Staying under the radar

The following article by the Register caught my attention: "NHS computers hit by voracious, data-stealing worm"

The interesting thing is that Qakbot is a known malware, well-documented by Symantec. Therefore, COTS Anti-Virus product should catch it, right?

As described on the Register, Qakbot spreads through Web pages that install malware by exploiting patched vulnerabilities in Microsoft’s Internet Explorer and Apple’s QuickTime software. It is able to self-propagate on local networks through file shares. It "moves slowly and with caution, trying not to bring attention to its presence" it is staying under the radar!

For some reason, the National Health Service (NHS) network was hit by a malware which has been known since May 2009… Could it be another sign that COTS cyber security products can be circumvented by advanced malware?

For me, this is just another confirmation that COTS security must be complemented by additional layers of custom-built cyber defense.

Jerome

COTS not enough for government cyber security

I just read this interesting article by Nextgov, confirming that relying only on commercial products can increase vulnerabilities to cyber attacks: http://www.nextgov.com/nextgov/ng_20090618_3505.php. This is in line with my recent discussions with governments who use Qosmos technology to enhance their cyber security beyond COTS capabilities. Not only could COTS products contain hidden code; they often lack capabilities required by government security specialists for detecting certain threat patterns and/or they lack the flexibility to customize according to special government security policies.

Jerome