The new age of protection

摘要

In the first decade of this millennium, we were dealing with simple worms, viruses, trojans and botnets. Basic reactive protection tools - like firewalls and anti-virus - were effective then, although falling gradually behind, buried by the volume of daily threats. Nowadays we see different malware. Threats are modular, persistent and armored. We have nation-state attacks on the rise and commercial companies, like Hacking Team, weaponizing exploits and creating military-grade spying tools. The game has changed. In the early days, enforcement prioritized over intelligence and most customers wanted automatic blocking. Detection relied on hash sums or signatures, so it was low on false positives and safer to block anything outright. The changing attack landscape inverted the protection triangle, so now companies are looking at intelligence to help manage most of the security risks, and blocking to deal with a small portion of well-defined incidents.