Palo Alto Networks has positioned its WildFire platform to resolve this issue, by providing what Williamson calls a “classify everything” view of all data coming into and going out of the network.
Other common signature behaviours of malware include visits to an unregistered domain (24.38% of cases), the sending of emails (20.46%), contacting an IP country different from the host top-level domain (6.92%), downloading a file with an incorrect file extension (4.53%), visiting a recently registered domain (1.87%), and more.
“”You can always create an exception if you need to, but you can also set a rule that says ‘if I see an HTTP post to new domains, that is something worth investigating’.
This confidence, says Palo Alto Networks’ ANZ country manager Armando Dacal, often translates into a better business-IT alignment because the security team can ensure the business will be protected through highly-granular control over applications and user behavior. Such control will pave the way for higher business and IT confidence around the influx of smartphones and tablets as companies, many grudgingly, give in to the realities of bring your own device (BYOD) policies.
“But users wanted to leverage the power in the devices – and now IT can have a discussion with the business around which users should have access to which applications, and how it can be done safely.” “We’re dealing with creative [malware authors],” Williamson says, “and we’re in a world where we’re going to have to be looking at what’s coming in – and be engaged, creatively, about what’s going on.