Lastline Study Finds Significant Gaps in Security Analysts’ Knowledge of Malware

LONDON, July 14, 2017 -- Lastline, Inc., the leader in advanced malware protection, today announced the results of a survey conducted with 326 cyber security professionals that tested their knowledge of malware and current cyberthreats.

Respondents were asked to identify different malware behaviors. The overwhelming majority were aware that malware can turn a webcam on to see if anyone is sitting in front of the computer (98 percent) and can monitor a keyboard to see if a user is typing (97 percent), both of which are among the many techniques malware uses to evade detection. However, only 70 percent knew that malware is able to avoid being detected by a sandbox.

“Malware has been able to sniff out that it resides on a virtual machine (used as a sandbox) for years now, so it is a little worrying that nearly a third of cybersecurity professionals were unaware of this,” explained Brian Laing, VP at Lastline. “Malware often plays a game of deception, pretending to be a perfectly benign program when analyzed by a defensive tool. Once it is past defenses, it can then perform the malicious activities it was programmed for when running on a user's device.”

Respondents were also asked to identify the behaviors of specific types of malware. While 93 percent correctly identified a Trojan as malware disguised as something that a user wants or something legitimate, over three quarters (77 percent) agreed with the statement that a virus actively seeks new computers to infect, which is actually the behavior of a worm. And half indicated that a rootkit creates a network of compromised devices for use in a coordinated attack, which actually is what a botnet does.

Laing argued that this level of knowledge can be crucial in incident response strategies. “When deciding how to prioritize security strategies and technology investments, it’s important to know what types of behaviors a given piece of malware has and how they behave. For example, when reading that WannaCry is a worm, it’s important to know what a worm is and how it spreads so that you know, for example, that cleaning the initially infected machine will not eradicate it from the network,” he said.

Respondents were also given a list of names and asked to identify which ones were strains of malware. Respondents correctly identified the real strains of malware on average 28 percent of the time, with the best results attributed to the widespread malware, Slammer (40 percent) and SpyEye (37 percent).

“Given the level of media attention that some malware discoveries get, it is interesting that the majority of respondents couldn’t identify them, but not surprising. It just doesn’t matter when you’re fighting cybercrime today,” said Laing. “Given the volume of malware, the pace at which it evolves, and how criminals borrow from each other and re-write the code, there are not clear distinctions or naming connections between one attack and a subsequent attack using what may largely be the same code. What’s important is detecting it, by whatever name, and understanding its behaviors so you can mitigate and remediate.”

Regardless of the malware used, its behavior, or its ability to evade detection, malware clearly causes significant pain to security professionals, as highlighted by the final result. The survey found that 44 percent of security professionals would rather have root canal surgery than make the dreaded walk of shame to the boardroom to explain that they’ve suffered a data breach. This statistic reinforces the severity with which all organizations treat the prospect of a data breach.

Lastline Enterprise is widely acknowledged as the industry’s most effective advanced malware protection solution as evaluated by third-party testing agencies, regardless of the malware or attack scheme. NSS Labs’ 2016 Breach Detection Systems Test recognized Lastline as the only breach detection offering they have ever tested to achieve 100 percent detection effectiveness with zero false positives. And the 2016 Forrester Wave report recognized Lastline as providing the strongest automated malware analysis solution in the market.

Notes to editor: The survey of 326 information security professionals was conducted at Infosecurity Europe 2017 conference that took place June 6-8, 2017, at the Olympia Conference Centre in London. The full results are available upon request.

About Lastline
Lastline provides advanced malware protection that is innovating the way companies protect themselves against advanced persistent threats, targeted attacks, and evasive malware. Lastline provides the threat visibility and context needed to respond quickly and effectively to malicious activity before damaging and costly data breaches occur. Headquartered in Redwood City, California with offices throughout North America, Europe and Asia, Lastline’s platform is used by Global 5000 enterprises, offered directly and through global managed security service providers, and integrated into the solutions of leading security technology vendors worldwide. www.lastline.com, or follow @lastlineinc on Twitter.

Media contact: 
Noe Sacoco for Lastline
(408) 340-8130
[email protected]