Research

Open source software is ubiquitous. Nearly every company is running some. Many organizations are not even aware of it – or at least weren’t until the Heartbleed vulnerability. Then they discovered what many firms already know: there is open source running in your company, and it’s an integral part of your operations. Earlier this year I participated in the 2014 Open Source Development and Application Security Survey, as I have done the last couple years. As a developer and former development manager – and let’s face it, an overtly opinionated one – I am always interested in adding my viewpoint to these inquiries, even if I am just one developer voice among thousands. But I have also benefitted from these surveys – looking at the stuff my peers are using, and even selecting open source distributions based on this shared data. So when Sonatype, the organization that conducts this survey, asked me to perform an independent analysis of the data, I jumped at the chance. I wanted to give back to the community, and perhaps share a unique perspective on what the survey results mean and how open source development is dealing with security-related issues. This research paper is the result of that work. I was given the raw data prior to the official release of the report, and a few questions immediately jumped out: Are developers worried about security? Do they have security policies? How did Heartbleed affect the survey results? Is open source more trustworthy than commercial software? How and when are components banned? I discuss these topics and more in the paper. You can find the official survey results at http://www.sonatype.com/about/2014-open-source-software-development-survey. And our research paper is available for download, free as always: 2014 Open Source Development and Application Security Survey Analysis Thank you to Sonatype – both for giving us access to the data and for licensing this research to accompany their results! Attachments Securosis_OpenSourceSurvey_Analysis.pdf [1.2MB] Share:

Anti-virus is basically dead, at least according to the biggest anti-virus vendor. The good news is that signature-based AV has actually been dead for a long time; even the big players have been broadening their capabilities to assess, prevent, detect, and investigate advanced malware on endpoints and servers. There has been a tremendous amount of activity and innovation in protecting endpoint and servers, driven by necessity: Endpoint protection has become the punching bag of security. For every successful attack, the blame seems to point directly to a failure of endpoint protection. Not that this is totally unjustified — most solutions for endpoint protection have failed to keep pace with attackers. But hygiene and awareness alone will not deter advanced attackers very long. We frequently say advanced attackers are only as advanced as they need to be: they take the path of least resistance. But the converse is also true. When these adversaries need advanced techniques, they use them. Traditional malware defenses such as antivirus don’t stand much chance against a zero-day attack Our Advanced Endpoint and Server Protection paper highlights the changes in threat management resulting from these advanced attackers using advanced tactics. We discuss changes in prevention, as well as advances in both detection and investigation. This is really a call to action to rethink how you deal with advanced adversaries, and ultimately how you protect your devices. Advanced adversaries require organizations to rethink how they manage threats. The idea that targeted attacks can be prevented consistently is a pipe dream, so organizations need to shift away from largely ineffective legacy technologies for protecting endpoints and servers. More specifically this means devoting more resources and investing in innovative approaches to blocking attacks in the first place, including advanced heuristics, application control, and isolation technologies. But even with significant investment in innovative prevention, a persistent attacker will still compromise your devices. This highlights the necessity of shifting security investment toward detecting and investigating attacks. We would like to thank the companies who have licensed this content (in alphabetical order): Bit9 + Carbon Black; Cisco/Sourcefire; and Trusteer, an IBM Company. We make this point frequently, but without security companies understanding and getting behind our Totally Transparent Research model, you wouldn’t be able to enjoy our research. Download Advanced Endpoint and Server Protection (PDF) Attachments Securosis_AdvancedEndpointServerProtection_FINAL-multi.pdf [1.6MB] Share:

What’s a couple hundred gigabits per second of traffic between friends, right? Because that is the magnitude of recent volumetric denial of service attacks, which means regardless of who you are, you need a plan to deal with that kind of onslaught. Regardless of motivation attackers now have faster networks, bigger botnets, and increasingly effective tactics to magnify the impact of their DDoS attacks – organizations can no longer afford to ignore them. In Defending Against Network-based Distributed Denial of Service Attacks we dig into the attacks and tactics now being used to magnify those attacks to unprecedented volumes. We also go through your options to mitigate the attacks, and the processes needed to minimize downtime. To steal our own thunder, the conclusion is pretty straightforward: Of course there are trade-offs with DDoS defense, as with everything. Selecting an optimal mix of defensive tactics requires some adversary analysis, an honest and objective assessment of just how much downtime is survivable, and clear understanding of what you can pay to restore service quickly. We owe a debt of gratitude to A10 Networks for licensing this content and supporting our research. We make this point frequently, but without security companies understanding and getting behind our Totally Transparent Research model you wouldn’t be able to enjoy our research. Download Defending Against Network-based Distributed Denial of Service Attacks (PDF). Attachments Securosis_NetworkDDoS_FINAL.pdf [841KB] Share:

Attacks keep happening. Breaches keep happening. Senior management keeps wondering what the security team is doing. The lack of demonstrable progress [in stopping malware] comes down to two intertwined causes. First, devices are built using software that has defects attackers can exploit. Nothing is perfect, especially not software, so every line of code presents an attack surface. Second, employees can be fooled into taking action (such as installing software or clicking a link) that enables attacks to succeed. Application Control technology can have a significant impact on the security posture of protected devices, but has long been much maligned. There was no doubt of its value in stopping attacks, especially those using sophisticated malware. Being able to block the execution of unauthorized executables takes many common attacks out of play. But there is a user experience cost for that protection. In Reducing Attack Surface with Application Control, we look at the double-edged sword of application control, detail a number of use cases where it fits well, and define selection criteria to consider for the technology. Keep in mind that no one control or tactic fits every scenario. Not for every company, nor for every device within a company. If you are looking for a panacea you are in the wrong business. If you are looking for a technology that can lock down devices in appropriate circumstances, check out this paper. Conclusion: Application control can be useful – particularly for stopping advanced attackers and securing unsupported operating systems. There are trade-offs as with any security control, but with proper planning and selection of which use cases to address, application control resists device compromise and protects enterprise data. We would like to thank AppSense for licensing the paper and supporting our research. We make this point frequently, but without security companies understanding and getting behind our Totally Transparent Research model you wouldn’t be able to enjoy our research. Download Reducing Attack Surface with Application Control (PDF). Attachments Securosis-ApplicationControl_FINAL.pdf [422KB] Share:

As we continue our research into the practical uses of threat intelligence (TI), we have documented how TI should change existing security monitoring (SM) processes. In our Leveraging Threat Intelligence in Security Monitoring paper, we go into depth on how to update your security monitoring process to integrate malware analysis and threat intelligence. Updating our process maps demonstrates that we don’t consider TI a flash in the pan – it is a key aspect of detecting advanced adversaries as we move forward. As much as you probably dislike thinking about other organizations being compromised, this provides a learning opportunity. An excerpt from the paper explains in more detail: There are many different types of threat intelligence feeds and many ways to apply the technology – both to increase the effectiveness of alerting and to implement preemptive workarounds based on likely attacks observed on other networks. That’s why we say threat intelligence enables you to benefit from the misfortune of others. By understanding attack patterns and other nuggets of information gleaned from attacks on other organizations, you can be better prepared when they come for you. And they will be coming for you – let’s be clear about that. Here is the table of contents so you can get a feel for how we structured the content. We would like to thank Norse Corporation for licensing this paper. Without support from our clients, you wouldn’t be able to use our research without paying for it. Download Leveraging Threat Intelligence in Security Monitoring (PDF) Attachments Securosis_ThreatIntelSecurityMonitoring_FINAL.pdf [1.7MB] Share:

This paper originally started with a blog post called Inflection that looked at a series of developing security trends and attempted to predict their eventual outcome. I researched for nearly 18 months; this paper compiles my thoughts on where the security industry is headed, why, and how it affects us now. From the introduction: Disruption defines the business of information security. New technologies change how businesses work and what risks people take. Attackers shift their strategies. But the better we security professionals predict and prepare for these disruptions, the more effective we can be. As analysts, we at Securosis focus most of our research on the here and now – on how best to tackle the security challenges faced by CISOs and security professionals when they show up to work in the morning. Occasionally, as part of this research, we note trends with the potential to dramatically affect the security industry and our profession. This paper starts with a description of the disruptive forces at work in our industry, but its real objective is to lay out their long-term implications for the practice of security – and how we expect security to evolve for security professionals, security vendors, and cloud and other infrastructure providers. Through the report we will back up our analysis with real – world examples that show this transformation isn’t a vague possibility in a distant future, but is already well under way. Although these changes are inevitable, they are far from evenly distributed. As you will see, this provides plenty of time and incentive for professionals and organizations to prepare. We would like to thank Box for licensing this content, enabling us to dedicate the resources to the research and release it for free. The Future of Security (Full Report, PDF) Executive Overview (PDF) Attachments Future-of-Security_Exec_Overview.pdf [550KB] Share:

Has your SIEM failed to meet expectations despite significant investment? Has your platform failed to keep up with emerging threats and scalability requirements? If you are questioning whether your existing product or service can get the job done, you are not alone. Given the rapid evolution of requirements, and the changing needs of enterprise users, it is no surprise that many vendors have been passed by as they work to address market demands from 4 years ago. You are likely more than a little frustrated by the difficulty of managing, scaling, and actually doing something useful with SIEM. But there comes a point where the futility of riding a mule in a horse race becomes obvious, and then it’s time to find a replacement steed. Security Management 2.5: Replacing Your SIEM Yet? takes a candid look at the emerging needs of SIEM users and how changes have made some platforms obsolete. In this research paper we discuss the specific customer demands that have forced SIEM evolution, as well as the technical capabilities that should be present to meet these requirements. We then walk through each aspect of the decision process to determine whether you should stay with your incumbent vendor or find a replacement. We provide a complete process to migrate – if the benefits outweigh the risks. This includes figuring out your requirements, whether your existing platform can meets them, and if not then how to select a new platform to make sure you don’t make the same mistakes again. Here is the table of contents, so you can get an idea of the paper’s depth. It is pretty comprehensive, and we understand it’s a handful, but we packed it with all the information needed to make an educated decision. We would like to thank IBM and McAfee for licensing this research. Download: Security Management 2.5: Replacing Your SIEM Yet? Attachments SecurityManagement2.5_FINAL-multi.pdf [1.7MB] Share:

iOS 7 is a significant update, with serious implications for enterprise management and data security (don’t worry, all good). The short version is that iOS is quite secure – far more than a general-purpose computer. But you need to understand Apple’s security philosophy to comprehend their design decisions and your integration options. Apple has a clear vision of the future for BYOD, and it is very different than the way most organizations have managed personal devices in the past. This paper updates our guidance for iOS and includes a deep dive into iOS 7 security and management features. Special thanks to WatchDox for licensing this content so we can release it for free! Defending Data on iOS 7 (PDF) And for historical purposes, here is the previous version of this paper: Defending Data on iOS Version 1.0 (PDF) Attachments Defending_Data_on_iOS.v.1.0.pdf [1.4MB] Defending-Data-on-iOS-v.2.pdf [1.5MB] Share: