Enterprise Security Blog

Is a NEW internet the only road to a SECURE internet?

John Markoff’s article in the “Week in Review” section of the February 15, 2009 issue of the New York Times is a “New Internet Really?”  

Much as we are not able to start over with a new green environment when dealing with global warming, it is equally impossible to start over fresh when it comes to the Internet. In both the case of dealing with global warming and making the internet a safer place, one has to develop a strategy, come up with a workable plan, and plan for it to work in the long term.

Markoff’s article describes work being done at

Stanford

University

– the so-called Stanford Clean Slate Project – whereby “… researchers are creating a system to make it possible to slide a more advanced network quietly underneath today’s Internet.” If you go to the Stanford site you learn that the researchers “… believe that the current Internet has significant deficiencies that need to be solved before [the Internet] can become a unified global communication infrastructure.” There is a quote on the site that implies that the implementation of the new architecture will be achieved “…before [the Internet] can become a unified global communication infrastructure.” Where do they think we are today? The Internet is already a global communication infrastructure, upon which we all depend every moment of every day.

When you read the publicity material, you get the sense that, if anybody can do it, the folks in the Clean Slate Lab probably have as good a chance as anybody to achieve their goal. But closer examination raises a few legitimate doubts.

First there is the idea of sliding a new network under the old without disrupting the latter sounds a bit like changing the wheels on a moving car. Taking the car analogy a little further, an analogy which I happen to like, you could have the equivalent of a driver’s license to be able to attach to the new Internet. I also like the idea of having your equipment and software pass an inspection -  though not annually – every second year sounds about right. If the system fails, then it has to be fixed before it is allowed back into the network.

The key point: even if the new technology works (and we don’t have reason to think that it won’t work), implementing and enforcing it could be a major hassle, up to and including failure of the new technology to be adopted by a critical mass of Internet users.

Markoff admits that until one can prove identity (the fake license syndrome) “… building a completely trustable system will remain virtually impossible.” I would add that it will remain “really impossible,” since the success of the project is based on a supposition that is highly unlikely to occur.

Which Insiders Have Too Much Access?

A few years ago I had the opportunity to meet Steve Katz, an industry speaker and mentor and most recently a blogger at www.bankinfosecurity.com Intellitactics sponsored the Luminary Leadership      Award at the Information Security Executive of the Year awards program run by the Executive Alliance. Steve was being honored and several IT security execs spoke about Steve's mentorship. Recently, his blog covered a topic that is front of mind with many security professionals: reducing the threat of insider attacks. The blog is exactly the kind of advice that I imagined Steve gave to all his proteges - the advice that earned their respect and admiration.

His blog gives great advice for tackling insider threat. Three simple steps:

Look for changes in attitude or behaviors on the job

Use available tools: segregation of duties, dual controls, access violation reports

Monitor activity and report on it

Sounds simple enough, right? Well, there are many organizations that haven't discovered the value of automated reporting and the benefits of sharing those reports for review by the business. Business managers need to get in the habit of examining who has access to the data?

Intellitactics advice to users of our SIEM products - Intellitactics SAFE or Security Manager is much the same as Steve's advice in the blog. There are dozens of reports on access controls in our products - use them and share them.

Access is implicit or explicit in just about every regulatory standard - especially obvious in PCI. The reports can be scheduled to run automatically, can be distributed to business managers, can be used by the audit team and all the data is accessible for understanding the context and speeding the investigation of access abuse.

The conviction of Roger Duronio whose alleged actions took down 2000 servers at UBS and Terry Childs who allegedly wreaked havoc on the City of an Francisco’s network created a spot light for the risk posed by granting full administrator or root access to a network. Diligent review of access to information can prevent these abuses and the negative impact of data loss on businesses. 

F-Secure. . . Really?

I asked a simple question:  Why do companies take risk with risk? I was thinking about the industry advice of "defense in depth" and wondering why companies ignore this maxim when using security service providers or outsourcing security. So I asked Warren Axelrod, who's written and spoken extensively on outsourcing security. Here's what Warren had to say about the recent attacks on security experts.

It was particularly distressing to those of us who might be dependent on third-party information security services to learn that a Romanian hacker had successfully compromised the web sites of three well-known security firms, namely, Kaspersky, F-Secure and BitDefender, all in the second week of February.

