Research

Update: Here are links to the series as we post it: Post 1 Post 2 Post 3 Post 4 Post 5 Back in 2012 I wrote a post titled Inflection. It was a collection of ideas and trends I have been watching, with the implications for the practice of security. This year I submitted it to the RSA Conference and it was accepted. I will be giving an updated presentation based on that post Tuesday afternoon. I thought that would be the end of it, because this isn’t the sort of research someone is usually interested in licensing and so it stays on the blog. But I was contacted by the folks at Box who were looking for something different that focuses more on where the industry is headed than our usual papers on helping you manage a current security issue. As an analyst I believe the majority of my published research should focus on day-to-day management of security, but it is also important to push the edges a bit and spend time thinking about the bigger picture. I am particularly excited about this paper because it isn’t being licensed by a traditional security vendor. The call from Box came out of left field, and shows that cloud and content providers are seeing security as a competitive differentiator. That isn’t an endorsement – no one can ever pay us to say nice things about them, but I can honestly say we are doing more work this year outside the traditional security market than I have ever seen before. To wet your whistle as I start writing the content, here’s a graphic of the outline. I will also be putting the content up on GitHub as I write and edit it for public feedback and review. I’m finding I like that better than the blog for the people who want to provide feedback, but this feed is better for getting the draft content out to a wide audience. We’ll take feedback on either side. Oh, and I could really use some help with a better title! This one feels a little pretentious to me, but I am struggling for something better and “Inflection” doesn’t translate well to a paper. Thanks, and here’s the outline: Share:

In this week’s Firestarter Rich, Mike, and Adrian (until his computer died) discuss the importance (or lack thereof) of the security industry and community in influencing government. Adrian drops out part-way through due to his frugal laptop choice, but rumor is he whipped out the credit card and payed homage to Apple shortly after the conclusion of this week’s recording. Share:

Threat intelligence (TI) is hot because it promises to close the gap a bit between attackers and defenders. So we have done considerable research on TI over the past year. We started by talking about the Early Warning System, a monitoring concept that leverages threat intelligence feeds to look for emerging attacks. Then we dove into the kinds of TI you can extract from network traffic, the ability to identify malicious IPs and senders by gathering TI through email, and finally a view of the external world through EcoSystem TI. As you see there are many different types of threat intelligence feeds, and many ways to apply the technology – both to increase the effectiveness of alerting, and to implement preemptive workarounds based on likely attacks. That is why we call threat intelligence benefiting from the misfortune of others. By understanding attack patterns and other nuggets of information gleaned from studying attacks on other organizations, you can get ahead of the threat. Okay – you cannot actually get ahead of the threat without a time machine. The threat is already out there, but hopefully it hasn’t been used against you yet. As the networks promote their summer reruns, “If you haven’t seen it, it’s new to you!” Shortening the Window We believe one of the most compelling uses for threat intelligence is to help detect attacks earlier in the attack cycle. By looking for attack patterns identified via threat intelligence in your security monitoring/analytics functions, you can shorten the window between compromise and detection. So we are happy to start a new series called Leveraging Threat Intelligence in Security Monitoring. We will go into depth on how to update your process, in order to integrate your existing malware analysis/threat intelligence gathering function with your security monitoring team’s work. We will be using parts of our Network Security Operations Quant and Malware Analysis Quant process maps to document a new Security Monitoring Process Model leveraging threat intelligence. We would also like to thank Norse Corp for agreeing to potentially license this content at the end of the process. We build all our public research using our Totally Transparent Research model, so all the research will be posted to the blog first to give everyone an opportunity to provide feedback and comment. But first things first. We need to set the stage by revisiting the kinds of threat intelligence we have highlighted in our research. This will provide the context you need to understand the kinds of TI feeds you can integrate into your security monitoring environment. Threat Intelligence Sources You can get effective threat intelligence from a number of different sources. We can chunk them into major categories to look at for security monitoring: Compromised Devices Malware Indicators Reputation Command and Control Networks Compromised Devices The first category of TI is the proverbial smoking gun. Something may look compromised, but until it actually starts acting compromised you may never know. Services are emerging to look for indications on the Internet of devices which either act like bots or communicate with C&C networks. These services are no-touch – you don’t need to install anything on your own network to get a verdict on devices within your network. How does it work? The intelligence providers penetrate botnets and monitor traffic on C&C networks. Using this information they build lists of (compromised) devices participating in botnets. Of course these services might detect your own internal honeypots or other malware analysis. So you will want to make sure you have some means of determining which devices should show up on their lists, and which shouldn’t. But being able to identify compromised devices is extremely useful for prioritizing remediation. Malware Indicators Malware analysis continues to mature rapidly, getting better and better at understanding exactly what malicious code does. This enables you to define both technical and behavioral indicators to seek out within your environment, as Malware Analysis Quant described in gory detail. Why is this important? The key strategy of classical AV – file blacklisting – is no longer effective, so indicators enable you to detect malware by what it does. A number of companies offer information on specific malware. You can upload a hash of a malware file – if the recipient has seen it already they match the hash and return their analysis; otherwise you upload the whole file for analysis. The services run malware samples through proprietary sandbox environments and other analysis engines to figure out what they do, build detailed profiles, and provide comprehensive reports which include specific behaviors and indicators. You can search your environment for those indicators to pinpoint possibly compromised devices. You can also draw conclusions from the kinds of indicators you find. Have those tactics been tied to specific adversaries? Do you see these kinds of activities during reconnaissance, exploitation, or exfiltration? Your analysis can enrich these indicators with additional context for better decisions about the best next step. Reputation Since its emergence as a primary data source in the battle against spam, reputation data seems to have become a component of every security control. The most common reputation data is based on IP addresses, and provides a dynamic list of known bad and/or suspicious addresses. This has a variety of uses – learning that a partner’s IP address has been compromised, for instance, should set off alarms, especially if the partner has a direct connection to your network. Traffic to known malware distribution sites, phishing sites, command and control nodes, spam relays, and other sites with bad reputations should be investigated. Besides IP addresses, pretty much everything within your environment can (and should) have a reputation. Devices, URLs, domains, and files, for starters. If you have traffic going to a known bad site, weird traffic coming from a vulnerable contractor-owned device, or even a known bad file showing up when a salesperson connects to the corporate network, you have something to investigate. If something in your environment develops a bad reputation – perhaps as a spam relay or DoS attacker – you need to know ASAP, hopefully before your entire network gets blacklisted. C&C Traffic Patterns One specialized type

Holy crap, time flies! Especially when you mark years by making the annual pilgrimage to San Francisco for the RSA Conference. Once again we are hosting our RSA Conference Disaster Recovery Breakfast. It has been six frickin’ years! That’s hard to believe but reinforces that we are not spring chickens anymore. We are grateful that so many of our friends, clients, and colleagues enjoy a couple hours away from the glitzy show floor and club scene that dominates the first couple days of the conference. By Thursday you will probably be a disaster like us and ready to kick back, have some conversations at a normal decibel level, and grab a nice breakfast. And with the continued support of MSLGROUP and Kulesa Faul, we are happy to provide an oasis in a morass of hyperbole, booth babes, and tchotchke hunters. As always, the breakfast will be Thursday morning from 8-11 at Jillian’s in the Metreon. It’s an open door – come and leave as you want. We will have food, beverages, and assorted recovery items to ease your day (non-prescription only). Yes, the bar will be open because Mike doesn’t like to drink alone. Remember what the DR Breakfast is all about. No marketing, no spin, just a quiet place to relax and have muddled conversations with folks you know, or maybe even go out on a limb and meet someone new. After three nights of RSA Conference shenanigans we are pretty confident you will enjoy the DRB as much as we do. See you there. To help us estimate numbers, please RSVP to rsvp (at) securosis (dot) com. Share:

