How to Design Linux Security Strategy
Recently, damage caused by attacks targeting Linux servers has been on the rise. Threat actors target Linux servers because they are connected to numerous customer desktops and store vast business-critical data. As Linux-targeting malware and ransomware continue to increase, they now cause severe consequences such as business disruption. Organization must prioritize protecting their Linux servers that contain their critical assets and customer data.
AhnLab has been providing strong security across all endpoint systems, including Linux, through a security architecture that integrates our anti-malware (V3 Net for Linux), sandbox (AhnLab MDS), and EDR (AhnLab EDR) solutions. This architecture has been adopted by many customers and has contributed to their enhanced security. Our platform-centric solutions have also demonstrated outstanding technical capabilities by achieving excellent results in renowned security evaluations.
Below is our Linux server security architecture that delivers powerful protection against major cyberattacks, including ransomware. Solutions within the architecture seamlessly interact with each other to deliver maximum security capabilities; they are powered by comprehensive detection technologies, including static, reputation, dynamic, and behavior detection and analysis.
Figure 1. Our Linux Server Security Architecture
The role of each solution is summarized below.
Figure 2. A Role of Each Solution
#1. AhnLab V3: Detection & blocking of known malware
AhnLab V3, our anti-malware, is backed by thirty years of history and technical expertise. It accurately detects and blocks known malware using its proprietary database containing billions of malware signatures. By leveraging thousands of malicious behavior patterns, it can properly prevent known and unknown malware.
It also delivers ransomware-specific features such as file decoy, application isolation & scan, and a ransomware security folder that quarantines potential ransomware. It also detects and blocks fileless malware by employing process memory detection AMSI (Anti-Malware Scan Interface) technologies.
AhnLab V3 provides solutions for different endpoint devices and operating systems. For Linux servers, V3 Net for Linux provides optimal detection and prevention of Linux-based malware, such as BPFDoor. It also supports cloud security features such as Docker container scan, helping customers achieve true hybrid cloud security.
#2. AhnLab MDS: Blocking malicious emails and analyzing unknown malware
From a Linux security perspective, AhnLab MDS performs sandbox-based file inspection across various domains, including email gateway and inter-network environments.
In the email domain, AhnLab MDS MTA (Mail Transfer Agent) performs a comprehensive scan of the email header, body, URLs, and attachments. It directly accesses URLs in the body to detect cyber threats and analyzes attachments in a sandbox environment. Malicious emails are quarantined to prevent them from entering the system.
The sandbox collects suspicious files via network traffic mirroring and executes them in VMs for in-depth analysis. Linux files are often executed with specific parameters, and AhnLab MDS allows users to directly input files and parameters to check the file’s behavior. It can also simultaneously analyze multiple files in a VM to accelerate malware detection and analysis.
#3. AhnLab EDR: Detection and response to all endpoint events
AhnLab EDR monitors all events across various devices, such as servers and desktops, to detect and respond to endpoint threats. Its core features encompass endpoint behavioral data collection, event correlation analysis, and unified response via AhnLab V3 and MDS integration. The solution is designed to manage threats across all endpoints, minimize the dwell time of unknown threats, and prevent potential damage and recurrence.
AhnLab EDR performs detailed analysis based on the MITRE ATT&CK framework and uncovers various factors, including inflow paths, major behaviors, correlations, severities, and others. Then, it represents the analyzed data in diagrams, timelines, and process trees, allowing customers to easily understand the underlying context.
Its dedicated console, called "EDR Analyzer," optimized for advanced security management, enables users to accurately identify and respond to cyber threats while configuring policies optimized to the organization.
#4. MDR Service: Maximizing the effectiveness of EDR
We deliver the MDR service with our EDR by default to support more effortless operation and an enhanced security experience. Customers of AhnLab EDR can take advantage of services like real-time monitoring, groundbreaking analysis, risk prioritization, optimal response guide, and customized analysis reports delivered by our industry-leading security experts. Customers seeking a higher-level service can use the “EDR Premium” option with an advanced MDR Service. It contains extra services, such as more extensive log analysis and the creation of custom detection rules tailored to the customer.
Download the case study to learn more about our Linux security offering.
