Chances are you’ve never heard of Dr. John Snow. But the methods he used more than 150 years ago to solve the mystery of a cholera outbreak in London can be applied today to help you get to the heart of a malware outbreak in your enterprise.
Briefly, in 1854 there was a cholera outbreak near Broad Street in London. John Snow, an English physician, plotted each case on a map of the area and noticed that the incidents of cholera occurred primarily near the Broad Street water pump. He requested that authorities remove the pump handle and the epidemic, which had claimed nearly 500 lives, soon ended. Not only did Dr. Snow’s findings save countless people, but by having identified the source Dr. Snow is credited with identifying the method of transmission and prevention of this deadly disease.
The most common way organizations discover an infection is with a call to a help desk. But they might also learn of an infection when a detection tool is updated and discovers malware previously missed. In this case the detection alert is actually an infection alert; the malware has already permeated the network and likely infected a number of devices.
Whichever way you identify malware, once you do it’s critical to quarantine the device to minimize the risk to other devices on the network and then to clean the infected device. But that’s not enough to truly eliminate malware. That would be the same as if Dr. Snow had simply focused on individuals exhibiting symptoms and treated them. Using only that approach he would have been caught in a never-ending cycle of treating patients and may never have found the root cause of the outbreak and stopped the spread of the disease altogether.
Just as Dr. Snow analyzed the data points available to him, in the case of stopping the spread of malware, technologies that use big data analytics to identify ‘patient zero’ (who was infected first), the application that introduced the malware and the files that are causing it to spread enable us to address the infection at the root and avoid re-infection. Identifying the last person infected is equally important as we can define the scope of the infection, assess the risk and understand what it will take to control the outbreak.
In addition to the ‘who,’ understanding ‘how’ the malware permeated the network is also critical to reducing the risk of re-infection. Identifying the use of non-sanctioned software plays an important role in stopping common vehicles for malware. By using blacklists and whitelists to control applications and identify rogue software you can greatly reduce your attack surface. Keeping current with the latest versions of browsers and productivity tools essential to your business’ operations can reduce the number of infections dramatically. In addition, because security has become an exercise in risk management, every IT department should conduct their own risk assessment when evaluating software packages. Certain packages introduce higher risk and may not make sense to deploy in your environment.
Finally, advanced malware protection also requires retrospective security, the ability to retrospectively alert about and protect against files previously classified as safe but subsequently identified as malware. Because today’s advanced malware can disguise itself as safe, pass through defenses unnoticed and later exhibit malicious behavior, this is an important capability to minimize damage after an attack and remediate.
Today’s malware is more damaging and more difficult to defeat than any threats we’ve experienced in the past. By extending protections beyond blocking and detection to include the power of big data analytics, intelligent controls and retrospective security we can stop malware at the source and truly eliminate it.