Zone Labs
Integrity
Enterprise Endpoint
Security

The Future ofEnterprise
Hacker
Attacks: Howto Secure
NetworkEndpoint PCs
A White Paper Presentedby Zone Labs™

A Check Point Company// Trusted Zone //Zone Labs
Integrity
Enterprise Endpoint
Security// Trusted Zone //White Paper

Page
2

As CEO and co-founder of Zone Labs®, Gregor Freund brings
his impressive experience as a technologist and entrepreneur tothe company. In addition to holding eleven software patents,
Freund provided the vision for Zone Labs enterprise security
solution Integrity™ and the award-winning ZoneAlarm® andZoneAlarm Pro personal firewalls.
Prior to founding Zone Labs, Gregor’s accomplishments
included helping to found Starfish Software, later acquired byMotorola, with noted software visionary Philippe Kahn as well
as founding Borland International’s first independent German
and Italian distribution and development companies. Gregor
also worked as a principal software architect for Borland.

Zone Labs
Integrity
Enterprise Endpoint
Security// Trusted Zone //White Paper

Page
3

SQL Slammer: A Warning Sign
to Enterprises“The recent SQL Slammer attack comes as a warning to enterprises,” says Gregor Freund, CEO and co-founder of ZoneLabs, a San Francisco-based company known for its best-ofbreed, endpoint security solutions. In January 2003, the malicious SQL Slammer worm spread rapidly across theInternet-infecting millions of servers and PCs. Although theworm was relatively benign, it could have destroyed data easily
and viciously.
Exploiting a buffer overflow vulnerability on Microsoft
SQL Servers (and on any PC that ran applications with embedded SQL Server versions; otherwise known as MSDE),
Slammer self-propagated by repeatedly probing port 1434/UDP, on any machine it could communicate with, in search ofother vulnerable SQL Servers or SQL Server-equipped PCs.
During its continued quest for unprotected PCs, SQL Slammer
created a network traffic deluge that resulted in an effective
denial of service for many enterprises.
The SQL Slammer worm illustrates how quickly an attack
can infiltrate a network and spread to other systems. The
Independent Digital reported that the worm “spread worldwide
in 10 minutes,” and in its early stages, the worm doubled thenumber of machines it infected “every 8.5 seconds.” SQL
Slammer’s rapid progress led the Cooperative Association forInternet Data Analysis (CAIDA) to conclude that if the worm
“had carried a malicious payload, had attached a morewidespread vulnerability, or had targeted a more popular service, the effect would likely have been far more severe.”“This time, the worm didn’t deliver a payload, but had it
combined its propagation technology with a Trojan, it would
have become a next-generation, hybrid attack” notes Freund.
And, if SQL Slammer had been a hybrid attack, it could havedone much more than interrupt business continuity. It could
have, for example, propagated itself and then deployedSpyware to broadcast sensitive enterprise data online; or avirus to deface or erase valuable data entirely; or, if combinedwith RAT technology, to give the hacker unregulated access toproprietary enterprise data accessible by the infected machines— information that could be stolen for profit.
Once any hybrid attack infects network PCs, it has themeans and the opportunity to deliver a destructive or malicious
payload. In addition to the loss of business continuity, theseoften inconspicuous hybrid attacks can deliver a crippling,financial blow to enterprises through theft of competitive, customer, and financial data or other valuable information.
“Enterprises have real secrets, and they have real enemies whowant to steal their data. The threat to all enterprises is, in otherwords, clear and present. Our enterprise customers have avested interest in thwarting these next-generation, targetedattacks against their networks,” says Gregor Freund.

In addition to the loss of business continuity,
inconspicuous hybrid attacks can deliver a crippling financial blow to enterprises through theftof competitive, customer, and financial data orother valuable information.

Targeted Hacker Attacks:
The Danger of Trojan Horses
Recognizing this threat and understanding its implications,
Gregor Freund deems it critical that enterprises view SQLSlammer as a harbinger of next-generation, targeted attacks.
Based on recent events, it’s clear that “Hackers’ motivations
have changed. Instead of demonstrating their technicalprowess by defacement or destruction, they’re now hacking fordollars,” he says.

