Future Defenses: Technologies to Stop the Unknown Attack
Source: SecurityFocus
Current anti-virus software, combined with sensible filtering (such as quarantining all executable content from e-mail and Web traffic), firewalling, and religiously maintaining patches, serves as a reasonably good defense against the current classes of virus, worms, and script kiddies. This malware includes conventional file infectors, mail worms, people running attack scripts, and active worms based on old security holes. Unfortunately these techniques are not sufficient to stop a speed-optimized active worm based on a previously undiscovered security hole.
In order to prevent highly damaging “superworms” or hackers using unknown or unpatched exploits, different solutions are needed that are designed to prevent and respond to unknown attacks, rather than known attacks. These techniques need to be automated (as human responses are too slow to prevent damage), implementable, widely deployable, and must require no application changes. This article examines three technologies that offer significant levels of protection against unknown attacks: software fault isolation, intrusion detection through program analysis, and fine-grained mandated access controls.