That same week I happened to be giving a course on outsourcing risk and information security, which is based on my book Outsourcing Information Security. I like to present a two-by-two matrix showing the four possible combinations of outsourcing and security, namely:

• Security aspects of IT functions that are to be outsourced
• Security risk considerations when outsourcing security functions
• Outsourcing of outsourcing, that is, subcontracting, and
• Security postures of security services providers

The second and fourth items are the most relevant to a discussion of the breaches that were experienced by these prominent security firms, as mentioned above. Justified or not, we expect security firms to be a step above (or ahead of) the rest of us. And being told that the data, which were reportedly accessed by the hackers, were likely not very sensitive, doesn’t make us feel any better. The truth of the matter is that the security professionals’ professionals are not immune from such attacks. So what hope is there for the rest of us? How can we trust the gurus’ advice or trust them to protect our companies’ information assets?

This has to be a wake-up call for all of us. If we can’t totally rely on “experts,” then we need to take on more responsibility ourselves – which is what I have been advocating all along. Yes, you should continue to hire experts, but you have to recognize and allow for their limitations. And you need to realize and accept that even if you outsource the functions, the responsibility and the liability remains with you.

So here are my suggestions … Do not totally rely on single points of failure, because they do fail, as we have seen. It’s an old saw, but “defense in depth” is the way to go, so that you do not depend on just one layer, which may be easily breached. With defense in depth, a hacker gets through one defense layer, but is then confronted with another … and another. It’s like having a moat, a heavy castle door, thick walls and archers firing arrows through narrow slits, not to mention the boiling oil poured on attackers from the parapets. And watch out for the Trojan [horse]. It’s even better if you monitor what is happening when an attack is in progress. That way, you will know in real time how effective all your defenses really are.

 

 

Are security breaches cheaper in a recession?

We don’t hear about every data breach. We hear about the big ones but for every big one there are lots of less consequential ones that don’t make the headlines. But the average data breach – the ones we don’t hear much about are still costing millions in lost business and clean up costs. Consider this claim from the latest Ponemon Institute survey: the average data breach costs organizations $6.6 million. Of that, $4.6 million, or about two thirds of the cost, is related to the resulting loss of business. We live in interesting times. Today, many businesses are experiencing losses that have little or nothing to do with security breaches. And for some unexplainable reason, in reaction to these losses some executives are thinking of cutting back on security spending to trim expenses. We asked security exec, writer and speaker Warren Axelrod how executives are evaluating security spend in difficult times.

 

Dr. Axelrod:  Well, first, losses in business can be due to many factors; just look at the auto industry’s 50 percent drop in sales. If the drop in sales was attributable to a loss of confidence resulting from a data breach then we would see spending in the billions on information security in the auto industry. However, one would be hard put to try and prove any relationship between the auto giants’ losses and a security breach. In the face of shrinking profits and revenues, does the “loss” resulting from a security breach suddenly have less value? Could this be the rationale for management cutting security expenditures?

It may be true that the dollar amount of the loss, particularly in regard to reputation and customer loyalty, may be less relative to overall financial losses: shrinking revenues, stock values etc.  But this rationale ignores an important fact: the probability of loss is much greater from both insider and external threats. More employees are disgruntled and despondent; laid off employees carry grudges and seek revenge; and, external attackers are more motivated to perpetrate fraud in these difficult economic times. These increases are already being seen and reported.  

 

Expected loss from an increasing number of attacks is the mathematical product of the probability of an event and the amount of the loss were the event to occur. If losses are going down (which is debatable) and the probability of compromise is going up, the result may go up or down depending on the relative values. However, if you believe that the recession is leading to greater expected losses, then it behooves the security professional to monitor systems and transactions even more carefully than before. Even if each incident were to have a lower associated cost, the number of potential incidents is likely to increase significantly.

 

Sunil Bhargava:  Intellitactics is making it easier to tighten your budget while keeping a SIEM to automate compliance and strengthen security in your budget. Intellitactics SAFE is right sized - you don't have to buy more than you need. SAFE enables you to defer additional staffing because the SAFE appliance acts smart - like a high paid analyst - improving understanding and speeding investigation of attacks. 

