Posts Tagged ‘flows’
Posted by Melissa Stevens in Cybersecurity, Log Management, Security Intelligence, SIEM, Threat Management
“… there are other ways to move from a position of constant and reactive defense to a state of preparedness: sharing our individual experiences. The bad guys are already organized and collaborating effectively on how to compromise our systems; we need to start sharing, and sharing openly.”
How do we beat the bad guys at their game? That’s the question Chris Poulin is asking in this new article for part of his ongoing series at SecurityWeek. The answer? Thinking like your adversary. Well, at least that’s part of it.
In his latest article, “Compromise Full Disclosure: Collective Knowledge Brings Stronger Defense,” Poulin explains how, in order to fight organized cyber attacks, security professionals need to be more organized themselves. This means more collaboration, knowledge sharing and, of course, the adoption of security intelligence. The end goal is to create an environment where breaches and the details of the attack (and not the vulnerability) are shared among professionals so that others can learn from these attack strategies and prevent their own breaches.
Click here to read the full article and share your thoughts about Poulin’s call for more full disclosure.
Posted by Michael Applebaum in Cybersecurity, Security Intelligence, Threat Management
Give up the façade of control. Trust no one. Verify everything. Resistance is futile.
Image attribution: http://bit.ly/r3Wnre under http://bit.ly/r9ywD2
Okay, I added the last statement, but the first three come straight from a recent Forrester Research report, “Applying Zero Trust to the Extended Enterprise” by John Kindervag. In today’s zero-trust environment – driven by mobile computing, cloud computing, social media and partner collaboration – it’s impossible to control the network perimeter, the number of users accessing the network or the configuration of devices connecting to the network. It’s also impossible to predict when an employee will attempt insider theft or fraud, rendering the notion of a trusted insider obsolete.
As John first wrote last year:
“The concept that there are trusted and un-trusted users is errant and dangerous. This is something we call Zero Trust. … Some of the key components of Zero Trust are that all users are un-trusted and that all traffic, both internal and external, must be inspected and logged.”
This blurring of profiles between internal and external networks means organizations must perform comprehensive monitoring and analysis of all their networks, all the time.
John’s absolutely correct in my view (he was a security systems integrator before joining Forrester), but how do you do it?
Let’s consider three of the report’s recommendations, and apply practical Security Intelligence solutions for implementing them:
- Monitor what users are doing on the network. Forrester advises companies to monitor their employees’ activity on the network, because as the 2011 Verizon Data Breach Investigations Report notes, “insiders were at least three times more likely to steal IP [intellectual property] than outsiders.” This can be accomplished with a user activity monitoring solution that establishes baseline patterns of activity for each user, and then creates alerts when anomalous behavior is observed – applications/systems accessed, volumes of data sent/received, and so on. Security Intelligence solutions today provide a 360-degree view into what users are actually doing and the potential impact of their activities – by collecting and correlating not only log data, but also Layer 7 network flows, asset data, configuration information and vulnerability data to cover the pre-threat exposures.
- Inspect and log all traffic. As if you needed another reason to collect and analyze logs, Forrester highlights one of the Verizon breach report’s more striking observations – that good evidence of breaches usually exists in the victims’ log files. John therefore recommends “inspect[ing] and log[ging] all traffic… [using] threat mitigation controls such as firewalls and network IPSes, security information management (SIM) solutions, and network analysis and visibility (NAV) tools.” Logging is already well understood and commonly performed, but inspecting all traffic? That’s a whole other animal. One of the key points I take from this report is the importance of triangulating intelligence on risks and threats through multiple types of network data – logs from firewalls and IPSes, network flows from NAV solutions, and much more, all correlated and analyzed by a SIM/SIEM solution. Logs, even from multiple sources, aren’t enough any longer; deeper network insight is required. Security Intelligence technologies are equipped to provide just that through Layer 7 flow analysis which is incorporated into a holistic and strategic security solution.
- Deploy NAV tools to watch data flows and user behaviors. This recommendation elaborates on the need for situational awareness via proactive monitoring of internal networks. Would you know if an employee were stealing valuable product plans? Or downloading customer data to take to a competitor? Or if his system had been silently compromised by a bot? These are often difficult to detect until well after the fact, if ever. But a modern Security Intelligence solution will consume and correlate all the data you need to identify these scenarios in real time, by taking a 360-degree view of suspected incidents and ruling out false positives. That may sound like a tall order given the frequently massive data volumes involved, but current solutions are architected for just this kind of scale.
