作者: Aaron Beuhring , Kyle Salous
DOI: 10.1109/MSP.2014.86
关键词:
摘要: Signature-based detection is no longer an effective way to detect and block malware; whitelisting much more effective. Whitelisting can vastly reduce organization's attack surface, letting defenders focus on advanced threats. It also force attackers use expensive exploits execute code remotely make it difficult for maintain persistence. Many organizations already own tools implement whitelisting, so the only cost time effort properly them.