data Security Services: What do Firms Need to Know?
Why should firms be considering data security services as part of their cyber protection strategy?
BlackFog Sweeps the 20th Annual 2024 Globee Awards for Cybersecurity
BlackFog Named Triple-Winner in the 20th Annual 2024 Globee Awards for Cybersecurity