Research

My career has been turbulent at times. I know that’s shocking to those of you who know me personally. When I was invited not to come to work at my last job in VA, I already had a good position at a hot start-up in Atlanta lined up. They were well aware of my situation, and once I was a free agent the deal got done quickly. I had one real estate agent selling a house in VA, and another looking for property in Atlanta. Full speed ahead. Then I got the strangest call from my “new” CEO. He said they did a final reference check and a past boss pretty much drove a shiv into my gut. WTF? So now the sure thing in Atlanta wasn’t so sure. And even better, if this guy was talking me down in VA, my odds of getting another job if Atlanta fell through weren’t so good. So I went into damage control mode. I wasn’t going to go down like a lamb, so I came out swinging. I called in every favor I had. I created dissension at my former employer by having folks in all parts of the organization talk to the Atlanta company confidentially to provide a different viewpoint. If I was going to investigate other occupations, it was going to be on my terms. Not because some whackjob CEO was trying to cover his behind as he lost control of his company. And you know what? I got the job. The good guys won. My friends stepped up for me bigtime, and I never forgot that. I promised myself that if I ever knew anyone else getting similarly screwed, I’d do everything in my power to help them. Everything. I’d return the favor when I had the opportunity. A few weeks ago I had lunch with a friend, who told me a story eerily similar to mine. He got caught in the crossfire of a regime change and received the blackball treatment that happens when backchannel chatter is more important than demonstrable accomplishments. My blood was boiling. I knew what I had to do. So at RSA last week I looked for an opportunity to do it. Thankfully one of my clients mentioned he was looking for the skill set my friend possessed. I jumped and put his name into the hat. I also mentioned his predicament and personally vouched for my guy. I called in a favor and asked my client to give him a chance. I don’t know if it’ll work out, but my guy is in the game and that’s all I asked. And when my friend called yesterday to thank me, I smiled. It was a really big smile. Like some type of karmic balance returned to the world, if only for a few minutes. I smiled because I remember being in that spot. I remember how powerless I felt. How a control freak had no control. And I remember how relieved I felt when I learned those folks stepped up for me. But most of all, it felt really good to be able to keep that promise I made to myself all those years ago. My friend asked what he could do for me. My answer was absolutely nothing. This wasn’t about me. It was about righting a wrong and doing the right thing. But I did tell him to pay it forward. Someday he’ll meet someone in the same position and he needs to help. And he will. –Mike TIP A DRINK TO RICH: Let’s all congratulate Rich and his wife Sharon for the successful launch of their latest joint project. The latest addition to the team, Ryan Mogull, was born Sunday night. Rich will be taking some time with the family for the rest of the week, but should be back in the saddle soon. And yes, we are shopping for a Securosis onesie. Photo credits: Switchbox karma originally uploaded by stuart anthony Upcoming Cloud Security Training Interested in Cloud Security? Are you in EMEA (or do you have a ton of frequent flyer miles)? Mike will be teaching the CCSK Training class in Reading, UK, April 8-10. Sign up now. Heavy Research We’re back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, where you can get all our content in its unabridged glory. And you can get all our research papers too. Email-based Threat Intelligence Industrial Phishing Tactics Understanding Identity Management for Cloud Services Architecture and Design Integration Newly Published Papers Network-based Threat Intelligence: Searching for the Smoking Gun Understanding and Selecting a Key Management Solution Building an Early Warning System Implementing and Managing Patch and Configuration Management Defending Against Denial of Service Attacks Incite 4 U Give a security hobo a pair of shoes: Really great post by Bob Rudis about what he’s calling Security Hobos, the truly small businesses that really have no idea what they need to do. But we have an opportunity to make a difference, like the cop who gave the homeless guy in NYC a pair of boots. Bob points out that these are the kinds of business that put their POS software on the only machine in the business. And yes, that machine will get popped and it will be bad. But rather than just railing about how these folks create problems, Bob makes some actual suggestions for how to help. Do things like speak at your Chamber of Commerce and search out small businesses to offer advice. I talked about returning karmic balance above, and this is another great opportunity to do it. Don’t expect anything in return – do it because it’s the right thing to do. – MR Driving competition: Amazon Web Services (AWS) rolled out a monitoring tool called Trusted Advisor. It is positioned as a performance and security tool, leveraging the intelligence Amazon gathers to help customers tune their environments. Like traditional IT tools playing at security, it’s really operational metrics and tools masquerading as security features. It’s just

