Issue link: https://insights.oneneck.com/i/1458399
54 Data Center & Hybrid Cloud Security For Dummies, Palo Alto Networks Special Edition These materials are © 2020 John Wiley & Sons, Inc. Any dissemination, distribution, or unauthorized use is strictly prohibited. Although patching is a critical part of a sound endpoint protection strategy, it protects an organization's endpoints only after vulnera- bilities are discovered and patched. Delays of days, weeks, or lon- ger are inevitable as patches for newly discovered vulnerabilities must be developed, distributed, tested, and deployed. Much like signature-based malware detection, patch management is an end- less race against time that offers no protection against zero-day exploits. Vulnerability exploits, however, are the primary reason patches are needed. Many advanced threats work by placing malicious code (exploits) in seemingly innocuous data files. When these files are opened, the exploit leverages unpatched vulnerabilities in the native appli- cation used to view the file, and the code executes. Because the application being exploited is allowed by IT security policy, this type of attack bypasses application whitelisting controls. Although many thousands of exploits exist, they all rely on a rela- tively small set of core techniques that don't frequently change. Regardless of the exploit or its complexity, for an attack to succeed, the attacker must execute a series of these core exploit techniques in sequence, like navigating a maze to reach the goal (see the fig- ure). Thus, the key to exploit prevention is to focus on the exploit techniques, rather than the exploits themselves. • Protect resource-sensitive environments. Frequent antivirus sig- nature updates, application patches, and operating system updates required to secure endpoints against known vulnerabilities are par- ticularly challenging in virtual environments, where "golden images" are used to provision virtual endpoints. Many traditional physical endpoint products can create unforeseen complications when applied to virtual environments. Furthermore, purpose-built virtual security products often leave gaps in the overall security architec- ture if they are not part of a cohesive security infrastructure. (continued)