Ultimately, I suspect that most security and networking professionals realize “zero trust” is the right approach to take. The question is how to embrace that view and evolve one’s security operations.
Hopefully the ideas suggested here – and in my “Six Things You Always Wanted to Know About Security Intelligence but Were Afraid to Ask” blog series – will provide ideas and inspiration to enhance your own security posture. Please share any thoughts on how you are evolving your organization’s security operations to respond to the new zero-trust reality.
Posted by Michael Applebaum in Compliance, Risk Management, Security Intelligence, SIEM, Threat Management
This is part 4 of an ongoing series of posts that answer “Six Things You Always Wanted to Know About Security Intelligence but Were Afraid to Ask.”
With a firm understanding of Security Intelligence (SI) in hand, let’s get down to brass tacks and review the benefits organizations are gaining from their SI deployments. Here are several real-world examples:
Improved Compliance
Like it or not, regulatory compliance – for PCI DSS, HIPAA, NERC CIP, SOX and many others – is a major driver of security initiatives. Although compliance doesn’t guarantee a secure environment, compliance will always get attention and budget because of the potential penalties for failure. Complying with relevant mandates is just the start of enhancing one’s security posture, but it’s an important first step. Security Intelligence aids both regulatory and internal policy compliance by logging and proactively monitoring diverse information across the enterprise in real time, providing accountability, transparency and measurability. It delivers practical value through automated reporting and easy searching of logs, flows and much more.
David Blackburn of California ISO, the electrical grid operator for 80 percent of California, notes, “Compliance was the chief driver in our purchasing a SIEM [solution]. We have many tools that monitor and analyze, but there was no centralized logging capability that [could] analyze those logs and give us good information quickly.” Hear more about how California ISO uses Security Intelligence for NERC CIP compliance in this video.
Faster Detection and Remediation of Threats
In the post-perimeter world, focusing solely on prevention is a noble but losing proposition. Boundaries are porous – think mobile computing, social media and cloud computing – and there’s a heightened risk of insider theft, leading to what Forrester calls a “zero-trust” environment. Security Intelligence solutions address this reality by helping businesses detect and remediate breaches faster. They have become adept at finding the needle in the haystack, by correlating massive data volumes in real time. This includes events from network & security devices, servers, applications, directory servers; network activity flows with Layer 7 visibility; asset information; configuration data; vulnerability information; and more. (If you think SIEM solutions have already been doing this for years, think again.) SI solutions also aid in remediation by identifying which assets and users were potentially affected by a compromise, and by capturing application content for forensic activities.
Adobe Systems senior network security manager Leon Fong discusses the benefits Adobe received from Security Intelligence in this video. He explains that QRadar detected threats other security products missed:
“Within 2 months [of deploying the solution], the conficker worm starting hitting our network. I noticed that we were getting a lot of heavy TCP port 445 traffic being denied by our firewalls. The next day, the traffic grew 10-fold. I had to notify our antivirus team that this needed to be looked into. Soon after, McAfee sent a note of this worm being prevalent. In this case, the SIEM solution [QRadar] found the problem before McAfee was able to.”
Reduction of Insider Fraud, Theft and Data Leakage
External attacks garner most of the headlines, but insider threats can be even more damaging – compromising invaluable intellectual property and even jeopardizing national security. We’re all familiar with WikiLeaks, but few organizations have come to grips with the true risk of insider threats. Would you know if an employee was sending key product plans to a competitor, anonymously publishing confidential information, or accessing financial information that could be used for insider trading? With Security Intelligence solutions, organizations can identify and mitigate those inside threats and many more, by detecting the following:
- Unauthorized application access or usage
- Data loss such as sensitive data being transmitted to unauthorized destinations
- VoIP toll fraud
- Application configuration issues such as privileged access exceptions
- Application performance issues such as loss of service or over-usage
A multi-billion-dollar branded consumer products firm recently used its SI solution to detect an attempted data exfiltration by a trusted employee for financial gain. The company’s executives suspected its intellectual property was being leaked but couldn’t identify the source. When they applied flow-based network activity monitoring to the situation, they were able to quickly track down the data leakage and stop the employee. With application content capture, they could even drill down and view the specific emails sent by the employee through his personal email account to the third party. This prevented the problem from snowballing and potentially causing millions of dollars in damage to the firm.