It looks like Ray Umerley had a good time at the RSA Conference. Besides seeing pics on the Tweeter of him at the Ju Jitsu gathering, he took some time to document his thoughts about what he saw at the show (RSA Conference 2013: My Takeways). Ray covers security intelligence, and how as you collect more security data, it becomes more important that it be used within a security/risk management program. He points out that we need more quality people in the information security field. I’m going to go out on two limbs here: we need quality people regardless of certification, those with the aptitude, passion, and intellect to excel across multiple security disciplines but also more security people who can apply the business and soft skills to develop into effective leaders. I really feel our resource gap is in the latter more than the former. I question the effectiveness of many of the traditional CISO/CSO and whether we as a profession have evolved to meet the needs and expectations of our organizations. Can I hear an amen? That’s exactly right. We don’t need more bodies. Okay, maybe a few more bodies. But what we really need are quality folks. Inquisitive souls who love learning, but who also have the temperament to handle a job with murky success criteria (at best). Then Ray moves on to flesh out the leadership gap, as well. The security industry is oftentimes very insular, difficult to break into some of the cliques, and we have a frustrating habit of eating our young. What we need to do is continue to nurture and foster a pipeline of security neophytes and intermediates and help them develop into multi-disciplinary security professionals. We as an industry need to continue sharing what we know and paying it forward. Obviously we can’t find enough qualified folks to meet the need, so we need to train them. If you are staff constrained and you don’t have a plan (aside from sending n00bs to a week-long SANS course) to develop your folks in a very structured fashion, you’re doing it wrong. Share:

Hat tip to our pals at TripWire, who do a good job of leveraging the security community to generate interesting and entertaining content. They have a guy named David Spark who roams around the floor at trade shows like RSA and captures video. A recent video asked, What would you do if you became CISO? Responses ranged from “fall off the wagon and drink heavily” to “ask for more budget” to “give myself a big-ass raise.” I definitely like that last one. But an ongoing theme involved updating your resume. That’s pretty funny. Who said security folks are pessimists? Of course the first thought that entered my mind was to grab the hemlock. But after that faded I’d go buy some guy’s book on being a Pragmatic CSO (hint, hint). I guess my advice is to forget almost everything you knew about technology. The position you’re now in is about persuasion and influence. It’s not about configuring firewalls or squeezing another $2-3 per device out of your endpoint protection vendor. There are some entertaining responses in the video, so check it out and get a few laughs. Then get back to work. Things don’t protect themselves, do they? Share:

Clearly the world is not enough. So I’ll be getting my 007 on in the UK in early April to deliver our Cloud Security Training. We have recently updated the curriculum to the Cloud Security Alliance Guidance V3.0, and I have to say it kicks butt. Many of the hands-on exercises have been overhauled, and if you are looking to get familiar with cloud security you will want to check out this class. I am personally training because part of this class will be a third day to train the next group of CCSK curriculum instructors. As authors of the training curriculum, we are the only folks who can train and certify instructors, so a couple times a year we deliver the courses ourselves, live and in person. The CSA is making a fairly serious investment in the CCSK, as evidenced by their recent announcement naming HP as a Master Training Partner. So if you do training, or would like cloud security to be a larger part of your business, getting certified as a CCSK trainer would be a good thing. If you want to become certified to teach, you need to attend one of these courses. And even if you aren’t interested in teaching, it’s also a good opportunity to get trained by the folks who built the course. You can get details and sign up for the training in Reading, UK, April 8-10. Here is the description of each of the 3 days of training: There is a lot of hype and uncertainty around cloud security, but this class will slice through the hyperbole and provide students with the practical knowledge they need to understand the real cloud security issues and solutions. The Certificate of Cloud Security Knowledge (CCSK) – Basic class provides a comprehensive one day review of cloud security fundamentals and prepares them to take the Cloud Security Alliance CCSK certification exam. Starting with a detailed description of cloud computing, the course covers all major domains in the latest Guidance document from the Cloud Security Alliance, and the recommendations from the European Network and Information Security Agency (ENISA). The Basic class is geared towards security professionals, but is also useful for anyone looking to expand their knowledge of cloud security. (We recommend attendees have at least a basic understanding of security fundamentals, such as firewalls, secure development, encryption, and identity management). The CCSK-Plus class builds upon the CCSK Basic class with expanded material and extensive hands-on activities with a second day of training. The Plus class (on the second day) enhances the classroom instruction with real world cloud security labs! Students will learn to apply their knowledge as they perform a series of exercises, as they complete a scenario bringing a fictional organization securely into the cloud. This second day of training includes additional lecture, although students will spend most of their time assessing, building, and securing a cloud infrastructure during the exercises. Activities include creating and securing private clouds and public cloud instances, as well as encryption, applications, identity management, and much more. The CCSK Instructor workshop adds a third day to train prospective trainers. More detail about how to teach the course will be presented, as well as a detailed look into the hands-on labs, and an opportunity for all trainers to present a portion of the course. Click here for more information on the CCSK Training Partner Program (PDF). We look forward to seeing you there. Share:

Hot on the heels of our Building an Early Warning System paper, we have taken a much deeper look at the network aspect of threat intelligence in Network-based Threat Intelligence. We have always held to the belief that the network never lies (okay – almost never), and that provides a great basis on which to build an Early Warning System. This excerpt from the first section sums it up pretty nicely: But what can be done to identify malicious activity if you don’t have the specific IoCs for the malware in question? That’s when we look at the network to yield information about what might be a problem, even if controls on the specific device fail. Why look at the network? Because it’s very hard to stage attacks, move laterally within an organization, and accomplish data exfiltration without using the network. This means attackers leave a trail of bits on the network, which can provide a powerful indication of the kinds of attacks you are seeing, and which devices on your network are already compromised. This paper will dig into these network-based indicators, and share tactics to leverage them to quickly identify compromised devices. Hopefully shortening this detection window will help to contain the damage and prevent data loss. Hit the landing page or you can download the paper directly (PDF) We would like to thank Damballa for licensing the content in this paper. Obviously we wouldn’t be able to do the research we do, or offer it to you folks for this most excellent price, without clients licensing our content. Share:

It’s funny how some technologies fall out of the hype cycle and folks kind of forget about them. But that doesn’t mean these technologies don’t work any more. Au contraire, it usually means a technology works too well, and just isn’t exciting to talk about any more. Let’s take the case of adaptive authentication: using analytics to determine when to implement stronger authentication. It appears Google has started taking an adaptive approach to authentication for Gmail over the past 18 months: Every time you sign in to Google, whether via your web browser once a month or an email program that checks for new mail every five minutes, our system performs a complex risk analysis to determine how likely it is that the sign-in really comes from you. In fact, there are more than 120 variables that can factor into how a decision is made. If a sign-in is deemed suspicious or risky for some reason–maybe it’s coming from a country oceans away from your last sign-in–we ask some simple questions about your account. Yeah, man. Not that a targeted attacker won’t have those answers based on some rudimentary recon. Obviously there are ways to beat this approach, but for run-of-the-mill attackers, more challenging authentication provides enough of a bar to get them looking elsewhere. Remember, these folks chase the path of least resistance, and there are tons of cloud-based email services to chase that don’t perform this kind of sophisticated analytics on authentication requests. And amazingly enough, it works. Using security measures like these, we’ve dramatically reduced the number of compromised accounts by 99.7 percent since the peak of these hijacking attempts in 2011. Good on Google. Maybe they are evil, but at least they are trying to improve security. Share:

Let’s just say I almost failed sharing back in kindergarten. Almost 40 years later I’m not a hell of a lot better at sharing (just ask my kids), but if you want to be good at security, you had better do better at sharing than me. Good points here by Don Srebnick (CISO of the City of NY) on using an ISAC to your advantage: A structure for this type of sharing has been developed within multiple sectors. If you haven’t heard, the Information Sharing and Analysis Center, or ISAC, is that structure. An ISAC provides members with a private community for dispensing information about security threats, incidents and response, and critical infrastructure protection. ISACs are an effective method of sharing your information without direct attribution. If your site is under cyber attack or you become aware of an imminent threat to your sector, details can be exchanged without ever revealing your identity, thereby facilitating sharing, but maintaining confidentiality. I’ve been doing a lot of research on threat intelligence and believe (as many of the CISOs I speak with believe) that no one organization can do it themselves. The only way to shorten the window between attack and detection is to get much better at searching for indicators of compromise in your environment. And bi-directional sharing of the attacks you’re seeing, and learning about attacks similar organizations are seeing, are becoming key success criteria for security in the age of advanced attackers. The New School guys were absolutely right years ago about the need to share. They were just way ahead of the curve. It’s good to see a lot more discussion about sharing happening in the industry. It’s about time… Photo credit: “Sharing” originally uploaded by Toban Black Share:

