I recently had the opportunity to speak with Gaurav Banga, CEO of Bromium. While at VMworld, VMblog had a chance to catch up with Simon Crosby during a video interview to find out what Bromium was announcing at the time and to find out what the company had been up to. And then two days ago, Tal Klein of Bromium submitted a great set of predictions for 2013.
Given the chance to talk malware and security trends with the CEO of this very interesting company, I jumped at the opportunity. Here is our conversation:
VMblog: Let's jump right in. Why
do you believe malware detection systems are becoming increasingly incapable of
protecting us against IT security breaches?
Gaurav Banga: Businesses have relied on information security technologies
and malware detection mechanisms in order to prevent attackers from penetrating
IT infrastructure and stealing information. All
existing technologies rely on knowing the definition of "bad" a priori in order
to protect. This methodology is implemented in existing security products as
signatures, firewall or blacklist rules, behavioral models for malware, etc. Existing technologies are thus incapable of defending
against modern attacks that exploit operating system and application
vulnerabilities before signatures or updated models can be created and
Detection-based systems detect new malware much too late,
leading to stolen corporate documents, or worse, a compromised corporate infrastructure.
VMblog: And what IT
security threats exist today verses years past?
users rely heavily on the Internet (Cloud) to accomplish their daily
activities. Users are also very mobile, and increasingly "social". Our user
today is very easy to target, because they interact with the world outside the
enterprise so much and in so many ways.
security model that IT has to implement has to go around so many different
types of programs & content that the user uses, often without wanting IT to
know- in a personal context, and often in a context where IT can exercise no
control without locking down the user.
take advantage of users who exchange information with other users through email
and the web, and try to uses applications on the Internet. In straightforward
ways, an attacker can design his malware to bypass even state of the art
detection systems and trick the user into letting him in. The more personal
information available on the Internet, the easier it is to target users.
malware detection tools are becoming a thing of the past, what are your
thoughts on the security trends of the future?
Banga: Since every existing security technology
relies on the detection of threats, they are incapable of blocking attacks that
have never been seen before. It is
important to remember that next-generation malware is persistent, utilizing
organizational data available on social networking sites and elsewhere on the
Internet to create these highly targeted attacks aimed at users who are easily
reachable through web and email. With that in mind, we must be forward thinking
design our security strategy with the assumption that the bad guy will get in.
That single assumption will start most
organizations along a completely different path than they are today. We need to
think in terms of hard isolation of the different compute contexts for the
enterprise and for users, and implement effective isolation between those
contexts in a way that makes sense and is highly usable.
do advanced persistent threats measure up against spear phishing attacks and
other threats against the enterprise?
Banga: Advanced persistent threats are much more devious
than any other type of threat because they target the user in order to
compromise the enterprise. APTs prey on unsuspecting users by appearing as
legitimate websites, emails and documents that trick those users into letting the
attack in and escalating privilege, thus compromising the corporate desktop. This
is then used as a launch pad to attack and compromise the enterprise infrastructure
and information. As more and more of our
personal information becomes available on the Internet, the easier it is to
target users individually with a higher likelihood that they will click the bad
link or open the poisoned attachment. Who among us wouldn't open an attachment or
follow a web link that appears to be from our manager, or trusted collaborator?
Once in, an APT can stealthily propagate
through the enterprise, can access enterprise information, and stay hidden for
a long time by continuously transforming itself. APTs are also increasingly aware of the
various nuances of enterprise user behavior - such as the fact that there is very
likely no hard outbound firewall active when a user is at home, and use such methods
to exfiltrate enterprise information without being discovered. A typical APT infection can go undetected for
100s of days, and the cost of the breach to the enterprise nearly impossible to
there one way to protect against the increasing number of security attacks
penetrating enterprises today?
Banga: We will always have to continue evolving
security solutions - our adversary will continue to evolve their attacks and
exploit vulnerabilities we didn't know we had. That is why Bromium has taken a vastly
different approach to advanced persistent threats than other security
We use hardware-enforced isolation to
contain and discard threats, even undetectable attacks without disrupting the
user, therefore defeating and automatically defeating malware. Our product,
vSentry, is built on our security-focused Microvisor that automatically,
instantly and invisibly hardware-isolates each vulnerable Windows task in a
micro-VM. This stops all attacks from gaining access to the endpoint, enterprise
data or network infrastructure.
else can we expect to see coming from Bromium?
Banga: Currently vSentry runs on Windows 7
and comes with core management support for deployment within the typical
enterprise. Expect to see greater platform support in the very near future. We
are also adding enhanced intelligence and capabilities into our LAVA micro-VM
introspection feature-set which will allow security teams to dissect the "long
tail" and intent of an attack by allowing it to run into its logical conclusion
without risk to the corporate information or infrastructure.
Once again, I'd like to thank Gaurav Banga, CEO of Bromium, for taking time out to speak with VMblog.