Getting a Good Deal on a SIEM - Lowest Total Cost

When we asked Dr. Axelrod to comment on Satyam controversy a few weeks ago, we wondered about what role the clients of Satyam may have played in their behavior. He wrote a post for Intellitactics, which follows, with some practical and logical advice on "getting a good deal" from your outsourcing partners. Intellitactics has premier MSSPs who use our software to service their clients; in fact in a recent tally we count over 3000 companies that benefit directly from Intellitactics Security Manager and/or SAFE as they are used by their selected MSSP (managed security service providers) to provision monitoring and reporting. And we think that MSSPs are going to play an increasingly important role in helping companies achieve their compliance objectives so maybe advice on negotiating terms will peak your interest. 

From the desk of Dr. Axelrod: Were clients to blame for the downfall of Satyam? You might be offended by or skeptical about the question I pose. But consider it in the context I describe. I refer you to an article “As Indian Outsourcing Changed, Satyam Hesitated” by Heather Timmons and Jeremy Kahn in the January 12, 2009 New York Times. The reporters wrote: “Perhaps to make up for the market share it might be losing, Satyam started to underbid its competition, putting pressure on its own profit margins.”

In my book Outsourcing Information Security I advise against putting too much economic pressure on smaller companies. They want your business and they want to stretch to grow, but what you ask and what they are willing to do may indeed put them out of business. For example, clients may have reaped the immediate benefit of a discount of about 20 percent for Satyam consultants versus those of its larger competitors. It’s possible that even if a massive fraud had not been perpetrated, Satyam could have been forced out of business or forced to sell to one of the big guys. Yes, with 53,000 employees Satyam could be considered large, but they were dwarfed by the likes of Tata, Wipro and Infosys.

The balance of power is an important aspect of all outsourcing relationships, as it can easily impact the ongoing viability of either party. A small client may be relegated to high billing rates and second-class service from a large outsourcer. A large client may be able to force a smaller outsourcer into financial terms that will threaten the latter’s very existence. Size is after all relative. So, next time you are negotiating with an outsourcer, by all means push to get the best deal that you can, but remember that it is in your interest to have the outsourcer continue as a viable and profitable entity … so don’t squeeze too hard.

Dr. Axelrod's advice seems sound and we started thinking about the advice as it applies to "getting a good deal" on aSIEM like Intellitactics SAFE and Security Manager. Dr. Axelrod's advice on negotiating the cost of an outsourcing agreement applies to buying a SIEM - whether you're considering a software solution or an appliance we advise you consider one important step: Make sure you understand all the costs.

1. Lots of appliance providers don't tell you that you'll need multiple appliances to achieve your goals - and multi-appliances translates into higher cost. Intellitactics SAFE is different - all the capability, required storage and power for processing comes on ONE right-sized appliance.

2. Determine how many people you'll need to get the benefits from the product you're choosing. Some of Intellitactics' clients don't have one full time person focused on security. Others have 3 shifts of 8 people servicing the security needs of their organization. We have product that works for both at a price point that meets their budgets. Whether you choose are highly configurable software solution (ISM) or the simple to use appliance (SAFE) you won't have to add people to extract the value.

3. Finally, make sure the product you buy solves your short term need but has the functionality and scale to service your long term vision. Hundreds of companies select the lowest cost product only to find that a year later they need, not just want, a more capable product to protect sensitive and compliance related data. "Do-overs" cost money.

Netflow - Worth it?

Netflow - data and lots of it. Net flow is a piece of a bigger puzzle -  important but not useful by itself - too much data for a human to consume and analyze in time to do anything about it. Richard Stiennon writes on netflow and wonders why more people aren't buying netflow utilities.

Here are some ideas: 

Buy an open source utility for collecting netflow data and use your SIEM (like Intellitactics) to make sense of netflow in the context of other network security events.  

Buy Lancope which delivers a bigger solution with more actionable information and integrates with SIEMs like Intellitactics.

Buy Mazu (now Riverbed) and get first class integration with the most complete SIEM solution available - Intellitactics Security Manager.

Use your Cisco netflow utilities and collect the Cisco data with Intellitactics SAFE or Security Manager along with firewall data, IDS data and NAC - and really understand what's happening on your network.

Netflow data - is it worth it? Absolutely when you have the context and correlation in a SIEM to really appreciate the value.