Choosing Device Detection

The studio's laptops and servers already run a signature scan, and both the Exchange web shells and the CCleaner code showed its limit: a program written fresh matches nothing on the list. A different kind of tool learns what normal activity on the device looks like and flags what departs from it, which costs more in memory, processing, and alerts someone has to read, and can catch what no list contains.

The New York Times published an investigation in October 2012 of the fortune gathered by the family of China's prime minister, Wen Jiabao. Starting in mid-September, while the story was being reported, intruders had been getting into the paper's network. They took the corporate passwords of every Times employee and used them to reach the computers of 53 people, searching the email of the reporter in Shanghai who wrote the story and of a former Beijing bureau chief. Investigators from Mandiant, a security firm the paper hired, tied the methods to a group they had seen attack U.S. military contractors from China.

Over the months they were inside, the intruders installed 45 pieces of custom malware on the paper's computers. The Times ran antivirus software from a major vendor on its computers. How many of the 45 would you expect it to catch?

The intruders' programs were custom, and 44 of the 45 matched nothing on the antivirus list; it caught a single one. The other 44 ran for months beside a scan that had nothing to match them against. The intruders were found by AT&T, which monitored the paper's network and, at the Times's request, was watching for unusual activity when the story ran. Then Mandiant tracked them for weeks before they were shut out. The vendor, Symantec, answered the Times in public: signatures alone are not enough against attacks like this one, and companies need to use every detection feature their products offer, beyond the signature scan.

The video game studio is deciding what detection to run on four kinds of device.

Pick a detection method for each: signature-based, anomaly-based, both together, or none on the device itself.

The studio has 27 devices that could carry a detection tool, and each one would need its own license.

Both servers get both kinds. The build server's compromise would reach every player, the way CCleaner's build computers did, and the sign-in server holds every player's hash; each has the power to run an anomaly tool without slowing down. The laptops are harder. A signature tool is light enough not to stall a render, but the Times's attackers worked through employees' computers, and the laptops hold source code too. The arcade cabinet gets nothing on the board itself: it couldn't run a tool, so it sits on its own network segment, a separate section of the studio's network, where the studio's network monitoring can see what it sends.

Then the bill. Signature-based protection for 27 devices is a small yearly cost. The EDR service a vendor quotes runs both kinds of detection on both servers and every laptop and puts all their alerts on one screen, at several times that price. The studio pays it, and the artists accept that a render may run a little slower.