Posts Tagged ‘Cybersecurity’
Posted by Tom Kendall in Cybersecurity, Security Intelligence, SIEM
As we have lately read and seen, the style and sophistication of cyber attacks on organizations’ networks have become ever more complex. One type of attack that has had a lot of media coverage in the UK are DDoS attacks, with hacktivists using multiple IP addresses to attack one IP address within an organization, resulting in critical business services and infrastructure being made unavailable. Although this type of attack may not be new news to people, in the UK there has been a lot of fresh exposure, bringing DDoS top of mind.
When reading through these cases it is not the seriousness of the cyber-attack that is the problem, but the late reaction to the attack. These can occur at any time and in many cases the technology is not in place to detect and highlight these immediately. The consequence? A DDoS attack that happens after people have “finished” work are not being acted upon by the Security team until the next morning when the attack has been successful in its mission. This raises the need for organizations to have an effective threat detection system, highlighting an attack to the security team, regardless the time of the day or a DDoS could be used opportunistically to mask other harmful activities.
Real time correlation and effective rule settings allow this to be combated successfully. With the right technology in place, automated alerts can be sent to the security team immediately when there is a suspicious incident, such as a DDoS attack. This allows an instant reaction to occur and enables the security team to be on top of the problem instead of chasing the issue– when it’s already too late to stop or prevent more damage.
For more information on how a next generation SIEM and Log Management solution like QRadar can bring you total security intelligence, changing your security posture from reactive to proactive, as well as responding to “dumber” brute force attacks such as DDoS, download this white paper “The Business Case for a Next Generation SIEM.”
Posted by Tom Turner in Cybersecurity, Security Intelligence, Threat Management
I think we can laugh because it was foiled, but we should be chastened that it even exists as a potential threat. What a topical parallel to draw with the daily fight waged by information security professionals. What an analogy to illustrate the need for sophisticated intelligence gathering and analysis — and the reason why traditional signature detection technologies alone are no longer sufficient to address new attacks such as zero-day threats (like this one).
OK, I realize that last sentence is hard to swallow when your eye keeps being drawn to the large blue image to the right, so allow me to borrow from an article in today’s Wall Street Journal to inject the correct tone. In describing how the underwear bomb has evolved (the latest version had dual detonators to compensate for the design flaw thankfully discovered over Detroit) , there is a very relevant comparison to how cyber threats evolve from one version to the next.
The article then went on to describe what aviation security authorities are trying to learn from the most recent generation of this threat. Change a few of the words and it sounds just like the challenge faced by their information security peers who manufacture today’s important perimeter security controls.
“Investigators are closely scrutinizing the construction of the bomb for clues that would lead to its makers and would also help aviation security experts improve and adjust airport detection systems. Investigators say the bomb contained no metal, meaning would have likely evaded detection by airport screeners.”
Most importantly, the threat was evaded not by traditional detection mechanisms (though these will continue to be important) but by the gathering and analysis of intelligence. One can only imagine the sheer amount of intel that is pored over by analysts in connection with suspected terrorist activity. Not unlike the huge volumes of security relevant telemetry that exists within an enterprise network.
The last parallel only just occurred to me, but it is extremely relevant to the conversations we have with security clients today. An important reason this threat was averted appears to have been due to information sharing between different groups….in this case different countries. A more global perspective on the information security landscape is becoming increasingly important to information security pros today as proved by the importance of groups like FS-ISAC and research from experts like the X-Force.
So there are many analogies that can be drawn from this most recent terrorist threat to the cyber threats facing our networks. Intelligence and information sharing are the keys to success in both cases.
Posted by Chris Poulin in Compliance, Federal, Security Intelligence, SIEM
Last week I participated in a panel on Continuous Monitoring at FOSE. Joining me were Mark Crouter from MITRE as the moderator, John “Rick” Walsh, chief of technology and business processes in the Cybersecurity Directorate of the Army’s Office of the CIO, and Angela Orebaugh, Fellow and Senior Associate at Booz Allen Hamilton. Auspicious company indeed.
For those not tuned into the federal government’s cybersecurity initiatives, the concept of continuous monitoring evolved from the previous approach in FISMA (federal information security management act), which mandated annual reviews of federal agencies’ security programs. After a few years of implementation it was widely recognized that the reviews generated rooms full of paper, which were obsolete as soon as they were printed, but didn’t elevate information security plan effectiveness to an acceptable level. Between 2006 and 2010, the number of security incidents rose by over 650%. The resulting strategy is embodied in FISMA 2012 (2.0), which is aimed at continuous monitoring of security controls, determining gaps between current and accepted security baselines, and quantifying risk.
Rick has been facing the challenges of implementing continuous monitoring within the government, and his experience has been that the different business processes, missions, and systems create obstacles, but once overcome, the solution yields financial and process efficiencies, and improved security. One of the biggest challenges is enumerating the assets, but once done is sure to reveal duplication of systems and opportunities to consolidate systems and software licensing.
