Trust-Based Security Models Ineffective: Researchers - SecurityWeek

SecurityWeek, by Eduard Kovacs

The trust-based foundations of whitelisting make it more difficult for organizations to properly protect their networks against cyber threats, Kaspersky Lab researchers have warned.

Juan Andres Guerrero-Saade and Fabio Assolini of Kaspersky Lab’s Global Research and Analysis Team (GReAT) provided numerous examples in which perfectly legitimate applications have been leveraged by malicious actors to achieve their goals.

Benevolent design doesn’t necessarily mean benevolent use, the experts showed during a presentation at the Infosecurity Europe conference in London this week. Trust-based security models such as whitelisting depend on the accurate characterization of the code’s intended use. Whitelisting technology is built on three pillars: verifying if the developer is trustworthy, if the application’s behavior is seemingly benevolent, and if the application is trusted by many users, an aspect the researchers call “crowdsourced trust.” Read more.