Zone Labs
Integrity
Enterprise EndpointSecurity// Trusted Zone //White PaperPage
4

With such profit-driven motivation, the attacks are likely toincrease — in sophistication, frequency, and severity. Already,the consequences are staggering: a recent CSI/FBI survey
found that two-thirds of all financial losses can be traced todata theft. Today’s hacker is a technological thief who understands that proprietary enterprise information has become
worth staggering sums to the right people. The intent of a targeted attack, in other words, is usually criminal, and any enterprise can become a target. These next-generation attacks
incorporate Trojan horses. Whereas the spread of SQL
Slammer worm was noisy and obvious in its slowing of networks, a Trojan horse sneaks into a network surreptitiously.
When successful, it draws little attention to itself; its goal is toinfiltrate the enterprise, capture information, and send it back toa hacker — or, in the case of a remote-access Trojan horse, togive a hacker remote control of a computer — all as quietly as“Without question, the easiest way of targetingan enterprise is through its network endpoints—
especially its remote and mobile PCs.”-Gregor Freundpossible. With a Slammer-type attack, enterprises know almost
immediately when they’ve been hit; with a Trojan horse, anenterprise may discover the extent of the damage only after it is
too late.
Compounding the threat of next-generation attacks is
a confluence of contributing factors. New worms are extremelyadept at propagation and infiltration, and the Internet facilitates
their spread. Also, because hacking-tool source code and pre-packTheft of Proprietary Information$151,230,100
aged scripts for Trojan horses areSabotage$5,183,100
readily available online, all a hacker
System penetration$19,066,601
needs is a little knowledge of system vulnerabilities and a willingInsider Net Abuse$35,001,650
ness to exploit those attributes for
Financial Fraud$92,935,500
financial or personal gain. And
because companies often publish
Virus$45,288,150
system vulnerabilities in an attempt
Unauthorized Insider Access$6,064,000
to protect or warn their customers,
Laptop Theft$8,849,000
their revelations can then become
attack maps for hackers exploiting
Denial of Service$4,283,600
these same vulnerabilities. “TheIn 2002, according to the CSI and FBI Computer Crime and Security Survey, security breaches
line between telling people how toresulting in datatheft accounted for 2/3 of all financial losses—far outstripping the costs associatedprotect themselves and educatingwith destructive viruses or worms.
hackers is a very fine line,” says

Zone Labs
Integrity
Enterprise Endpoint
Security// Trusted Zone //White PaperPage
5

Gregor Freund. Once a hacker is armed with tools and motivation, it isn’t long before an enterprise becomes the victim of atargeted attack.

The Enterprise Vulnerability:
Endpoint PCs“Without question, the easiest way of targeting an enterprise isthrough its network endpoints — especially its remote and mobilePCs,” says Gregor Freund. With this in mind, it becomes essential for enterprises to protect their vulnerable endpoints against
next-generation attacks. Hackers find remote and mobile PCs
extremely attractive targets because they reside outside the cor-

Nearly 90 percent of companies use perimeter
firewalls and antivirus software, but 85 percent
still succumbed to attacks last year.
-2002 CSI / FBI Computer Crime
and Security Survey

porate firewall but have access to the enterprise. As such, thesecomputers offer a convenient entry point. Aiding the hackers isthe fact that telecommuters or mobile professionals often
access their enterprise networks using insecure connections,such as dial-up, broadband, wireless, or thirdparty networks. At the same time, on-site
employees often leave work with their laptops
and return to their enterprises the next morning
only to re-dock behind the corporate firewall.
PCs behind the perimeter firewall are at risk aswell. Employees use their work PCs for personaluse, so they have access to their POP3 mailaccounts via their mail client or Web browser.
They also may participate in peer-to-peer filesharing, Instant Messaging (IM), and file downloading, and all these activities could potentiallybring a Trojan horse directly into the heart of anenterprise network.
Unfortunately, existing security technologies— which many enterprises have deployed-do noteffectively mitigate these risks or seal these vulnerabilities; as a result, endpoint PCs become
convenient targets for today’s hackers.
Unfortunately, dangerous hacker tools are readily available. For example, any search engine query will
Traditional antivirus security measures relyresult in over 134,000 sites with sophisticated hacker tools designed to assist criminals in targeted data
theft and corporate espionage.

