Zero Second Protection from Check Point

How often is your network at risk?

Every year threats are becoming more sophisticated and more frequent. Relying on signatures to identify malicious traffic entering your network can no longer be your only point of focus.

Recent tests by a team at Check Point has proved that by simply appending data to the end of malware can change the properties of the program, so that it has a new unique signature and no longer identified as the original. This is one of the reasons why there are so many variants of malware signatures. Not only are there many variants, but the entry points into a network have also increased. Most vendors deal with unknown malware by means of a sandbox environment. Virtual machines are spun up with an unknown file or program that can be executed to monitor its file access. Any files that attempt to access restricted areas of the system are deemed malicious and blocked. PDF files for example should not attempt to access any areas of the registry. Check Point’s test focused on 4 of the leading vendor solutions to monitor how well they faired against unknown malware; malware that was known, but simply had its signature changed by modifying the payload. The results were quite unexpected. See the following document: Check Point Zero Second White Paper.