Research

The question of stopping targeted attacks has been on my mind for a while. Of course my partners and I have to suffer through far too many vendor briefings where they claim to stop an APT with fairy dust and assorted other black magic. But honestly, it is a legitimate and necessary question. Ever since Google came clean a few years back about Aurora, and everyone then acknowledged the persistent, likely state-sponsored attacker as a class of adversaries, vendors have been APT-washing their stuff trying to convince anyone who would sit still that their run-of-the-mill IPS or endpoint protection product had a chance. Basically this rash act was necessary to keep the cash cow hemorrhaging money, even in the face of mediocre (or worse) efficacy of existing controls. But here is the thing these vendors missed. Very few of the adversaries most organizations face are advanced or persistent. Most are today’s version of script kiddies trying to smash and grab their way out of the despondency of their existence. It’s much easier and more lucrative than robbing a bank, after all. So most existing controls still have some role to play in tomorrow’s defense. But we all know existing controls are not sufficient. Yet targeted attacks do exist, and the legitimately advanced attackers are now targeting further afield to achieve their objectives. They are attacking the supply chains of their targets to gain deeper footholds, earlier. And now that we have a better idea of the tactics they are using, we start to see offerings built very specifically for these kinds of attacks. I won’t say we’re seeing real innovation yet, but lots of vendors are learning and evolving their offerings to factor in this new class of attacker. Unfortunately it’s still way too early to get a feel for whether real innovation is happening (or will happen), or whether this is just a classier version of APT-washing. Regardless of what happens on the prevention side, you still need to monitor the hell out of your stuff. As Mandiant described in a blog post that has since disappeared from their site (wonder if they’re now doing work for Global Payments, hmmmm), the folks at Global Payments evidently found the first breach themselves by monitoring their egress traffic and seeing stuff they didn’t like leaving their network. Was it too late? Of course. But it’s a hell of a lot better to catch it yourself than to hear from your payment processor or the FBI that you have a ‘problem’. We will see a lot of new stuff, as everybody tries to get ahead of attacks – even targeted ones. But it’s career-limiting to plan on stopping them; so we still push investment in monitoring, forensics, and response – even in the presence of new and innovative protections. Or is “Can you stop a targeted attack?” the wrong question to even ask? Photo credit: “Bullseye” originally uploaded by bitsofreality Share:

Be quiet. Be vewy vewy quiet. Now listen. What do you hear? Listen very closely. Do you hear anything? No? That’s exactly the point. The Boss and I woke up yesterday morning to the sound of nothing. No grumbling about having to get ready for school. No kvetching about ill-fitting bathing suits, and no asking for this play date or that activity. No crappy Disney Tween shows blaring from the TV. No nothing. The house is quiet. On Sunday we put the kids on the bus for sleepaway camp. Barbarians that we are, we ship the kids off to Pennsylvania every summer. The girls go for 6 weeks. The Boy is going for 4 weeks, as it’s his first summer away. So for the first time since XX1 was born, we will have the house to ourselves for longer than a day. Will we miss the kids? Of course. We huddle around the laptop every night and look for pictures posted on the camp website. We dutifully write them letters every day. Well actually, we type the letters into a website, which then prints a copy for delivery to them. We’ll trudge off to the mailbox every day, hoping we got a letter. But we will also enjoy the time they are away. We’re going to see Earth, Wind and Fire tonight – and we don’t have to worry about arranging for a baby sitter. We may take a long weekend at a nearby resort. Or we might not. We can sleep late. We can work late. We can go to the pool at 2pm if we feel like it. We can BBQ on Wednesday, and I could party on Friday night, knowing that I don’t have to wake up early to take a kid to a game or activity. Best of all, I can spend quality time with the Boss without the constant crushing pressure of being the involved parents of active kids. We don’t have to worry about who’s making lunches, or picking up from the dance studio, or folding the laundry. Two adults don’t really generate that much laundry. These quiet times also prepare us for the inevitable, when the kids leave the nest. Lots of parents forget to have their own relationship because they are too busy managing the kids. Not us – for here on, our nest will be empty every summer. We are painfully aware that the kids are with us for a short time, and then they will live their own lives. And 6 weeks every summer is a big chunk of their summer vacation. Like everything, it’s a trade-off. Ultimately the decision is easy for us. They learn independence and how to function as part of a group, without their parents telling them what to do. We take very seriously our responsibility to prepare our kids to prosper in the wide world, and I don’t think there is a better place to apply the skills we teach them than at summer camp. It’s also great for the kids. On the first day we have seen the boy at the pool, at the lake doing paddle boats, at the firing range, playing basketball, and watching some kind of show put on by the counselors. That was one day. So as barbaric as it may seem to send our kids away for that long, there is no other place they’d rather be every summer. And that’s a win/win in my book. –Mike Photo credits: Empty Nest originally uploaded by Kristine Paulus Heavy Research We’re back at work on a variety of blog series, so here is a list of the research currently under way. Remember you can get our Heavy Feed via RSS, with all our content in its unabridged glory. And you can get all our research papers too. Understanding and Selecting Data Masking Buyer’s Guide Use Cases Pragmatic Key Management Choosing Your Key Management Strategy The Four Enterprise Key Management Strategies Evolving Endpoint Malware Detection Controls, Trade-offs and Compromises Providing Context Incite 4 U Blue Horseshoe loves threat intelligence: For a long time, the reactive approach to doing security worked well enough. But the past few years, not so much. So large organizations, with significant security infrastructure, have started to try to learn a bit about attackers before they attack. Wait, what? You mean an intel type function, which requires investment? Yup. So not only are we seeing a re-emergence of vulnerability trackers like iDefense, but also some new business models based on using intelligence to deceive attackers (as described in Dark Reading), or buying up zero-days to share with the good guys (Aaron Portnoy’s new shop, Exodus Intelligence). We love content, and cannot be happier that we’re finally seeing security content valued on its own merits – not just as part of a widget. – MR The future of software: We see continuing evidence in support of the assertion made by Red Monk’s founder Stephen O’Grady: Large software firms will be making money with software rather than from software. And I totally agree with that statement! While the main thrust of the post is to argue that Microsoft’s share price has suffered from poor choices in direction and lack of innovation, the really interesting aspects highlight the competitive forces within the software industry. In part it’s the transition from desktop, to web app, to mobile app, but it’s also about growing adoption of Software as a Service (SaaS) and what I consider the real long-term direction for back office applications: Platform as a Service (PaaS). Many of his observations are solid, but the dim picture he paints for Microsoft and other software vendors fails to account for their mobile and PaaS efforts, or the pricing pressures these larger software vendors will inflict on the rest of the market when they start offering the entire back office stack – including hardware and service – for a single price. Apple’s – and to a lesser extent Google’s – more consumer-oriented cloud service models