Threat prevalence: your breach will have to wait

The economics governing security vendors’ priorities do not bode well for victims of targeted attacks.

Recently, I blogged [1] my impressions following a security conference that was hosted by a major vendor, with many of our security vendor peers in attendance. In this article I expand on one of my main takeaways from that event: how the actions of mass malware purveyors targeting consumers provide cover to hackers engaging in targeted attacks. By being the needle in the haystack, state-sponsored and other hacking groups can successfully and regularly launch targeted attacks [2] because of what amounts to an economic, as much as a technical failure by security vendors [3].

Targeted attacks weren’t part of the discussion at the conference per se. What was discussed was the overall threat landscape we are dealing with. The dominant feature of that landscape is the sheer number of unique malicious binaries. Vendors are typically dealing with 100,000 or more [4] unique malware binaries each day, with some quoting 150,000 or even up to 250,000 daily samples received. Of course, the vast majority of these binaries are minor variations of existing malware, mostly polymorphic variants.

Yet even longstanding and widely propagated malware families can avoid signature detection, at least for a short time, through minor mutations [5]. Whether a vendor has the capacity to write a couple of dozen new signatures daily or several hundred, the vendor has no choice but to prioritize resources towards ensuring that their signature library does at least keep up with existing malware families.

Of course, this prioritization on prevalence makes sense in plain economic terms. Any major vendor with a broad customer base will focus on the threats that are a risk to the largest parts of its customer base. If that vendor has a large consumer base, then the bottom of the pyramid – the broadest section of their user base – can be huge indeed and may dwarf the user base of enterprise customers.

But if you are responsible for security at a large enterprise, and find yourself on the receiving end of targeted, custom attacks, where does the response to the custom malware you uncovered fit on your vendor’s priority list? You are by definition way down the far right end of the long tail [6]. This is where the failure of signatures becomes economic, rather than technical.

Under normal circumstances, a vendor may take anywhere from many hours to several days before publishing a signature for a new threat sample with no or few detections. For a custom threat, the only option for an enterprise may be (if supported by the vendor) to create a blocklist of hashes for all the samples they discover – back to the future, as it were, for threat detection, with all its attendant limitations.

Even a very large enterprise with hundreds of thousands of desktops and a corresponding IT security budget will not have the economic heft on its own to change the priorities for a vendor that measures its installed base in tens of millions of consumers and hundreds of thousands of small businesses.

The takeaway for those dealing with targeted attacks is caveat emptor. No matter how well intentioned the security vendor, if you are at the far end of the long tail, your vendor’s priorities are not the same as yours.

Latest articles:

Bulletin Archive