Malicious attacks are evolving and, as Robert Clyde discovers, defenses to these attacks should evolve too
Attack tools and the attacks themselves are becoming more sophisticated, and the amount of knowledge required by an attacker is dramatically decreasing. Software and techniques are widely published, providing intruders with downloadable 'click and hack' automated tools.
New types of malicious code will fall into three different classes of threats. Class one threats will take a matter of days to a few hours to spread and will include email worms and more recent blended threats, like Nimda.
Class two threats will be able to spread in a few hours to minutes. The Slammer worm was an example of a class two threat. In its initial stages, the infection rate doubled every 8.5 seconds. Human response becomes difficult or impossible, although an automated response would be possible.
Class three threats will only take a matter of minutes to seconds to proliferate across the internet. We have not seen any true 'flash' threats like these just yet, but we probably will in the next several years.
Schooling the classes
There are technologies to defend against each of the major threats. First, 'sensing strategies' tell the administrator that the threat is present. Similar technologies can be used for all three threat classes, including the correlation of intrusion detection events, protocol anomaly detection and distributed sensor networks.
Second, 'reactive strategies' are used to stop threats through reactive mechanisms. 'Proactive strategies' are used to stop threats through blocking mechanisms. For all three threat classes, network and host intrusion prevention are likely to have some effectiveness.
Underlying these technologies is the need for unified central management systems. Such systems must be capable of managing the various security technologies in the organization, as well as aggregating information.
There will also be growth in adaptive management and lockdown technologies. The idea is to build a system in which security components communicate with a centralized management system to provide coordinated response during an attack.
Robert Clyde is CTO for Symantec Corporation (www.symantec.com).