Angela framed the conversation in her intro, which was appropriate since she co-authored NIST Special Publication 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations. She has also been involved with the Security Content Automation Protocols (SCAP, pronounced ess-cap) project, which provides a set of standards for describing vulnerabilities (CVE, common vulnerabilities & exposures), systems (CPE, common platform enumeration), and configuration standards (CCE, common configuration enumeration), as well as a scoring system (CVSS), a test definition language (XCCDF), and a vulnerability definition language (OVAL). Angela advocated use of SCAP as a foundation for continuous monitoring.
Questions from the audience mainly focused on how to implement continuous monitoring, including getting buy-off from senior management and budgeting. The key is to show short-term results that are meaningful to business stakeholders. While continuous monitoring is in the process of being mandated, the danger is treating it as a checklist and doing the bare minimum to comply; whereas, when done right continuous monitoring can be the cornerstone for real security improvements, including interrupting the kill chain through early attack detection, provide total visibility to include troubleshooting operational problems, and give management a security dashboard with both technical and business gauges. The State Department was one of the first successful adopters of continuous monitoring and was able to not only ameliorate their high-risk vulnerabilities by 90%, but also slash the cost of certification and accreditation by 62%.
One of the more amorphous questions was how continuous is continuous? Does data need to be analyzed in real-time or near real-time? Does this apply to all systems? The answer is that it depends on each individual agency’s goals and the telemetry that can be collected from the systems. Organizations don’t want to have to retool systems to provide events as they occur–unless the systems are critical enough to warrant that cost and effort and there is no other way to gain the needed visibility. The panel all agreed that some systems only need to report into a central monitoring solution on an occasional basis–vulnerability scanners, for example–while network monitoring should report in near real-time, which means in one-minute intervals for most systems that create NetFlow records. Ultimately, there is no one-size-fits-all answer.
My overall impression from the panel is that continuous monitoring to the federal sector is what we call Security Intelligence in private industry, and both need to be defined and implemented per the enterprise or agency’s specific needs. The primary difference is that continuous monitoring is focused on metrics: quantifying the delta between expected state of assets and the measured states and classifying these differences as vulnerabilities. The scorecard approach provides a common baseline for different organizations to compare themselves against each other, and for management to better understand their organizational security posture at any given moment in time and compare it against past performance.
I was asked at the GTRA conference how the public and private sectors differ. My view is that the government does more up-front analysis and planning, while the private sector sees a need and builds a solution. Between well-considered frameworks, like FISMA 2.0, and tools like QRadar and OpenPages, the federal government and industry have an opportunity to collaborate on a complete Security Intelligence solution incorporating continuous monitoring and meaningful security scorecards and dashboards.
Click here to learn how Security Intelligence can help Federal organizations address continuous monitoring requirements. Find out how QRadar Risk Manager addresses the need for configuration auditing, and assessing the risk of configuration changes, across multi-vendor network environments (switches, routers, firewalls and IDS/IPS).
Posted by Melissa Stevens in Cybersecurity, Security Intelligence, SIEM
Have your security practices been guided by old wives’ tales and horror stories of installations past? In this article for Security Week, Chris Poulin explains why it’s time to revisit your security posture, especially when it comes to SIEM and Security Intelligence. Don’t let superstition influence your strategy!
“Another area where superstitious habits aren’t effectively influenced through SFP [self fulfilling prophecy] is information security. And yet we continue to spend a good part of our security technology budget on the latest iteration of firewall technology–application firewalls, UTM gateways, data diodes–and anti-virus, the perennial favorite, even though conservative figures estimate that A/V protects endpoints from less than 50% of current malware. Granted, much of this spend is aimed at preventing data leakage, which is a positive shift from the perimeter defense strategy, designed primarily to keep out external threats.”
Read the full article to learn how a next generation SIEM, the cornerstone of Security Intelligence, can help keep your organization protected against today’s threats, and why Chris thinks trying to operate without Security Intelligence is equivalent to insanity!
Posted by Michael Applebaum in Cybersecurity, Network Intelligence, SIEM, Threat Management
You know that QRadar SIEM excels at collecting, correlating and reporting on unusual activity, but have you ever wondered how it performs user activity monitoring? Or what value this would have for your organization?
In this new 8-minute YouTube demo, we look at how the integration of identity and access management data enables real-time user activity monitoring. We show how QRadar can identify risky or abnormal activity of user groups such as employees with privileged access, contractors, or terminated employees.
What value would user activity monitoring provide? You might care about a number of use cases:
- A terminated employee taking action on your network (if terminated, how is he or she still on your network?)
- A privileged employee accessing databases she doesn’t usually access (is she performing malicious activity? was her account compromised by an attacker? or did her responsibilities just change?)
- Is an employee from one geography, who does not travel for business, seen performing activity in a different geography? (was his account taken over?)
- Is a contractor accessing a database or application that he doesn’t require for his job? Can he be trusted? do his actions require closer monitoring?
- And many more exmples specific to your business.
Without a SIEM solution that can correlate identity and access management data with network activity in real time, most organizations would miss these risks. But QRadar provides the visibility to know whenever a user performs activity that is risky or abnormal. Whether you want to be alerted to security and risk incidents in real-time or view automated reports periodically, QRadar makes it easy to take a proactive stance toward user risks and improve your security posture.
For more information, visit the Q1 Labs Resource Center today.
The latest on Cyber Security