Media 脅威を入口で食い止める

Threat actors employ various tactics to deliver malware or extract data from air-gapped environments, using removable media to bypass traditional security controls and evade detection: 

• BadUSB: Reprogram a USB device's firmware to mimic a legitimate device, such as a keyboard or a network card, allowing the device to secretly execute malicious commands. 
• USB Baiting: Leaving an infected USB drive in a public place with a tempting label, like "Confidential" or "Q4 Plan," that installs malware or requires the user to open a malicious file once connected. 
• Data Transfer: Using the same media used to transfer malware to air-gapped systems to secretly carry sensitive data out of secure environments. 
• Supply Chain Attacks: Compromising media supplied by vendors and contractors by preloading malware onto USBs during manufacturing or distribution. 

A single antivirus engine may only achieve an average of 45.4% detection rate. Since single-antivirus solutions rely on a signature-based detection approach and limited databases of known malware, they fall short against modern, evasive, and AI-driven malware. 

With no patches or signatures and a lack of information to detect an attack, zero-day attacks are often detected only after damage is done. Relying solely on detection instead of prevention leaves critical infrastructure highly vulnerable.

Removable media carrying files of suspicious foreign origin can pose further risks than carrying malware by state-sponsored adversaries. While seeming safe to use, processing files or using software that originated from specific locations puts organizations at risk of failing to meet regulatory compliance and leading to hefty fines.

Adversaries continue to use the latest technologies to develop hard-to-detect malware, from common evasive techniques, such as macros and memory ejection, to behavior-changing, AI-driven malware. These layers of sophistication require multi-layered solutions that prioritize prevention over detection.

With 5 form factors that meet the requirements of various operational environments, even under the harshest conditions, MetaDefender Kiosk™ acts as a physical gatekeeper to ensure all removable media is scanned and validated before use, especially in critical air-gapped environments. Supporting 20+ media types, MetaDefender kiosk scans a wide range of removable media, including USB drives, memory cards, hard drives, CDs, and DVDs. 

With detection rates that reach up to 99.2% with 30+ malware engines, Metascan™ Multiscanning provides enhanced protection from a variety of cyberthreats, reduces outbreak exposure times, and decreases the chance of false positives.

While traditional scanning solutions fail to detect unknown threats, Deep CDR™ is a technology that defends against these threats by sanitizing and regenerating files while keeping their functionality. It helps prevent undetected threats, including zero-day exploits and evasive malware, with 200+ file types supported.

The Country-of-Origin technology detects the geographic source of files by analyzing metadata and fingerprints. Verifying the geographical origin of a file helps organizations avoid compliance violations. 

To protect sensitive data, Proactive DLP™ checks files before being transferred to and from critical air-gapped networks and blocks sensitive and secret data by using custom regular expressions.