Zone Labs
Integrity
Enterprise Endpoint
Security// Trusted Zone //White PaperPage
6

upon databases of known viruses, which make them reactive bynature. Also, antivirus measures are burdened by latency of signature; by the fact that they only acknowledge known viruses;and by the fact that they do not recognize custom viruses. And
no antivirus database can be updated quickly enough to halt aworm that spreads to every Internet host within 10 minutes.
Although host- and network-based intrusion detection and prevention systems can be more proactive, they also depend upona database of known attack patterns, network traffic, and hostintrusion attempts. Perimeter firewalls can stop some inboundattacks at the gateway, but they must remain open for ports andprotocols that bear network inbound and outbound traffic. IT
professionals using perimeter firewalls cannot view the sourceof outbound traffic and therefore can’t differentiate between
valid port 80 ‘HTTP’ traffic generated by a browser and similar
traffic generated by an insidious Trojan horse. In fact, nearly 90
percent of companies use perimeter firewalls and antivirus
software, but 85 percent still succumbed to attacks last year,
according to the 2002 CSI/FBI Computer Crime and Security
Survey. The fact is: perimeter-centric security systems alone
cannot offer the necessary protection against new andunknown hacker attacks.
The sophistication of today’s targeted, next-generation
attacks demands an aggressive, intelligent solution — that ofendpoint security.

Integrity: The Proactive Solution
for Vulnerable Endpoints
With Integrity, vulnerable endpoint PCs are protected by amulti-layered security system that enables enterprises to block
new and unknown attacks automatically. As a result, IT departments can mitigate the impact of malicious worms and candefend their enterprises against costly Trojan horse attacks.
Integrity is built upon patented technology that has been

field-tested across industries on more than 20 million consumer
PCs and throughout countless enterprises. Zone Labs
TrueVector® technology takes a unique, guilty-until-proven-innocent approach to security, and it allows enterprises to control
and extend security down to the application level. Application
control is critical in securing network endpoints because it
ensures that only checksum-verified applications enter the network, thereby keeping enterprises safer from targeted hacker
attacks.
“Technology, no matter how advanced, needs a strong
management complement for the system to operate seamlessly
and effectively,” says Gregor Freund. Using centralized, Webbased management combined with agents on each endpoint,
Integrity enables efficient network management so an IT professional can quickly create, deploy, and enforce flexible policy
assignments across the network from a single location. As awhole, the multi-layered security approach of Integrity, with its
advanced management component, minimizes the risk ofvicious targeted hacker attacks and malicious worms.

Three Steps for Securing Enterprise Systems
Now — with Zone Labs Integrity“SQL Slammer illustrated how hard it is for enterprises to constantly follow up on patches and deal with all the system vulnerabilities,” Freund says. Indeed, in a perfect world, all systems
would be updated immediately and continuously. New patches
would be installed as soon as they are released. System-wide
implementation would happen routinely. But reality dictates differently. At any given time, a significant number of enterprise
endpoints do not reflect the most current security measures.
With shrinking staffs and increasing responsibilities, today’s IT
professionals struggle to perform basic network maintenance.
With a fleet of thousands of desktops and laptops, ongoingadministrative tasks create a huge burden on IT departments.

Zone Labs
Integrity
Enterprise EndpointSecurity// Trusted Zone //White PaperPage
7

There is no question that the time involved in researching eachpatch and updating every computer is formidable. But obsolete
security or insufficient security make network endpoints evenmore vulnerable, and hackers bank on this.
Zone Labs has designed its Integrity management tools
to address this very problem and to help IT departments gain
control of their enterprise networks. Once an IT department hasa solid PC firewall in place, it can then set proactive and reactive policies to mitigate system vulnerabilities. And once systemvulnerabilities are locked down, the enterprise becomes moresecure against worms and targeted hacker attacks.

Step 1: Deploy a PC Firewall
The mandate is stunningly simple: for immediate protection, IT
departments can deploy a PC firewall on each network endpoint. By putting the machines in “stealth” mode, administrators
ensure that enterprise PCs are invisible to hackers; if thesemachines cannot be seen, they cannot be hacked.
Now administrators have the tools to deploy enterprisewide PC firewalls with minimum effort. Integrity ships with preconfigured policy templates, so an IT administrator canimmediately pick a template that is appropriate for the level ofsecurity he wants to apply — and then deploy that policy acrossthe entire network. Unlike traditional ‘port and protocol’ firewalls, Integrity offers an immediate solution that does not
require complex configuration. The process is simple, andwithin minutes, an IT department can have a solid firewall policy
set and deployed on all of its PCs.

