COMPARISON OF SOLUTIONS FOR ADVANCED CYBER THREATS PROTECTION

Cilj diplomske naloge je pregled naprednih spletnih groženj in opredelitev potencialnih rešitev, ki nas pred njimi ščitijo. Prikazali smo, kaj opredeljuje napredne trajne grožnje in zakaj klasične varnostne rešitve, ki statično, na podlagi podpisov, analizirajo programsko kodo, niso več kos novim kibernetskim grožnjam. Napredne trajne grožnje in ostale usmerjene napade smo predstavili, prikazali delovanje in izpostavili potencialne posledice, ki jih lahko povzročijo. Prikazali smo različne pristope, ki nudijo dinamično pregledovanje spletnega prometa ob različnem času in na različnih mestih omrežja. Izpostavili smo tehnologijo t.i. peskovnika, ki analizira neznane datoteke in ocenjuje njihovo stopnjo ogrožanja na podlagi obnašanja v emuliranem / navideznem okolju. Ker tehnologija peskovnika ni nezmotljiva, smo prikazali tudi nekaj tehnik izmikanja. Diplomska naloga nudi tudi kratek pregled komercialnih rešitev ter njihovo primerjavo glede na tri glavne skupine kriterijev: funkcionalnost, strategijo in prisotnost na trgu. Zaključili smo, da popolne obrambe pred usmerjenimi napadi nikoli ne bomo mogli doseči. Za zmanjšanje uspešnosti naprednih spletnih groženj smo predlagali povečanje zavedanja, zagotovitev sredstev za tehnologijo in človeške vire ter poglobitev znanja.The aim of this thesis is to provide an overview of advanced cyber threats and identify the potential solutions that might offer a reliable protection against such threats. The author defined the concept of advanced cyber threats and demonstrated why nowadays the traditional security solutions that are signature-based and analyse software code statically are no longer a match for new cyber threats. This thesis presents advanced persistent threats and other targeted attacks and their operation, highlighting the potential consequences that may ensue. The thesis looks at various approaches which provide a dynamic inspection of internet traffic at different points in time and in different network locations. The author highlighted so-called sandbox technology, which enables an analysis of unknown files and an assessment of their threat level based on their behaviour in an emulated/virtualised environment. Since the sandbox technology is not infallible, the author also presented several evasion techniques. In addition, the work at hand includes a brief overview of commercial solutions and their comparison based on three main groups of criteria: functionality, strategy and market presence. The conclusion of the work is that a perfect and complete protection against targeted attacks can never be achieved. In order to reduce the effectiveness of advanced online threats the author proposes to provide additional funding for technology and human resources, increase awareness, and to enhance knowledge