The new product 'stares' at a piece of malware until it makes a move

Nov 16, 2011 15:39 GMT  ·  By
Damballa Failsafe 5.0 is designed to protect devices against zero-day threats
   Damballa Failsafe 5.0 is designed to protect devices against zero-day threats

Damballa released the latest variant of their Failsafe security solution which now encapsulates even more enhanced detection mechanisms. By observing network behavior, the new software is capable of detecting if a rogue application is communicating with the outside.

PCs, Macs, servers and even portable devices can benefit from the protection suit which is permanently on the lookout for unidentified threats with the help of advanced monitoring mechanisms.

“Damballa Failsafe has never failed to detect unknown threats and hidden infections in corporate networks. Our ability to correlate multiple behavioral indicators to rapidly and accurately pinpoint hidden infections is unequaled in the market,” said Stephen Newman, vice president of product management for Damballa.

“We now offer real-time malware analysis as additional forensic evidence that contributes to the threat conviction scores for threats identified on infected devices.”

Modern malware incorporates means of evading detection mechanisms, a thing highly taken into consideration by the developers of Failsafe 5.0. This is why the latest version of Failsafe relies on the fact that even if the communication between the cybercriminal and the infected device tries to take a legitimate form, close monitoring can quickly identify if something is amiss.

The new product is aware of the fact that modern malicious elements will not execute without internet access and that they will not jump into action if sandboxes or virtual machines are detected. This is why Failsafe is programed to stare at suspicious components until they make a move.

By being cloud-based, Failsafe will not require any hardware or software improvements, the maintenance process being fast and easy.

“There are products available today that analyze ‘malware in motion,’ but they do so by analyzing the malware in a sandbox within the customer’s network,” Newman added.

“There are obvious limitations inherent with running captured malware samples live within a targeted organization. Damballa Failsafe overcomes these limitations by performing the malware analysis in the cloud, outside of the targeted company’s network.”