You know a technology is close to the top of the hype cycle when talking heads start calling for its demise. Zeus Kerravala goes medieval on MDM in this NetworkWorld column: I believe we’re starting to see the beginning of the end of the red hot MDM market. More and more network vendors are rolling out solutions for BYOD that make the traditional solutions somewhat of a commodity. Now Zeus is talking about a new product from F5 that basically wraps apps before delivery to a mobile device, to ostensibly provide proper protection, authorization, etc. Hmmm. Sounds a lot like VDI to me. Or remote control. Or the zillion other technologies that are supposed to take devices out of the equation and manage applications and desktops and everything else remotely. Let’s just say we have seen this movie before and device-centric management approaches continue to be alive and well. And I don’t have any doubt that MDM will be here for the foreseeable future to manage the configurations and hygiene of mobile devices. Will MDM be bundled into a broader endpoint and/or IT management suite? Absolutely. Everything is a feature (in time). Though some folks think this is very big market, as evidenced by AirWatch raising $200 MILLION. Not that investors are always right, but that sounds like a market on the upswing. To say it’s the beginning of the end is, well, wrong. It’s the beginning of the beginning. Photo credit: “it’s dead Jim” originally uploaded by Eddie Codel Share:

In addition to all the cycles we spent in our weekly research meeting trying to come up with cool t-shirt ideas featuring APT1, we also spent a bunch of time talking about the real impact of the Mandiant report, and how hacking for the Chinese is just different than what the US (and most other governments) do. I’m pretty sure Rich will do a much more detailed post on this, following up on his great House of Cybercards ideas. But suffice it to say you probably wouldn’t get much of a hearing if you asked the US military apparatus to help figure out what price a Chinese competitor was planning to bid on a big power plant in South America. But the Chinese have no issue with hacking into all sorts of places to assist their commercial entities, many of which are still at least partially owned by the government. But that’s another discussion for another day – one with a lot of beer. I want to follow up on this week’s Incite snippet, Attribution. Meh. Indicators. WIN! on what I see as the real value of Mandiant’s report. It’s not like most of us in the industry didn’t know that the Chinese military was behind a lot of the so-called APT activity. Now we have a building to go visit. Whoopee! I was far more interested to see the malware indicators they found published, if only to see how some smart folks will use that information to help the industry. First send some kudos over to the folks at Tenable, who quickly posted checks you can load directly into Nessus to look for the malware. Part of the reason to do malware analysis in the first place is to be able to search for those indicators within your environment, using tools you already have. This audit file determines possible infections by several of the malware items identified in the Mandiant Intelligence Center Report – APT1: Exposing One of China’s Cyber Espionage Units. It includes checks for 34 of the malware variants identified in Appendix C The Malware Arsenal. The audit file utilizes a combination of registry checks and file system checks to find hosts that might likely be at risk or infected. Wesley McGrew’s students at Mississippi State also got a little gift, in terms of a bunch of new samples to analyze, as described by TechWorld. It’s great to see students able to learn on real world ammo. “Oh, it’s fantastic,” said McGrew, who will defend his doctoral thesis on the security of SCADA (supervisory control and data acquisition) systems next month. “The importance of having malware that has an impact on the economic advantage of one company over another or the security of a nation is priceless. This is exactly what they should be learning to look at.” Not to get all New School now, but access to the malware and associated indicators used in many of these advanced attacks can be instructive for tons of reasons. We can only hope this is the first of many instances where the industry works together to improve the practice of security, as opposed to competing against each other for purely economic gain. Yeah, not sure what I was thinking with that last statement. Share:

In the least surprising news of the day, the guy who sold his start-up, Zenprise, to Citrix, concluded that selling standalone MDM was a tough sell. Even though Zenprise had around 100 developers, it would have been tough to respond to all those demands, he said. “We were feeling pressure from larger enterprises to offer data, secure email, secure browsing, and tie it into other third party and native apps,” he said. “We didn’t feel we had the resources to really deliver a lot of these pieces.” What’s the guy going to say? He took the money and ran and now can throw developers at the problem. That’s his differentiation against the start-ups that remain. And the folks who haven’t sold yet probably want to talk about how innovation stops when a start-up gets bought and how their nimble focus will provide a better solution for customers. Blah blah blah. Over time, pretty much all the MDM start-ups will be acquired and MDM will be integrated into the management stack. It could be the systems management stack or perhaps the security stack. But it will be integrated. We have seen this movie and it always has the same ending. Over time, everything is a feature. Everything. And before you tell me one of the stand-alone companies will go public and remain independent, remember that the day their stock starts trading they begin looking for other stuff to buy to integrate into their platform. As a former boss of mine said, “if you aren’t moving forward, you’re moving backward.” That’s the way technology markets work. Photo credit: “Penn and Teller Get Killed + Pee Wee’s Big Adventure” originally uploaded by Double Feature Podcast Share: