On the Front Line with the FortiGuard Team

At first glance, the world of malware and other threats to your network may seem overwhelming: thousands of new malware variants found every day, advanced targeted attacks, zero-day vulnerabilities, key logging, phishing, trojans and botnets. In addition, there’s an ever-growing vocabulary of confusing and overlapping terms. It seems that almost every day you read stories of organizations being attacked, networks penetrated, data stolen, all resulting in financial damage. How do you stay on top of it all?

As a user of Fortinet technology, you may notice updates being sent to your FortiGate appliance multiple times a day. But what goes into these updates? How does the FortiGuard team create updates for your network? This brief will explain what happens on the front line and how the FortiGuard team obtains information and creates daily packages for your FortiGate and other Fortinet devices to help keep your networks secure.

The FortiGuard Team

FortiGuard is Fortinet’s threat research and response team. With more than 200 security engineers and forensic analysts around the globe providing 24 hours a day, 365 days a year analysis of current threats on the Internet, the FortiGuard team’s sole purpose is to protect customers.

FortiGuard: Continuous Protection

The FortiGuard continuous protection model is a multilayered, multi-step process that the team uses to keep our customers safe. We learn about threats in a number of ways. We share what we learn with our customers by updating their devices and with industry in conferences and publications. We use the information that we know to protect our customers. And with tools like real-time sandboxing and our ability to detect new malware variants, we can recognize suspect content, that which exhibits malicious attributes, and investigate accordingly.

From Analysis to Protection

Data Feeds

FortiGuard uses many data sources to collect samples and information about malware and other threats. FortiGuard monitors a host of different data feeds to harness the information used to identify malware and other threats circulating online. The team analyzes the information to create and deploy unique protection packages for Fortinet customers’ networks.

Sources include actual virus samples, alerts from partners about suspicious activity, or Fortinet’s own internal systems that replicate, analyze or reverse-engineer malware.

• Strategic Partners: FortiGuard maintains partnerships with many organizations globally, both public and private.
• Computer Emergency Response Teams (CERTs) and Computer Security Incident Response Teams (CSIRTs): FortiGuard has many collaborative partnerships with CERTs and CSIRTs worldwide, regularly exchanging information about emerging threats.
• Forum of Incident Response and Security Teams (FIRST): FIRST is a large group of incident teams all over the world who exchange critical threat information, especially in the all-important first hours when a new threat is discovered.
• VirusTotal: FortiGuard receives specialized antimalware feeds from VirusTotal, a Google subsidiary that assists in the identification of malicious online files.
• Internal Research: FortiGuard Labs maintains a large team of threat researchers all over the world, providing around-the-clock presence. The team covers the entire spectrum of research: covert surveillance of malware and botnets; reverse engineering of malware; signature generation; and world-class zeroday research. It also studies how complex or polymorphic forms of malware modify themselves as they replicate.
• Analytics: This feed is used to receive samples direct from appropriately configured FortiGate devices when suspicious content has been identified.

Service Portals

The FortiGuard team uses service portals to receive and provide information to Fortinet customers and the Internet security industry:

• Online AV Scanner and Submission Tool: If you discover a suspicious file on your machine, or suspect that a program you downloaded from the Internet might be malicious, you can submit a copy to FortiGuard via the online submission tool. The file is sent to a dedicated server for scanning, and the results are emailed back to you.
• FortiGuard Malware Encyclopedia: FortiGuard’s online encyclopedia allows you to search for threats you want more information on. The encyclopedia covers malware, viruses, vulnerabilities and exploits as well as known intrusion protection threats.
• Live Threat Monitor: FortiGuard’s live threat monitor shows you live data from the FortiGuard network. Botnet activity, viruses, intrusions, antispam and applications are all shown, including a daily or monthly ranking of the top 10 threats that are currently being reported by the global network of FortiGate devices. You can view rankings of global threats or specify geographic regions.

FortiGuard’s Knowledge Store

Our knowledge store is a repository of all the information we collect on every threat we analyze and protect against. For more than a decade, the knowledge store has been collecting hundreds of millions of malicious code samples. FortiGuard’s engineers, analysts and intelligent systems add an average of 160 thousand new samples to the store every single day of the year.

Cross-Reference, Correlation and Analysis

Malware and other malicious threats have long evolved passed the simple virus. The FortiGuard team analyzes and creates protection packages for not only viruses, but for botnets, intrusion detection and protection, web filtering, Distributed Denial of Service (DDoS) attacks, phishing attacks, vulnerabilities, exploits, IP reputation and antispam. Often we see malware that uses multiple components: a malware sample may have a virus component, a spamming component, an intrusion component and a botnet component (with its related command and control information).

Description Creation and Verification

Once we’ve analyzed a threat, we generate a package to protect against it.

FortiGuard uses a unique and powerful proprietary programming language called Compact Pattern Recognition Language (CPRL). CPRL allows our analysts to describe entire families of malware with a single program instead of the traditional signature-based “one signature, one variant” model used by other vendors. The FortiGuard team proactively uses CPRL not only to protect against today’s threats, but to predict tomorrow’s zero-day malware.

Once a threat has been investigated and a CPRL program created, it is thoroughly tested by the FortiGuard team. These tests ensure the new program detects what it is expected to detect. They also eliminate the risk of a false positive by checking a database of known clean content. Detecting clean files as malware is never a good thing.

Package Release

Once an update has been tested and cleared for release, the package is released to the Primary FortiGuard Distribution Servers. When the primary servers have received the update, it’s distributed to our network of Secondary FortiGuard Distribution Servers. This secondary layer provides updates directly to the customer devices.

FortiGuard Distribution Network

The FDN is a global network of servers that distribute updates to Fortinet devices, including FortiGate, FortiMail, FortiWeb and FortiDDOS appliances.

There are nine primary FDS servers and almost 100 secondary servers in data centers throughout the world. Customers with a large installation base can choose to use their FortiManager to receive and push the update to the devices that it manages.

FortiManager becomes a third tier within the FortiGuard Distribution Network hierarchy.

FortiGuard Premier Signature Service

FortiGuard’s Premier Signature Service provides enhanced virus detection and threat analysis support to help mitigate breaking and advanced targeted attacks.

With the FortiGuard Premier Signature Service, you can submit requests for custom antivirus, intrusion protection or application control signatures 24 hours a day, seven days a week for prioritized support with guaranteed response times. Updated signatures are typically provided through Fortinet’s support site and later included in FortiGuard distribution network’s automatic updates.

FortiGuard Real-Time Data

FortiGuard’s live threat monitor is available any time online for you to discover more about FortiGuard and many of the current threats we’re observing on the Internet. If you’d like to see more, visit us at www.fortiguard.com. Security is our business.

Download Solution Guide Inside FortiGuard