What is a zero-day threat?
A zero-day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it -this exploit is called a zero day attack.
For effective zero-day threat protection organisations need their solutions to include malware-analysis technolgoies and have the ability to detect evasive advanced threats and malware – today and tomorrow.
To protect customers against the increasing dangers of zero-day threats, SonicWall Capture Advanced Threat Protection Service – a cloud based service available with SonicWall firewalls – detects and can block advanced threats at the gateway until verdict.
A cloud-based, multi-engine solution for stopping unkown and zero-day attacks at the gateway.
Multi-engine advanced threat analysis
SonicWall Capture extends firewall threat protection to detect and prevent zero-day attacks. The firewall inspects traffic and detects and blocks known malware and intrusions. Suspicious files are sent to the SonicWall Capture cloud service for analysis. The multi-engine sandbox platform includes virtualized sandboxing, full system emulation, and hypervisor-level analysis technology. It executes suspicious code and analyses behaviour, thus providing comprehensive visibility to malicious activity, while resisting evasion tactics and maximising zero-day threat detection.
Broad file type analysis
SonicWall Capture supports analysis of broad range of file types, including executable programs (PE), DLL, PDFs, MS Office documents, archives, JAR and APK. Plus, it supports multiple operating systems, including Windows, Android, and Mac OSX environments. Administrators can customise protection by selecting or excluding files to be sent to the cloud for analysis, including by file type, file size, sender, recipient and protocol. In addition, administrators can manually submit files to the cloud service for analysis.
Block until verdict
To prevent potentially malicious files from entering the network, files sent to the cloud for analysis can be held at the gateway until a verdict is determined.
Rapid deployment of remediation signatures
When a file is identified as malicious, a signature is immediately deployed to firewalls with SonicWall Capture subscriptions to prevent follow-on attacks. In addition, the malware is submitted to the SonicWall threat intelligence team for further analysis and inclusion of threat information into the Global Response Intelligent Defense Network (GRID) Gateway Anti-Virus and IPS signature databases and the URL, IP and domain reputation databases within 48 hours.
Reporting and alerts
SonicWall Capture provides an at-a-glance dashboard and reports that detail the analysis results for files sent to the service, including session information, OS information, OS activity and network activity. Firewall log alerts provide notification of suspicious files sent to the SonicWall Capture service for analysis and results.