MAKING ATTACKS EXPENSIVE FOR THE ATTACKERS: APT DETECTION WITH WHITELISTING AND LOG MONITORING

No ratings

Presented at Mircon 2014 by

Aaron Beuhring

Kyle Salous

Signature based detection is no longer an effective means of detecting and blocking modern malware. Whitelisting is a far superior way to prevent malicious code from executing. Many organizations already own tools to implement whitelisting, so the only cost is time and effort to properly implement these tools. If implemented correctly, it can vastly reduce an organization's attack surface, allowing defenders to focus on more advanced threats rather than common malware and forcing attackers to utilize expensive exploits to gain remote code execution. Our presentation will show how we have combined application whitelisting and network whitelisting with continuous monitoring to quickly identify potentially malicious activity.