The dynamic Web is making it much more difficult for run-of-the-mill security technologies to pin down malicious content, as malware authors use the same technology that makes it easy for Web app developers to change Web content on the fly to hide malware on a site.
We recently caught up with Sarit Kozokin, director of product management for Trustwave, for a Q&A about how the dynamic nature of the today's typical Web content and new attack techniques require a shift in the way content security looks for malicious code.
Q: Would you say there are limitations in most of today's content-examining technologies?
A: Yes. The problem with many of the content security options on the market today is that they examine code elements in isolation. They're looking at these elements statically to root out malicious indicators that these elements may be capable of bad stuff. The problem is that the way the bulk of websites work today is that they use technology like PHP, J2EE and ASP.NET to deliver up dynamic Web content based on these elements.
Q: How can new tech overcome these limitations?
A: When code is designed for dynamic attacks, the only way to see through the obfuscation is to examine how the code acts when executed. This means that content security techniques can only be effective if they're examining websites through the lens of some kind of simulation of how the code runs.
This is exactly the principle we've used to design the Malware Entrapment Engine in the Trustwave Secure Web Gateway. It works by using what's called Document Object Model (DOM) analysis. DOM is an application programming interface for HTML and XML documents that defines the logical structure of documents and the way a document is access and manipulated.
Q: What kind of attacks does this thwart?
This is a huge advance in helping organizations detect zero-day attacks, which go after previously unknown vulnerabilities using never-before-seen exploits. Attackers target zero-day vulnerabilities because they know there is necessarily a window of opportunity for them to attack unknown vulnerabilities until security vendors can scramble to put a patch together and add the attack to signatures.
By taking this behavioral, conditions-based approach, the Entrapment Engine offers an effective means of zero-day protection. We've found that it essentially closes the 60 percent malware gap that exists in other content secure Web gateways.
To learn more about the Trustwave Secure Web Gateway Malware Entrapment Engine, check out our latest whitepaper [PDF] that more fully explains how the technology works.