Trustwave SpiderLabs Uncovers Critical Cybersecurity Vulnerabilities Exposing Manufacturers to Costly Attacks. Learn More

Trustwave SpiderLabs Uncovers Critical Cybersecurity Vulnerabilities Exposing Manufacturers to Costly Attacks. Learn More

Managed Detection & Response

Eradicate cyberthreats with world-class intel and expertise

Managed Security Services

Expand your team’s capabilities and strengthen your security posture

Consulting & Professional Services

Tap into our global team of tenured cybersecurity specialists

Penetration Testing

Subscription- or project-based testing, delivered by global experts

Database Security

Get ahead of database risk, protect data and exceed compliance requirements

Email Security & Management

Catch email threats others miss with layered security & maximum control

Co-Managed SOC (SIEM)

Eliminate alert fatigue, focus your SecOps team, stop threats fast, and reduce cyber risk

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
The Trustwave Approach
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Platform
SpiderLabs Fusion Center
Security Operations Centers
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Q&A: How Content Security Must Adapt To the Dynamic Web

The dynamic Web is making it much more difficult for run-of-the-mill security technologies to pin down malicious content, as malware authors use the same technology that makes it easy for Web app developers to change Web content on the fly to hide malware on a site.

We recently caught up with Sarit Kozokin, director of product management for Trustwave, for a Q&A about how the dynamic nature of the today's typical Web content and new attack techniques require a shift in the way content security looks for malicious code.

Q: Would you say there are limitations in most of today's content-examining technologies?

A: Yes. The problem with many of the content security options on the market today is that they examine code elements in isolation. They're looking at these elements statically to root out malicious indicators that these elements may be capable of bad stuff. The problem is that the way the bulk of websites work today is that they use technology like PHP, J2EE and ASP.NET to deliver up dynamic Web content  based on these elements.

Certain elements of code and content only come into play if specific variables or conditions are met. Otherwise they just don't execute or display. This offers Web site developers a ton of flexibility, but it also presents the perfect way for malicious hackers to hide evidence of what's lurking on a site. They essentially use HTML elements to hide executable JavaScript elements.  That way all the pieces that make up an attack that is built dynamically once conditions are just right seem safe at rest. It's only when the code is put together for execution that the real intent is revealed. The code doesn't become malicious until all of the pieces across the site are put together and executed.

Q: How can new tech overcome these limitations?

A: When code is designed for dynamic attacks, the only way to see through the obfuscation is to examine how the code acts when executed. This means that content security techniques can only be effective if they're examining websites through the lens of some kind of simulation of how the code runs.

This is exactly the principle we've used to design the Malware Entrapment Engine in the Trustwave Secure Web Gateway. It works by using what's called Document Object Model (DOM) analysis. DOM is an application programming interface for HTML and XML documents that defines the logical structure of documents and the way a document is access and manipulated.

The motivation of the new design of our Entrapment Engine is the understanding that our gateway couldn't just be examining content statically a piece at a time. We recognized that in order to be effective, content security must be able to inspect a webpage holistically, looking at all of the embedded objects or resources like JavaScript or CSS files so it can detect dynamic capabilities and understand the real intent of how the code is supposed to execute.

Q: What kind of attacks does this thwart?

A: The beauty of the Entrapment Engine is that it doesn't just look for exploits from a set signature of potential attacks. It takes a bigger picture view, identifying conditions that would result in exploitation. The technology is keyed into the code's potential malicious behavior. This kind of inspection can be made across all potential vectors of attack, including HTML, JavaScript, VBScript and PDF.

This is a huge advance in helping organizations detect zero-day attacks, which go after previously unknown vulnerabilities using never-before-seen exploits. Attackers target zero-day vulnerabilities because they know there is necessarily a window of opportunity for them to attack unknown vulnerabilities until security vendors can scramble to put a patch together and add the attack to signatures.

By taking this behavioral, conditions-based approach, the Entrapment Engine offers an effective means of zero-day protection. We've found that it essentially closes the 60 percent malware gap that exists in other content secure Web gateways.

To learn more about the Trustwave Secure Web Gateway Malware Entrapment Engine, check out our latest whitepaper [PDF] that more fully explains how the technology works.

Latest Trustwave Blogs

Unlock the Power of Your SIEM with Co-Managed SOC

Security information and event management (SIEM) systems play a pivotal role in cybersecurity: they offer a unified solution for gathering and assessing alerts from a plethora of security tools,...

Read More

Trustwave SpiderLabs: LockBit 3.0 Ransomware Most Common Malware Used to Attack the Manufacturing Sector

As the manufacturing sector continues its digital transformation, Operational Technology (OT), Industrial Control Systems (ICS), and Supervisory Control and Data Acquisition (SCADA) are becoming...

Read More

Trustwave’s Observations on the Recent Cyberattack on Aliquippa Water Treatment Plant

The attack last week on the Municipal Water Authority in Aliquippa, Penn., that gave threat actors access to a portion of the facility’s pumping equipment has spurred the Cybersecurity &...

Read More