Back to the future - a new reality in IT security
Play
The ability to travel back in time has captured the imaginations of generations around the world for hundreds of years.
One of the more universally recognised examples is the “Back to the Future” film trilogy, which grossed nearly US$1 billion (Bt31 billion) in theatres worldwide.
Being able to go back to a previous time, observe what happened and then learn from those events to improve the present and future is a powerful notion.
Wouldn’t it be great to be able to actually do that as an IT security professional? Think about it.
Traditional detection-only defences are stuck in the present. They conduct inspection at a single, initial point in time and they have no memory. They allow through anything they don’t recognise immediately as a threat, and forget that the file ever existed.
Capitalising on this limitation, advanced malware writers continuously innovate, use a variety of techniques to obscure malware and make it much harder to initially detect.
To detect, understand and stop these increasingly evasive threats, you need new tools and techniques that enable you to always watch, never forget – and then take action should a file be determined to be malicious at a later time.
In effect, you need to be able to turn back time.
Technology has advanced to make this possible, and I’m not talking about the flux capacitor. I’m talking about big data-powered continuous capability and retrospective security.
Big data adds ‘memory’ to security. The widespread availability of affordable storage capacity and processing power, along with sophisticated data-mining techniques, means we no longer have to discard files that aren’t recognised as threats upon initial inspection.
Retrospective security uses this continuous capability to let you, in essence, travel back in time and retrospectively identify which devices have been exposed to malware. Delving into the rich history that big data provides you can also identify the point of entry and prevent reinfection, automatically.
Travelling back in time isn’t something to relinquish to science fiction. Just as advancements in other fields – cloning, space travel and bionics – have made seemingly far-fetched ideas reality, big-data analytics is making time travel a reality in security.
Now you can learn instantly from the past and come back to create a more secure present and future.
Suwitcha Musijaral is security engineer at Sourcefire (Thailand).
