The inherent problems of the detection paradigm

[Mihir :-)]

Content source

https://www.helpnetsecurity.com/2016/04/28/detection-paradigm/

An ongoing debate in the modern cybersecurity world is whether to detect or prevent cyberattacks. Although detection technologies are undoubtedly important tools in the defender arsenal, recent years show they have only limited effects when encountering certain types of cyberattacks.

Network based intrusion detection systems (NIDS) and host based intrusion detection systems (HIDS) have been defeated time and again. Typically, attackers successfully penetrate through the NIDS systems and gain a persistent foothold within an organization’s workstations. They gather and leak sensitive data without raising any HIDS alarms, sometimes for months and years.

Read more The inherent problems of the detection paradigm - Help Net Security

 

[Deleted member 178]

I kept telling here since years that detection is an obsolete feature of the ancient age of security; but vendors are desperately hooking on it because it is the system which afford most incomes and users like it from beginners (who can't/don't want handle more complex and safer protection system) and by some geeks (who like test detection rates).

 

[LabZero]

Also, currently, a major problem is the Web malicious code that attackers are continually improving using JavaScript.
JS is very powerful and universal code that can be injected into a Web page with a simple HTML iframe, so the browser loads malicious content from a specific remote site when that page is opened.
The malicious component can be easily obfuscated, so the payload is hidden at the time of the scan of the content of the page.
It is difficult to detect the threat also using advanced detection systems.
As often happens: recycle the old..

 

[jamescv7]

The problem here where the prevalence of a samples (threats) affects the possible notification on many AV's, besides of obfuscation techniques which typically present nowadays which the solutions provided are exist but everything up to the user decision.

Honestly the techniques of a security program are already provided, you need to understand clearly how everything works.

 

[Mihir :-)]

Honestly the techniques of a security program are already provided, you need to understand clearly how everything works.

Good Say.