Step 2: Create and Enforce Proactive Policy
Once an IT department has its firewall policy in place for immediate protection, it can begin to think about shaping a proactive
policy. Policy serves an important function: closing off known

system vulnerabilities. By creating and deploying role-appropriate policies throughout the enterprise, IT departments ensurethat only authorized applications can access the enterprise network. At the same time, IT administrators can minimize the risk
inherent in applications such as peer-to-peer file sharing, outdated browser versions, or instant messaging programs.
Once these flexible policies are created, an administrator
can deploy and assign them in a number of ways, depending on
the needs of the enterprise. For example, an IT administrator
may set policy by users or groups (syncing with existing active
directory, LDAP or Radius management systems), connection
type (VPN, dial-in, wireless LAN), or by IP address.
Enterprises also need to ensure that endpoint antivirus
software is current when employees access the network.
Integrity’s exclusive Cooperative Enforcement™ technology
quickly audits each PC before it accesses the network. If theendpoint does not comply with the latest antivirus software, theuser is directed to upgrade. Cooperative Enforcement also integrates with select VPNs to prohibit remote-access connections
until the user is in compliance. Cooperative Enforcement technology integrates within the existing IT infrastructure to close
gaps and harden overall network security.

Step 3: Deploy a Reactive Option
At some point, despite the best measures, an IT department
might discover that its security policy parameters were toolenient and that a threat has infiltrated its enterprise. When thisoccurs, Integrity provides the ability to set an immediate, reactive policy so that an IT department can respond to the threat inreal time. In the midst of an attack, for example, an enterprise
can block ports or applications and effectively put the network
in lockdown while assessing the situation. In this way, Integrity
gives IT departments a measure of control over the attack; more
importantly, Integrity reduces the extent of an attack’s damage.

Zone Labs
Integrity
Enterprise EndpointSecurity// Trusted Zone //White PaperPage8Conclusion
SQL Slammer was relatively innocent this time, but this worm
should be seen as a harbinger of future attacks. Next-generation attacks will combine the spread and reach of a worm withthe payload of Trojan horse technology.
It is an unfortunate truth that calculated, targeted attacks
are part of today’s enterprise landscape. Inevitably, almost
every enterprise will be attacked at some point. The response
to such dangerous, but as yet unknown, attacks is “to work atdeveloping security solutions that effectively mitigate the risk,”says Gregor Freund.
At the same time, a confluence of factors contributes todanger of these insidious attacks: the Internet facilitates the fast
spread of threats; system and software vulnerabilities are wellknown and easily exploited; vendors have emphasized accessand productivity over security; and, tomorrow’s hackers are
criminal: they are driven by theft and destruction and are motivated by profit.
Until now, enterprise security administrators have not hadaccess to effective tools to secure their networks. Now, IT professionals can use Integrity, which allows enterprises to assess
risk and then create and enforce proactive policies across theorganization. “We have designed Integrity,” Freund says, “withthe IT professional in mind. IT departments need maximum yet
flexible security that is easily managed and easily deployed.”

To learn more about how Integrity can minimize your risk of new and unknown hacker
attacks, contact a Zone Labs representative at
1-877-876-4960.

Integrity is a proven, best-in-class solution that offers
superior security and easy administration. It has been designedto protect an enterprise’s most vulnerable areas — namely, its
endpoint PCs. As a result, the entire enterprise network
becomes more protected. Integrity is the solution of choice forenterprises that are committed to mitigating the risk of nextgeneration attacks.

About Zone Labs, Inc.
Zone Labs, Inc. is a leading creator of endpoint security
solutions that millions of customers trust to protect their PCs
from the risk posed by hackers and data theft. Zone Labs’proven technology is deployed by global enterprises, service
providers, small business and consumers.
US Headquarters
Zone Labs, Inc.
475 Brannan Street
Suite 300San Francisco, CA 94107
tel 415.633.4500
fax 415.633.4501

European Headquarters
Zone Labs, GmbHFrankfurter Str. 181 a63263 Neu-Isenburg,
Germanytel +49.6102.36689.0
fax +49.6102.36689.99

www.zonelabs.com© 2004 Zone Labs. All rights reserved. IMsecure, TrueVector, ZoneAlarm and Zone Labs are registeredtrademarks of Zone Labs. The Zone Labs logo, Zone Labs Integrity and Cooperative Enforcement aretrademarks of Zone Labs L.L.C. Zone Labs Integrity protected under U.S. Patent No. 5,987,611. Reg.
U.S. Pat. & TM Off. Check Point is a trademark of Check Point Software Technologies Ltd. All othertrademarks are the property of their respective owners. v.06.18.04™

A Check Point Company