Research in how bacteria communicate and cooperate may be the future lessons of how computer malware evolves.

Bacteria and malware evolution

I recently watched a fascinating presentation by Bonnie Bassler on how bacteria communicate.

My information security brain started thinking of the similarities between the evolution of computer malware and bacteria.  Bacteria over the course of billions of years, devised the most efficient way to communicate, survive, and even destroy large and complex systems.  This may be the most logical path for the successful evolution of computer malware and a peek in the future of information security challenges.

Bonnie is a passionate and articulate speaker who outlined how these simple single cell critters work as a team to coordinate activities in a perfectly synchronized manner.  Their actions are stealthy, methodical, and can accomplish incredible objectives through teamwork on the scale humans have never achieved.  They infect, quietly multiply, and wait.  Bacteria independently determine the size of their community and decide to act based upon rudimentary communication and awareness.  When conditions are right, a level of potential virulence is attained, they team up in the billions and act in a choreographed manner.  And they do it simultaneously to bring down their target.

In many ways, computer malware act similarly to bacteria.  Malware infects computers which are part of a large community.  Malware and bacteria want to remain stealthy until ready to strike.  Malware exists as basic lines of code with simple rules.  Bacteria are organisms which behave in simple ways.

We are seeing the malware industry evolve with more ambitious goals.  Infection of a single node in a network is no longer sufficient to achieve desired objectives.  Malware must be developed to meet new challenges.  Bacteria are the masters at infiltration, stealth and surprised coordinated attacks against behemoth adversaries.  In the future, malware may take some lessons from it biological doppelganger.

So how may malware evolve?

Malware design may shift to very small autonomous pieces.  Modern malware is generally a single package of standalone code which may exist as a file or attach itself to other code.  Deciphering of this complete nugget will typically reveal all its secrets.  In the future such code may be broken up like pieces to a puzzle.  Each piece means very little and appears harmless. Only when they come together does the malevolent picture come into view.

Code will replicate itself and seek deeper penetration to all manner of systems.  With little risk of the big-picture exposure, these pieces can be distributed and replicated much more.  Computer environments are full of innoxious code such as temp files, random packets, application remnants, and unneeded data.  Most code and data is ignored unless deemed dangerous.  These pieces can quietly infiltrate many different operating systems, applications, data, and communication traffic of clients, servers, storage, and network devices without raising alarm.

Malware will be very quiet, acting locally and not attempting to communicate outside of the environment.  Much of today’s malware is detected as it attempts to communicate with command and control systems outside of the target network.  Evolution of malware code will be harmless, quiet, and unnoticeable until the right success conditions are met.  Local community awareness via ‘quorum sensing’ between the pieces within a target environment would likely not be detected.  Only when the right elements are in place will the pathogenicity be realized as unified activation is initiated and virulence is rapidly achieved.  This will offer little chance for security to offer a meaningful response.

Malware has a lot to learn from its slimy cousin.  Maybe someday malware writers will become as smart as these microbes.  On the upside, security can learn from the same teachers.  Just don’t blame our microscopic symbiants of malice, as we exist in their world.  The battle continues.

Momentum continues to gather for the protection of people’s private data.  On January 28th, the US, Canada, and 27 European countries will celebrate Data Privacy Day.  The security aspects seem simple in principle, but are proving to be more challenging than anyone predicted.

Today we celebrate Privacy Day, to promote fundamental principles of privacy and to raise awareness in our society.  The advancement and adoption of everyday technology has pulled this issue into the attention of the world stage.  In recent years, consumers insatiable desire for convenience, efficiency, and speed have placed our identities, purchases, interests, medical records, debts, communications, and social interactions into the digital world.  Indeed, our very lives are being tracked, processed, stored, and transmitted electronically.

There is a cost to all the inherent benefits: our Privacy.  One of the most important liberties in our free and open society is our right to privacy.  Our ability to choose what others know about us grants individuals some semblance of control in how we can be manipulated by others.  Protecting our private data is key.

The realms of security and privacy are beginning to blur.  I see a trend of security organizations being asked to tackle this tricky problem.  On the surface, it appears to be straightforward.  Find the data and secure it.  However, the picture starts to get complicated when we consider regulations, security controls, data lifecycles, and the immense behavioral challenges.

Regulations

The European Union strongly influenced the direction back in the 1990’s with the development of privacy directives which outlined some basic principles.  Since, decentralized regulations have been germinating and beginning to take hold with different verbiage, requirements, and exemptions all over the world.  Even within each country, different regulations may exist for different states, provinces, or jurisdictions.  Today’s landscape is ever changing with overlapping policies, gaps, and regulations which touch different aspects.  It is a mess.  Well, Rome was not built in a day and neither will a unified privacy stance.  Security, with the goal of meeting all the regulations, must understand the requirements and make them magically come to fruition.

Security controls

The security controls, including tools, standards, and processes, are themselves new and trying to keep up with the changing types of data and how they are handled by organizations.  It is akin to herding cats.  Finding private data is tough enough, but securing it with a comprehensive strategy without impacting the business value of how it must be used is problematic.  To compound the problem, new technologies and more types of data are being added to the pool.  Everyone loves data. Nobody loves the job of securing it.

Data lifecycles

It is not enough to simply lock up data from prying eyes.  Data must be managed.  In some cases, the very person which the data represents must be given a chance to review and correct inaccurate data.  Information may be obtained only in certain ways, stored securely, accessed in a controlled manner, and most importantly, data must be destroyed.  Yes, destroyed.  Which means security must have a strong hand in how data is managed across its entire lifecycle.

Behavioral Challenges

Securing data may sound tough, but the most difficult problem is not technical in nature.  It is the behavioral challenges of educating people why security is necessary and to convince them it is in everyone’s best interest.  The toughest audience to convince are the end-users, especially the next generation who are just now leading the social media exploration of cyber communication and on-line communities.  They are willing to share very personal data without comprehending the risks or understanding how it may adversely affect their future.

Which brings us back to Data Privacy Day.  As an employee, I am proud Intel is actively participating in Privacy Day
http://www.intel.com/policy/dataprivacy.htm  Check out the event details, other participants, and resources!

Exerpt:

“Designed to raise awareness and generate discussion about data privacy practices and rights, Data Privacy Day activities in the United States have included privacy professionals, corporations, government officials, and representatives, academics, and students across the country.

One of the primary goals of Data Privacy Day is to promote privacy awareness and education among teens across the United States. Data Privacy Day also serves the important purpose of furthering international collaboration and cooperation around privacy issues.”

Can security be detrimental to an organization?  Absolutely!

Being aware security programs may become the source of losses and introduce more risk is important for establishing and maintaining a valuable security capability.

Listen to the audiocast

It is important to understand there does exist a dark side to information security.  If it is not professionally managed it can cause productivity impacts, financial losses, and introduce liability for the corporation.