alphaspirit - Fotolia
My organization has moved away from Adobe Flash to HTML5 because of security concerns, but I've seen new research that shows HMTL5 can be used to prevent detection of drive-by download attacks. How does this new malware obfuscation technique leverage HTML5, and what can we do about it?
Enterprises need to remember the state of software security and vulnerabilities is changing faster than ever before and will most likely outpace anything they can do to keep up. Enterprises need to have a rigorous security program to evaluate emerging risks. Today's new security control is tomorrow's new vulnerability. An enterprise security program needs to be nimble enough that if one security control or compensating control ceases to be effective, it can be replaced or retired without having to redesign the entire program.
Enterprise responses to this proof-of-concept malware obfuscation should be the same as with any new attack in which a vulnerability is identified in software or security controls. Researchers suggest enterprises could disable some of the functionality of HTML5 that is used in this attack to prevent infections. However, limiting the functionality on untrusted sites and allowing for trusted sites could be too restrictive. Ensure that Web browser and antimalware tools are updated so they can incorporate some of the other countermeasures recommended by the researchers. Be sure only trusted data is executed on endpoints and the new malware obfuscation techniques can be detected.
Ask the Expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Learn more about attack obfuscation
Find out more about HTML 5 security features and risks
Learn if HTML 5 is really safer than Flash
Dig Deeper on Web application and API security best practices
Related Q&A from Nick Lewis
Cloud penetration testing presents new challenges for information security teams. Here's how a playbook from the Cloud Security Alliance can help ... Continue Reading
Many cloud providers are tight-lipped about internal security control details. Learn how to evaluate cloud security providers with certifications and... Continue Reading
Enterprises new to the cloud can write new security policies from scratch, but others with broad cloud usage may need an update. Consider these ... Continue Reading