Pre-Exploit Risk Reduction
Sure, I just finished explaining how you can’t focus only on threat prevention in a post-perimeter, zero-trust world. But that doesn’t mean you have to give up on prevention either. No one is ripping out all their firewalls or IDS/IPS products. Likewise, you shouldn’t overlook some of the more cutting edge approaches to pre-exploit risk reduction. Three ways SI solutions are helping customers prevent compromises today are by:
- Automatically monitoring device configurations (e.g., firewalls) and alerting on policy violations
- Prioritizing the multitude of vulnerabilities reported by vulnerability scanners
- Performing predictive threat modeling and simulation of network changes
These may sound familiar, but modern SI solutions surpass yesterday’s point products by applying greater intelligence to a broader set of inputs. Network activity flows, for example, provide a more complete view of the effectiveness of security device rules than configuration data by itself. As my colleague Brian Mehlman writes, “[Configuration data alone can] miss situations where a configuration is thought to be adequate but for some reason still allows potentially risky network traffic to propagate.” Similarly, knowledge of network topologies can “minimize false positives common among vulnerability scanners and … [prioritize vulnerabilities] that can be easily exposed because of the way the network is configured.”
A major electric energy transmission company uses QRadar Risk Manager to perform centralized device configuration monitoring and auditing, thus reducing the risk of security breaches. Because the solution monitors multiple vendors’ security products and uses flow analytics (QRadar QFlow) to paint a rich picture of exposures, the company believes it has significantly strengthened its security and risk posture. The fact that its risk management capability is part of a broader Security Intelligence solution also reduces training and staffing requirements.
Simplified Operations and Reduction of Effort
Lastly, SI solutions are applying intelligent automation to simplify security operations and reduce the burden on security and network professionals. IANS just published a study of the Return on Security (ROS) achieved by two large customers, and the findings were compelling. In addition to estimated risk reduction benefits of $13.5 million, the objective benefits (net of all solution costs) were estimated at $550,000. These stem from greater efficiencies and elimination of tedious manual tasks. Again, these were the benefits reported by the customers based on actual experience. The full report can be accessed here.
How do these benefits compare to what you’ve received from security solutions? We welcome comments about your own real-world experiences.
Posted by Iven Connary in Cybersecurity
The first step a smart cyber-criminal takes is to turn off logging at the host, blinding the SOC. But you can’t turn off the network. Network activity monitoring is a security fundamental that some organizations do without, at their peril. Effective analysis of network session activity, known as flow data to router jockeys, involves not just the collection of data, but also the ability to correlate that data against log events and other security activity across your enterprise.
The first question to consider is how deep to dive into the activity crossing your networks? Are you limited to Layer 4? Are you blind to the bad guys in your virtual infrastructure? If so, you don’t have the complete level of visibility needed to fully secure and monitor your environment. Without application -layer intelligence, you aren’t protected against more sophisticated attacks, and internal attacks such as fraud and theft of IP.
For instance, bots have evolved to keep pace with security countermeasures. They hide in seemingly harmless protocols, such as HTTP, and use encryption to evade IPS and firewall detection. Application-layer visibility provides the intelligence to distinguish botnet command and control activity from otherwise innocuous web traffic, and can even distinguish between valid encrypted data and that meant to obfuscate the application. Without application-layer visibility, you can’t comprehensively detect, respond to, and investigate policy violations, exploits, and intrusions.
But you are not done yet. Now that you have an accurate picture of your network activity, you need to be able to correlate it, analyze it, and, if there is a policy violation or intrusion, generate an alert. To effectively do this you must have:
- Native flow analysis, integrated deeply into the solution so it understands the value of network telemetry vs. log events
- Correlation of network data in real time, not just as post-incident forensic data
- Retention of application layer content retention; converting flows to logs discards critical forensics information
Leveraging network activity delivers total security intelligence (and provides intelligence beyond simple log collection) and results in the improved ability to detect and remediate threats, enforce network policies, and minimize risk to mission critical IT systems. If you can’t get to Layer 7 and aren’t able to collect, correlate and analyze that data, you really don’t have network activity monitoring support.
The latest on Cyber Security