I realize this will shock many of you, but I hated beer in high school and the first couple years of college. I know, I know, this destroys your image of me, but it’s the truth. I blame it on orange soda. My parents weren’t big soda drinkers, so I wasn’t really exposed to it. The first time I tried an orange soda at a birthday party in elementary school, the carbonation freaked me out and that was the end. My anti-carbonation stance carried over when we started on beer in high school (don’t tell the cops). Plus, beer back then sucked. I was still a young male and would drink beer when nothing else was around, but I tended towards kamikazes. Until the night I got so drunk that when my friends dropped me off at home I freaked out over someone stealing my car. You know, the one I drove to the bar earlier that night and (wisely) left there. The hangover lasted three days – so much for the immunity of youth. But then I discovered Buff Gold. In 1990 the Walnut Brewery, the first brew pub in Boulder, opened up. Shortly afterwards I was hired as a 19 year old 140 lb (wet) bouncer. It was a mellow crowd. I couldn’t drink there as an underage employee, but a couple other bars owned by the same guy carried the beer. Buffalo Gold was the first ale I ever tried, and started me down a path of refined malty (and responsible) consumption. As a side note, Frank Day, the owner, later opened the first Rock Bottom brewery in Denver (same franchise, different name). He also started the Old Chicago’s chain. Rock Bottom is all over the place, and merged with Gordon Beirsch a few years ago, which also owns Big River Brewery, the only brew pub at Disney World (on the Boardwalk). I keep showing my Walnut Brewery nametag at Disney, but they still make me pay for my beers. When they let me in the door. Anyhoo… after Buff Gold came Fat Tire, which migrated down from Fort Collins an hour north of Boulder. Then all sorts of craft beers exploded, which explains why the American Homebrewers Association offices were around the corner from my old Boulder condo. Turns out I didn’t hate beer, I just hated bad beer. After I moved to Phoenix a Yard House opened up near us and my (now) wife and I started spending most Friday happy hours there. That’s when I met The Bastard. Arrogant Bastard, if you are being formal, and it is about as serious a beer as you can find. After that anything short of an IPA seemed almost tasteless, and I became obsessed with California hops. I also loved the naming and marketing used by the Stone Brewing company. Beers like Ruination and Sublimely Self Righteous. Tag lines like, “You’re Not Worthy” and “you probably won’t like this beer”. When my wife was pregnant with our first child she deigned to take the Stone Brewery tour when we were out in San Diego, despite being unable to drink. That’s when I realized the marketing genius of their aggressive, no-nonsense approach. After… a few pints… I emailed Adrian and informed him I had our new corporate branding. “No B.S. Research”, “If you want to feel good about yourself, call your mom. If you want a security program, call us”, and the rest of our site and attitude. It has been five years since that trip, and our distinct divergence from traditional professionalism. And you know what? People like honesty. And the ones who don’t aren’t the sorts we want to work with anyway. It’s a nice filter that drives the kinds of clients and engagements that make this such an awesome job, and save us from endless piles of lapdogging and paperwork. And it all started with a beer. Like anything else worth a damn. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Adrian quoted on DBaaS. Dave Lewis in The Atlantic: This Little House in Wyoming Didn’t Just Get Flooded With Web Traffic From China. Favorite Securosis Posts Adrian Lane: The Catalyst. Someone sent me the book this week. Care to guess who? Rich: The SIXTH Annual Disaster Recovery Breakfast (with 100% less boycott). Yes, it’s a repost, but RSVP anyway. Other Securosis Posts Mindfulness Works. Firestarter: Target and Antivirus. Eliminate Surprises with Security Assurance and Testing [New Paper]. Favorite Outside Posts Adrian Lane: Metadata for beginners 😉. My favorite of the week was not a post, but a tweet. It only takes a couple fat-fingered cell calls from a ‘suspect’ to make you part of their social circle. Chris Pepper: More security is always better, right? Domain registrar auto-enrolls customers into $1,850 security service. Er. Dave Lewis: The death of Windows XP. Rich: Increased Cyber Security Can Save Global Economy Trillions. Funny numbers, but once again we see security hitting the mainstream. Research Reports and Presentations Eliminate Surprises with Security Assurance and Testing. What CISOs Need to Know about Cloud Computing. Defending Against Application Denial of Service Attacks. Executive Guide to Pragmatic Network Security Management. Security Awareness Training Evolution. Firewall Management Essentials. A Practical Example of Software Defined Security. Continuous Security Monitoring. API Gateways: Where Security Enables Innovation. Identity and Access Management for Cloud Services. Top News and Posts Chinese Internet Traffic Redirected to Small Wyoming House. Huh. Notes from Shmoocon 2014. Office.com Defaced by Syrian Electronic Army. RootCloak Hides Root Access From Specific Applications. Chrome hack lets websites keep listening after you close the tab. “70,000 healthcare.gov records hacked” claim turns out to be Google results. Oops; press fail. Again. Blog Comment of the Week This week’s best comment goes to DS, in response to A Very Telling Antivirus Metric. “We stop 0 day* attacks” *in this sense 0 indicates the number of attacks we successfully stop. Always gotta read the fine print. Share:

