eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Malware is increasingly being used as advanced persistent threats against enterprises, according to the latest quarterly report from Cisco.
There were 287,298 “unique malware encounters” in June 2011, double what was found in March, according to a Global Threat Report from Cisco Security Intelligence Operations released Aug. 1. Since the beginning of 2011, unique malware encounters have nearly quadrupled, Cisco said.
In the report, Cisco researchers did not restrict a malware encounter to just malware infecting a single system. It can also include incidents when a system was initially infected by a basic downloader, which analyzed the system and downloaded even more sophisticated data-collecting malware.
“Malware has evolved along with the Internet and is now the tool of choice for would-be attackers,” wrote Gavin Reid, manager of the computer Security Incident Response Team at Cisco.
Cyber-attackers rely on malware to “remain surreptitious” so that they can continue to remotely manipulate a system while remaining virtually invisible, Reid said. Detecting APTs like unique malware is not an easy task because there is no “silver bullet” such as a software signature that would identify them on a network, he said.
“If anyone attempts to sell your organization a hardware or software solution for APTs, they either don’t understand APTs, don’t really understand how computers work or are lying, or possibly all three,” Reid said.
On average, enterprises had 335 malware encounters per month, Cisco researchers found. March had the highest malware activity during the second quarter, with enterprises seeing an average 455 pieces of malware, followed by an average 453 encounters in April.
The majority of the “malware encounters” occured over the Web, the report said, as employees surf the Web and land on malicious sites. Despite the increase in encounters, the number of unique malware hosts and unique IP addresses remained relatively consistent between March 2011 and June 2011, according to the report.
Companies with between 5,000 and 10,000 employees and more than 25,000 employees “experienced significantly higher malware encounters” compared to other smaller companies. Companies in the pharmaceutical, chemical, energy and oil sectors continued to be at highest risk of Web malware, according to Cisco, although transportation, agriculture, mining and education were also at high risk.
Organizations can improve their abilities to detect and respond to APTs if they have some form of deep packet inspection technology that covers all the important points in the network where traffic is entering or leaving the enterprise. The ability to quickly query network connections or flows through NetFlow or a similar service will also help security managers detect malicious activity.
The organization should also be able to produce, collect and query logs such as host logs, proxies and authentication and attribution logs. “The more the better,” Reid wrote.
Organizations that have not seen any APT attacks should be concerned, according to Reid, as it doesn’t mean that attackers haven’t targeted it or that the security defenses are working. What’s more likely is that the defenses aren’t picking up on the attack itself. “If you have something of interest and you’re not seeing APT attacks in your organization, you may need to rethink your detection capabilities,” Reid said.