New SentinelOne Enterprise Risk Index Provides Evidence of Growing Use of In-Memory Attacks; Renders Traditional Antivirus Protection Methods Redundant
Data analysis shows attackers continuing to shift away from file-based attack techniques
PALO ALTO, Calif.—April 27, 2017—SentinelOne, the company transforming endpoint protection by delivering unified, multi-layer protection driven by machine learning and intelligent automation, today launched its first Enterprise Risk Index which highlights the growing use of in-memory attacks, further proof that attacks simply cannot be stopped by traditional, static, file inspection security solutions.
The report includes an analysis of filtered data from more than one million SentinelOne Enterprise Platform agents deployed worldwide during the last half of 2016. Findings are based on behavioral analysis of malware programs that bypassed firewalls and network controls to infect endpoint devices.
“These days, infecting a target is just a matter of resources; but how long the hackers get to stay inside the network is a matter of good detection,” said Andy Norton, EMEA risk officer for SentinelOne and lead researcher for the Enterprise Risk Index. “In our analysis we focused on the attacks that are successful in making their way past traditional defenses to reach endpoint targets because these are the threats that pose the greatest risk to an organization. That’s what we should be measuring – not what’s stopped at the gateway.”
The report focuses on attack methods classified into three risk categories:
- Attacks detected from document-based files, largely associated with Microsoft Word or Adobe PDF.
- Attacks detected from traditional portable executable-based files.
- Attacks detected only from the memory of the system with no associated new artifacts on the system.
From the report, “we won’t be announcing what the top malware family is – for example, Zeus, Diamond Fox or Upatre – however, we do build indicators of compromise to help with identification and response, and when a hash value exists we have submitted the hash to malware repositories to see what other submissions there have been for them.”
Key findings of the report include:
- The growing menace of in-memory attacks: in this timeframe, we found that these attacks have doubled in comparison to the infection rates of file based vectors.
- Even for file-based attacks, only 20 percent of threats had corresponding signatures from existing AV engines.
- Nation-state actors are trading infection sustainability for stealth, leaving no new artifacts on the file system and relying on memory-based attacks, even if it means needing to re-infect the target.
- Three-pronged infections are becoming the norm as attackers no longer rely solely on .exe files to deliver malware, but instead use hybrid attacks that multiple attack vectors can utilize in one attack chain.
“Our goal with the Enterprise Risk Index is to help organizations get a better view of which threats are successful in reaching the final barrier in enterprise defenses,” said Norton. “With this data in mind, customers can better determine not only what the risks are but where they are and can adjust their security planning and investments accordingly.”
A copy of the full SentinelOne Enterprise Risk Index is available for download here.
About SentinelOne
SentinelOne is shaping the future of endpoint security with an integrated platform that unifies the detection, prevention and remediation of threats initiated by nation states, terrorists, and organized crime. SentinelOne’s unique approach is based on deep inspection of all system processes combined with innovative machine learning to quickly isolate malicious behaviors, protecting devices against advanced, targeted threats in real time. SentinelOne was formed by an elite team of cyber security and defense experts from IBM, Intel, Check Point Software Technologies, McAfee, Palo Alto Networks and the Israel Defense Forces. To learn more visit sentinelone.com or follow us at @SentinelSec.
Contact:
Megan Grasty
Highwire PR for SentinelOne
Ph: 1.415.963.41.74 ext. 26
Email: [email protected]