I was on the phone last week with Jen Minella, preparing for a podcast on our Neuro-Hacking talk at this year’s RSA Conference, when she asked what my story is. We had never really discussed how we each came to start mindfulness practices. So we shared our stories, and then I realized that given everything else I share on the Incite, I should tell it here as well. Simply put, I was angry and needed to change. Back in 2006 I decided I wanted to live past 50, so I starting taking better care of myself physically. But being more physically fit is only half the equation. I needed to find a way to deal with the stress in my life. I had 3 young children, was starting an independent research boutique, and my wife needed me to help around the house. In hindsight I call that period my Atlas Phase. I took the weight of the world on my shoulders, and many days it was hard to bear. My responsibilities were crushing. So my anger frequently got the best of me. I went for an introductory session with a life coach midway through 2007. After a short discussion she asked a poignant question. She wondered if my kids were scared of me. That one question forced me to look in the mirror and realize who I really was. I had to acknowledge they were scared at times. That was the catalyst I needed. I wasn’t going to be a lunatic father. I need to change. The coach suggested meditation as a way to start becoming more aware of my feelings, and to even out the peaks and valleys of my emotions. A few weeks later I went to visit my Dad. He had been fighting a pretty serious illness using unconventional tactics for a few years at that point. I mentioned meditation to him and he jumped out of his chair and disappeared for a few minutes. He came back with 8 Minute Meditation, and then described how meditation was a key part of his plan to get healthy. He told me to try it. It was only 8 minutes. And it was the beginning of a life-long journey. These practices have had a profound impact on my life. 6 years later it’s pretty rare for me to get angry. I am human and do get annoyed and frustrated. But it doesn’t turn into true anger. Or I guess I don’t let it become anger. When I do get angry it’s very unsettling, but I’m very aware of it now and it doesn’t last long, which I know my wife and kids appreciate. I do too. Everyone has a different story. Everyone has a different approach to dealing with things. There is no right or wrong. I’ll continue to describe my approach and detail the little victories and the small setbacks. Mostly because this is a weekly journal I use to leave myself breadcrumbs on my journey, so I remember where I have been and how far I have come. And maybe some of you appreciate it as well. –Mike Photo credit: “Scared Pandas” originally uploaded by Brian Bennett Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, where you can get all our content in its unabridged glory. And you can get all our research papers too. Reducing Attack Surface with Application Control Use Cases and Selection Criteria The Double Edged Sword Security Management 2.5: You Buy a New SIEM Yet? Negotiation Selection Process The Decision Process Evaluating the Incumbent Revisiting Requirements Platform Evolution Changing Needs Introduction Advanced Endpoint and Server Protection Assessment Introduction Newly Published Papers Eliminating Surprises with Security Assurance and Testing What CISOs Need to Know about Cloud Computing Defending Against Application Denial of Service Security Awareness Training Evolution Firewall Management Essentials Continuous Security Monitoring API Gateways Threat Intelligence for Ecosystem Risk Management Dealing with Database Denial of Service Identity and Access Management for Cloud Services Incite 4 U SGO: Standard Government Obscurity: The Target hack was pretty bad, and it seems clear it may only be the tip of the iceberg. Late last week the government released a report with more details of the attack so companies could protect themselves. Er, sort of. The report by iSIGHT Partners was only released to select retailers. As usual, the government isn’t talking much, so iSIGHT went and released the report on their own. A CNN article states, “The U.S. Department of Homeland Security did not make the government’s report public and provided little on its contents. iSIGHT Partners provided CNNMoney a copy of its findings.” Typical. If I were a retailer I would keep reading Brian Krebs to learn what’s going on. The feds are focused on catching the bad guys – you are on your own to stop them until the cuffs go on. – RM Unrealistic expectations are on YOU! Good post on the Tripwire blog about dealing with unrealistic security expectations. Especially because it seems very close to the approach I have advocated via the Pragmatic CSO for years. I like going after a quick win and making sure to prioritize activities. But my point with the title is that if senior management has unrealistic expectations, it’s because your communications strategies are not effective. You can blame them all you want for being unreasonable, but if they have been in the loop as you built the program, enlisted support, and started executing on initiatives, nothing should be a surprise to them. – MR Other people’s stuff: The recent Threatpost article ‘Starbucks App Stores User Information, Passwords in Clear Text’ is a bit misleading, as they don’t mention that the leaky bit of code is actually in the included Crashylitics utility. The real lesson here is not about potential harm from passwords in log files, which is a real problem, with

