Integrating Isolation with Analytics

One of my PhD thesis advisors at the Stevens Institute of Technology was a mathematician named Steve Bloom. Among the late, great Dr. Bloom’s amazing research accomplishments include mathematical analysis of computational structures and equational properties of fixed point operations. I consider him one of the most amazing scientists I’ve ever met, and will admit to having been somewhat intimidated by him at times. And one day, he asked me about computer security:

“What are the foundational issues?” he asked. Now, when someone whose normal conversation wanders comfortably into Friedberg splitting in ß-recursion theory asks you about the foundational aspects of your discipline, then you’d better give an answer that makes technical and logical sense. After giving his question some thought – and I remember that he asked me while we were driving in the car near Bell Labs in Murray Hill, New Jersey – I responded by talking about isolation.

“Computer security, I said, back in a time before it was fashionable to say cyber, “is about finding ways to isolate active entities and passive repositories like files into groups based on their properties and on stated policies.” I remember him nodding and responding that this seemed a sensible way to describe the security challenge. That moment was meaningful to me, and every time I hear of isolation techniques in cyber, I think of Professor Bloom.

Now, an interesting thing happened in our industry recently – and it might seem minor, but I got excited when I heard about it. The team at Menlo Security, which provides isolation for web surfing and email links, realized that it needed to make allow or block decisions based on the properties of email attachments being isolated. All too often, I see this type of product challenge result in a cobbled-together capability that wanes in comparison to similar commercial offerings.

But in this case, the Menlo team made the wise decision instead to partner with the capable security team at ReversingLabs. Now, you probably already know that ReversingLabs provides best-in-class methods for differentiating between safe and infected files. By combining the power of isolation from Menlo Security with the analytic forensic strength of ReversingLabs, the two teams have created and demonstrated the poster child case for a clean, useful security integration.

“The power of what we provide at ReversingLabs,” explained Brian Soldato from ReversingLabs, “involves reverse engineering files of interest to produce useful cyber security results in a way that is not prone to evasion techniques such as with most dynamic analysis methods. This capability provides Menlo and our other customers and partners with forensic advantages. And we can scan efficiently, within in a couple of seconds, to produce a verdict on the data being analyzed.”

“Our customers benefit from the power of isolation,” explained my longtime friend Howard Garfield from Menlo Security, “with dangerous attachments being efficiently blocked, when warranted, based on ReversingLabs technology.” I will second Howard’s motion here: I like this integration and appreciate its sensible approach to solving a common problem. If Dr. Bloom were alive today, I might have used this as an example to illustrate the power of isolation in my answer to him.