Malware defense moving to isolation

ishotjr2

A few people have posted recently "I am in career Y and want to become a malware analyst". I think this technology/techniques is reaching its date of expiration for the broad market. There will be still lots of malware analysis but its place in the frontline will be held by other technologies.

When I first heard of sandboxing I thought the idea was obvious but not worth doing because of the compute power required. I think the market/specialists are turning away from sandboxing now because of its limitations.

I think the new technology that will come to the fore front will be isolation in a number of forms. Cloud Desktops where the VM is created ad-hoc and destroyed after short term use. Browser Isolation appliances like (https://spikes.com/index.html) who house the browser and then export the screen using HTML5. Then there is also Menlo Security. There is of course Qubes https://www.qubes-os.org/ also.

The above may be obvious to many here, but I wonder do others see the same trend gathering momentum.

syklops

/me gets some popcorn.

The invention of the bullet proof vest didn't spell the end for the gun.

Virtualisation aided malware analysis in a massive way... until malware authors started writing virtualisation detection functions into their malware which self destructed the malware.

Its an arms race.