SANS Critical Control 5: Malware Defenses

In this latest installment of this blog series, I am going to analyze how to implement the SANS Critical Control #5: Malware Defenses using Unified VRM.

Enterprises and organizations belonging to any industry and government have been lately particularly victimized by targeted hacking attacks and malware of increasing sophistication. Botnets, trojans and exploit kits are making their round on a weekly basis continuously being updated with the latest 0-day exploits. Anti-virus companies are playing “catch-up” trying to update their products with the latest malware signatures. However, this is a “cat and mouse” game.

Unified VRM is not an anti-malware or a malware detection solution per se. However, appropriately configured through a specially crafted scan template, it can interact with tools that helps in malware detection.

As mentioned in a previous blog post, Unified VRM can interact with the remote agent SLAD installed in target system. SLAD can execute and interact with a series of malware detection and prevention tool, including:

1. It can collect snort IDS logs from the target system, gathering evidence of malware infection. The snort signature are very powerful malware detection tool as they are created by a huge community of intrusion detection engineers.
2. It can interact, run and collect logs from tripwire from the target system. Tripwire is a very powerful tool to perform file and file system integrity checking to detect signs of malware compromises.
3. It can run and collect logs from the open source antivirus CLAMAV installed on the target system. Like Snort, CLAMAV has a huge community of open source developers that write open source malware detection signatures.
4. It can run and collect logs from the open source tool “chkrootkit” installed on the target system. Chkrootkit is a tool used to detect the compromise of the system by most common rootkits and trojans.
5. Unified VRM Internal scan engine has an authenticated vulnerability check that logs into target systems and scans for signs of malware compromise, detecting the most famous malware including Blackhole exploit kit and Zeus trojan.