The problem that the OVH Security Operations Center (SOC) team has decided to tackle is curbing the proliferation of malware and ransomware, the latter of which has been particularly on the rise for the last three years. These programs infect computers and servers to encrypt their data and extort money from their owners, or to transmit it to third parties, through mechanisms as complex as those used in offshore finance. Sometimes they also take control of machines to form a botnet (a network of infected computers) designed to launch distributed denial-of-service (DDoS) attacks.
 
OVH has implemented an environment that allows monitoring malware activity without affecting the local network or actually infecting a machine, based on virtual machines. Thus, when a client's server is detected as having been hacked, the owner is notified and prompted to correct the vulnerability and clean or reinstall their virtual machine. If they fail to do so, OVH suspends the server.
 
OVH's goal is to take a proactive approach, picking up on the faint signals that herald new methods of operation. Frank Denis, a security expert at OVH's Security Operations Center (SOC), states: “If we detect malware before it acts, it's more of a deterrent for cybercriminals. We will always be vulnerable to highly specific attacks for which, by definition, there is no pattern to detect. But at OVH, we make these criminal activities more difficult by hindering them as much as possible.”.
 
In this context, there is also work to be done on the awareness front. Because at the root of an infection there is usually human error, or at the very least a lack of caution. Regarding personal computers, email remains a highly effective vector for infection, closely followed by malicious banner ads (malvertising) and exploit kits that exploit software vulnerabilities.

More information