Back in November I learned I will be giving a talk on Neuro-Hacking at RSA with Jennifer Minella. We will be discussing how mindfulness practices can favorably impact the way you view things, basically allowing you to hack your brain. But I am pretty sure you can’t sell my synapses on an Eastern European carder forum. Over the last few months Jen and I have been doing a lot of research to substantiate the personal experience we have both had with mindfulness practices. We know security folks tend to be tough customers and reasonably skeptical about pretty much everything – unless there is data to back up any position. The good news is that there is plenty of data about how mindfulness can impact stress, job performance, and work/life balance. And big companies are jumping on board – Aetna is the latest to provide a series of Evidence-based Mind-Body Stress Management Programs based on mindfulness meditation and yoga. Meditation and yoga are becoming a big business (yoga pants FTW), so it is logical for big companies to jump on the bandwagon. The difference here, and the reason I don’t believe this is a fad, is the data. That release references a recent study in the Journal of Occupational Health Psychology. That’s got to be legitimate, right? Participants in the mind-body stress reduction treatment groups (mindfulness and Viniyoga) showed significant improvements in perceived stress with 36 and 33 percent decreases in stress levels respectively, as compared to an 18 percent reduction for the control group as measured with the Perceived Stress Scale. Participants in the mind-body interventions also saw significant improvements in various heart rate measurements, suggesting that their bodies were better able to manage stress. The focus of our talk is going to be solutions and demystifying some of these practices. It’s not about how security people are grumpy. We all know that. We will focus on how to start and develop a sustainable practice. Mindfulness doesn’t need to be hard or take a long time. In as little as 5-15 minutes a day you can dramatically impact your ability to deal with life. Seriously. But don’t take our word for it. Show up for the session and draw your own conclusions. We just recorded a podcast for the RSA folks, and I’ll link to it once it’s available, later this week. Jen and I will also be posting more mindfulness stuff on our respective blogs in the lead up to the conference (much to Rich’s chagrin). Photo credit: “6 Instant Ways To Stress Less And Smile More – Flip Your Perspective” originally uploaded by UrbaneWomenMag Share:

In this week’s Firestarter Rich, Mike, and Adrian discuss the latest in the Target relevations and whether over-reliance on antivirus is to blame once again. We aren’t out to blame the victim. We also pick our top prevention strategies for this sort of attack. Ain’t hindsight great? Share:

We have always been fans of making sure applications and infrastructure are ready for prime time before letting them loose on the world. It’s important not to just use basic scanner functions either – your adversaries are unlikely to limit their tactics to things you find in an open source scanner. Security Assurance and Testing enables organizations to limit the unpleasant surprises that happen when launching new stuff or upgrading infrastructure. Adversaries continue to innovate and improve their tactics at an alarming rate. They have clear missions, typically involving exfiltrating critical information or impacting the availability of your technology resources. They have the patience and resources to achieve their missions by any means necessary. And it’s your job to make sure deployment of new IT resources doesn’t introduce unnecessary risk. In our Eliminating Surprises with Security Assurance and Testing paper, we talk about the need for a comprehensive process to identify issues – before hackers do it for you. We list a number of critical tactics and programs to test in a consistent and repeatable manner, and finally go through a couple use cases to show how the process would work at both the infrastructure and application levels. To avoid surprise we suggest a security assurance and testing process to ensure the environment is ready to cope with real traffic and real attacks. This goes well beyond what development organizations typically do to ‘test’ their applications, or ops does to ‘test’ their stacks. It also is different from a risk assessment or a manual penetration test. Those “point in time” assessments aren’t necessarily comprehensive. The testers may find a bunch of issues but they will miss some. So remediation decisions are made with incomplete information about the true attack surface of infrastructure and applications. We would like to thank our friends at Ixia for licensing this content. Without the support of our clients, our open research model wouldn’t be possible. Direct Download (PDF): Eliminate Surprises with Security Assurance and Testing Share:

From Brian Krebs’ awesome reporting on the Target breach (emphasis added): The source close to the Target investigation said that at the time this POS malware was installed in Target’s environment (sometime prior to Nov. 27, 2013), none of the 40-plus commercial antivirus tools used to scan malware at virustotal.com flagged the POS malware (or any related hacking tools that were used in the intrusion) as malicious. “They were customized to avoid detection and for use in specific environments,” the source said. That source and one other involved in the investigation who also asked not to be named said the POS malware appears to be nearly identical to a piece of code sold on cybercrime forums called BlackPOS, a relatively crude but effective crimeware product. BlackPOS is a specialized piece of malware designed to be installed on POS devices and record all data from credit and debit cards swiped through the infected system. I swear I’ve been briefed by a large percentage of those vendors on how their products stop 0-day attacks. Let me go find my notes… Share: