Security company Damballa reported that about 3 to 5 percent of all systems in an enterprise network are infected with bot-related malware — even within organizations running up-to-date anti-malware tools.
Damballa protects businesses from targeted attacks used for organized, online crime. Their global approach rapidly isolates the command-and-control needed to launch multi-network attacks.
Antivirus software discovered only 53 percent of malware samples, according to data gathered by Damballa in a six-month case-study that used McAfee Scan Engine v5.3.00 to scan more than 200,000 malware samples. Another 32 percent were found later on, and 15 percent were not detected at all. The average delay in detection and remediation was 54 days.
“The window of catch-up is 54 days…that’s a long delay,” says Bill Guerry, vice president of product management for Damballa. “So if you’re relying on AV, it’s able to detect a little over half of malware immediately.”
Damballa stated that the malware gap with today’s antivirus products is a contributing factor to the enterprise bot problem. “One of our clients said it’s not unusual for them to see 100 new [botnet] compromises in a day [in its environment],” Guerry says.
In connection with its study, Damballa also rolled out its first hardware product, the Failsafe 3.0 security hardware appliance, which detects targeted, bot-driven attacks. Damballa traditionally has offered a “cloud” or software as a service approach to bot detection and protection services, focusing on botnet command and control infrastructure to detect malicious activity within an organization.
Failsafe 3.0 includes a management console and will ship this month, with pricing starting at $100,000 for 10,000 nodes. It’s aimed at organizations that prefer to keep their botnet-detection “locally in the cloud,” Guerry says. “This is sensitive information to these clients,” he says.
Damballa has also invested in building a prototype, host-based botnet-remediation tool that it hopes to release this year. The so-called Remediator will let organizations handle remediation on a host-by-host basis. “It’s not an AV agent running all the time…you can load and remove it,” Guerry says.
Steve Linowes, CEO at Damballa, says the goal of Remediator is not to replace AV tools, but to assist the help desk. “Companies we work with have defined processes in place already to handle incidents like this,” he says. “They have help desk support and processes for remediating their compromised assets. Our desire is to fit into those processes they have in place.”
{ATOMICSUB}
Total Members: 14197
Topic: New Study: Antivirus Software Misses 15% of Malware (Read 3464 times)
