Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Q&A: How Content Security Must Adapt To the Dynamic Web

The dynamic Web is making it much more difficult for run-of-the-mill security technologies to pin down malicious content, as malware authors use the same technology that makes it easy for Web app developers to change Web content on the fly to hide malware on a site.

We recently caught up with Sarit Kozokin, director of product management for Trustwave, for a Q&A about how the dynamic nature of the today's typical Web content and new attack techniques require a shift in the way content security looks for malicious code.

Q: Would you say there are limitations in most of today's content-examining technologies?

A: Yes. The problem with many of the content security options on the market today is that they examine code elements in isolation. They're looking at these elements statically to root out malicious indicators that these elements may be capable of bad stuff. The problem is that the way the bulk of websites work today is that they use technology like PHP, J2EE and ASP.NET to deliver up dynamic Web content  based on these elements.

Certain elements of code and content only come into play if specific variables or conditions are met. Otherwise they just don't execute or display. This offers Web site developers a ton of flexibility, but it also presents the perfect way for malicious hackers to hide evidence of what's lurking on a site. They essentially use HTML elements to hide executable JavaScript elements.  That way all the pieces that make up an attack that is built dynamically once conditions are just right seem safe at rest. It's only when the code is put together for execution that the real intent is revealed. The code doesn't become malicious until all of the pieces across the site are put together and executed.

Q: How can new tech overcome these limitations?

A: When code is designed for dynamic attacks, the only way to see through the obfuscation is to examine how the code acts when executed. This means that content security techniques can only be effective if they're examining websites through the lens of some kind of simulation of how the code runs.

This is exactly the principle we've used to design the Malware Entrapment Engine in the Trustwave Secure Web Gateway. It works by using what's called Document Object Model (DOM) analysis. DOM is an application programming interface for HTML and XML documents that defines the logical structure of documents and the way a document is access and manipulated.

The motivation of the new design of our Entrapment Engine is the understanding that our gateway couldn't just be examining content statically a piece at a time. We recognized that in order to be effective, content security must be able to inspect a webpage holistically, looking at all of the embedded objects or resources like JavaScript or CSS files so it can detect dynamic capabilities and understand the real intent of how the code is supposed to execute.

Q: What kind of attacks does this thwart?

A: The beauty of the Entrapment Engine is that it doesn't just look for exploits from a set signature of potential attacks. It takes a bigger picture view, identifying conditions that would result in exploitation. The technology is keyed into the code's potential malicious behavior. This kind of inspection can be made across all potential vectors of attack, including HTML, JavaScript, VBScript and PDF.

This is a huge advance in helping organizations detect zero-day attacks, which go after previously unknown vulnerabilities using never-before-seen exploits. Attackers target zero-day vulnerabilities because they know there is necessarily a window of opportunity for them to attack unknown vulnerabilities until security vendors can scramble to put a patch together and add the attack to signatures.

By taking this behavioral, conditions-based approach, the Entrapment Engine offers an effective means of zero-day protection. We've found that it essentially closes the 60 percent malware gap that exists in other content secure Web gateways.

To learn more about the Trustwave Secure Web Gateway Malware Entrapment Engine, check out our latest whitepaper [PDF] that more fully explains how the technology works.

Latest Trustwave Blogs

Why Vulnerability Scanning is an Offensive Security Program’s Secret Weapon

Knowing what you don’t know is the key to keeping an organization safe and the best method of doing so is with an offensive security approach that includes vulnerability scanning. By being proactive...

Read More

Upcoming Trustwave Webinar: Maximizing the Value of Microsoft E5

Many organizations license Microsoft 365 E5 to obtain its productivity features, which makes perfect sense because that is what the tool is known for. However, E5 also shines in the security realm...

Read More

Comparably Honors Trustwave with Leadership and Career Growth Awards

Comparably, the leading workplace culture and compensation monitoring employee review platform has recognized Trustwave with two major awards: 2024 Best Companies for Career Growth and 2024 Best...

Read More