Reputation-based security tackles new threats

By Staff Writer for Symantec

Johannesburg, 15 Sep 2009

Symantec has integrated reputation-based security technology, Quorum, into its Norton 2010 solution range.

According to Symantec, the security solution complements traditional security techniques by using anonymous software usage patterns to classify new types of spyware, viruses and worms.

“This new technology changes the rules of the malware game, shifting the odds significantly in favour of our users,” said Gordon Love, regional director for Africa, Symantec. “By harnessing the wisdom of our tens of millions of users, we're able to detect threats that are invisible to traditional security products.”

In 2008, Symantec discovered more than 120 million distinct malware variants, highlighting the significant changes in the threat landscape over the past few years. In this environment, says Symantec, it is necessary to move beyond traditional security approaches to stay ahead of new malware.

Traditional anti-virus software relies on virus signatures to blacklist those pieces of malware that should be blocked from a user's machine. Ten years ago, Symantec published an average of five new virus signatures each day. Today, in spite of the fact that each signature can detect many different malware strains, security vendors regularly publish thousands of signatures or more per day.

Quorum reputation-based security complements traditional security techniques by using anonymous software usage patterns to classify files as safe or unsafe, explains Symantec. The Quorum technology provides a fundamentally new layer of protection from today's latest threats.

According to Symantec, its Quorum reputation-based security leverages data from multiple sources. This includes anonymous data contributed by tens of millions of Norton Community Watch members, data provided by software publishers, and anonymous data contributed by enterprise customers in a data collection programme tailored to large enterprises.

The data is continually imported and fed into the reputation engine to produce a security reputation rating for each software file, all without ever having to scan the file itself.

Quorum uses information such as the file's prevalence, age and other attributes to compute highly accurate reputation scores. These reputation ratings are then made available to all Symantec users through a large cloud-based infrastructure of Symantec servers.