Powered By InformationWeek Business Technology Network
 
Welcome Guest. | Log In| Register | Membership Benefits
  • Email this page E-mail this page
  • |  Print Print this page
  • |   Bookmark and Share

ScanSafe Releases Quarterly Global Threat Report

Research shows 88% of signature-based scanners missed Gumblar attacks

Aug 13, 2009 | 06:45 PM

LONDON and SAN FRANCISCO — August 13, 2009 — In its quarterly Global Threat Report issued today, ScanSafe, the pioneer and leading provider of SaaS Web Security, reported that at its highest peak in the second quarter of 2009, 88% of ScanSafe malware blocks were zero day threats, meaning that the vast majority of the attacks were not detected by signature based scanners. The single largest contributor to the high rate of signature misses were the result of the second stage Gumblar attacks.

The overall rate of zero day Web malware in 2Q09 was 32% " nearly one in three Web malware encounters which were blocked via ScanSafe Outbreak Intelligence zero day threat protection. Companies relying on signature-based scanners alone would have been extremely vulnerable, given that signatures for Gumblar-compromised sites were not generally available until three weeks after the largest peak of Gumblar website compromises.

ScanSafe noted that the rate of Web-delivered malware increased sharply in the second quarter of 2009 " a staggering 36% from 1Q09. This was also due in large part to Gumblar, the most sophisticated mass compromise seen this year. 2008 was the largest year on record for Web-delivered malware, with a massive 300% increase from 2007. By all accounts, 2009 is on track to double that number. "The fact that the most serious threat of the year was not detectable by most standard antivirus signatures should serve as yet another wake up call to the security community," said Mary Landesman, senior security researcher at ScanSafe. "The evasiveness and sophistication of the Gumblar threat has set quite a precedent for threats to come. Companies need to be prepared with a comprehensive Web security solution " specifically, a solution that adequately protects against the increasing rate of zero day threats." Worryingly, the second quarter of 2009 also demonstrated a sharp increase in data theft trojans. The rate of encounters with data theft trojans increased 37% in 2Q09. The most prevalent of these encounters were with Backdoor trojans, which can lead to data theft, registry manipulation and full control of files on an infected system, among other things. "It is alarming that the prevalence of data theft trojans has increased so significantly this quarter, but not surprising," said Landesman. "Stolen data is in high demand and in this economy cyber criminals are motivated to develop increasingly sophisticated tactics to obtain it."

To obtain a full copy of the latest ScanSafe Global Threat Report, please visit www.scansafe.com.

About ScanSafe ScanSafe is the pioneer and largest global provider of SaaS Web Security, ensuring a safe and productive Internet environment for businesses. ScanSafe solutions keep malware off corporate networks and allow businesses to control and secure the use of the Web. As a SaaS solution, ScanSafe eliminates the burden of purchasing and maintaining infrastructure in-house, significantly lowering the total cost of ownership.

Powered by its proactive, multilayered Outbreak Intelligence threat detection technology, ScanSafe processes more than 20 billion Web requests and 200 million blocks each month for customers in over 100 countries.

In 2009, the company was awarded "Best Content Security" solution by SC Magazine Europe for the third consecutive year.


Subscribe to RSS



Database Security Reports

report Beyond the Database: Protecting Unstructured Data
Corporate databases may be the crown jewels, but unstructured data stores contain plenty of diamonds in the rough. Organizations can be burned by an exposed spreadsheet of credit card numbers, an e-mail with patient information or a file share containing reports on a pharmaceutical company's new wonder drug. In this Dark Reading Tech Center report, we show how to classify, find and protect unstructured data across the enterprise.

report Protecting Databases from Web Applications
Most external hacks of databases occur because of flaws in Web applications that link to those databases. Yet, enterprises are increasingly exposing their most valuable data to these outward-facing interfaces. In this Dark Reading Tech Center report, we'll discuss how security teams, database administrators and application developers can work together to improve the defenses of both front-end Web applications and back-end databases to prevent these attacks from succeeding, and offer a look at the most frequent Web-borne database attacks.

report Database Activity Monitoring: Emerging Technology Keeps Tabs on Assets
You can read about the consequences of not protecting critical data in the daily headlines. In response, security-conscious organizations are tackling the complexities involved in effectively monitoring their databases for potential leaks and compromises. Fortunately, an emerging class of software is stepping up to help. Here’s what enterprises need to know about selecting, deploying, and managing DAM technology.

Other reports from the Database Security Tech Center:

Related Content

HOWTO Secure and Audit Oracle 10g and 11g
Read the "Hardening Your Database" chapter from the 454-page book "HOWTO Secure and Audit Oracle 10g and 11g" and learn how to navigate the many security options within Oracle (authored by database security expert and Guardium CTO, Ron Ben Natan, Ph.D.)

HOWTO Monitor Database Activity
Read the "Database Activity Monitoring (DAM)" chapter from "HOWTO Secure and Audit Oracle 10g and 11g" (CRC Press, 2009) and learn how to leverage DAM to prevent cyberattacks, monitor privileged users and track access to sensitive data.

8 Steps to Holistic Database Security
Get the 8 essential best practices for a holistic approach to both safeguarding databases and achieving compliance with key regulations such as SOX, PCI-DSS, NIST 800-53 and data protection laws.

Essential Steps to Implementing Database Security and Auditing
Learn best practices and specific tips for effectively securing Oracle, SQL Server, DB2, MySQL and Sybase environments, including tracking security vulnerabilities, the anatomy of buffer overflow vulnerabilities and database auditing.

Databases at Risk: Current State of Database Security (ESG Research)
This recently published ESG report analyzes the current state of database security -- concluding it depends upon too many manual processes -- and also offers concrete steps to improve database security across the enterprise.