Research

Attacks keep happening. Breaches keep happening. Senior management keeps wondering what the security team is doing. The lack of demonstrable progress [in stopping malware] comes down to two intertwined causes. First, devices are built using software that has defects attackers can exploit. Nothing is perfect, especially not software, so every line of code presents an attack surface. Second, employees can be fooled into taking action (such as installing software or clicking a link) that enables attacks to succeed. Application Control technology can have a significant impact on the security posture of protected devices, but has long been much maligned. There was no doubt of its value in stopping attacks, especially those using sophisticated malware. Being able to block the execution of unauthorized executables takes many common attacks out of play. But there is a user experience cost for that protection. In Reducing Attack Surface with Application Control, we look at the double-edged sword of application control, detail a number of use cases where it fits well, and define selection criteria to consider for the technology. Keep in mind that no one control or tactic fits every scenario. Not for every company, nor for every device within a company. If you are looking for a panacea you are in the wrong business. If you are looking for a technology that can lock down devices in appropriate circumstances, check out this paper. Conclusion: Application control can be useful – particularly for stopping advanced attackers and securing unsupported operating systems. There are trade-offs as with any security control, but with proper planning and selection of which use cases to address, application control resists device compromise and protects enterprise data. We would like to thank AppSense for licensing the paper and supporting our research. We make this point frequently, but without security companies understanding and getting behind our Totally Transparent Research model you wouldn’t be able to enjoy our research. Download Reducing Attack Surface with Application Control (PDF). Attachments Securosis-ApplicationControl_FINAL.pdf [422KB] Share:

As we continue our research into the practical uses of threat intelligence (TI), we have documented how TI should change existing security monitoring (SM) processes. In our Leveraging Threat Intelligence in Security Monitoring paper, we go into depth on how to update your security monitoring process to integrate malware analysis and threat intelligence. Updating our process maps demonstrates that we don’t consider TI a flash in the pan – it is a key aspect of detecting advanced adversaries as we move forward. As much as you probably dislike thinking about other organizations being compromised, this provides a learning opportunity. An excerpt from the paper explains in more detail: There are many different types of threat intelligence feeds and many ways to apply the technology – both to increase the effectiveness of alerting and to implement preemptive workarounds based on likely attacks observed on other networks. That’s why we say threat intelligence enables you to benefit from the misfortune of others. By understanding attack patterns and other nuggets of information gleaned from attacks on other organizations, you can be better prepared when they come for you. And they will be coming for you – let’s be clear about that. Here is the table of contents so you can get a feel for how we structured the content. We would like to thank Norse Corporation for licensing this paper. Without support from our clients, you wouldn’t be able to use our research without paying for it. Download Leveraging Threat Intelligence in Security Monitoring (PDF) Attachments Securosis_ThreatIntelSecurityMonitoring_FINAL.pdf [1.7MB] Share:

This paper originally started with a blog post called Inflection that looked at a series of developing security trends and attempted to predict their eventual outcome. I researched for nearly 18 months; this paper compiles my thoughts on where the security industry is headed, why, and how it affects us now. From the introduction: Disruption defines the business of information security. New technologies change how businesses work and what risks people take. Attackers shift their strategies. But the better we security professionals predict and prepare for these disruptions, the more effective we can be. As analysts, we at Securosis focus most of our research on the here and now – on how best to tackle the security challenges faced by CISOs and security professionals when they show up to work in the morning. Occasionally, as part of this research, we note trends with the potential to dramatically affect the security industry and our profession. This paper starts with a description of the disruptive forces at work in our industry, but its real objective is to lay out their long-term implications for the practice of security – and how we expect security to evolve for security professionals, security vendors, and cloud and other infrastructure providers. Through the report we will back up our analysis with real – world examples that show this transformation isn’t a vague possibility in a distant future, but is already well under way. Although these changes are inevitable, they are far from evenly distributed. As you will see, this provides plenty of time and incentive for professionals and organizations to prepare. We would like to thank Box for licensing this content, enabling us to dedicate the resources to the research and release it for free. The Future of Security (Full Report, PDF) Executive Overview (PDF) Attachments Future-of-Security_Exec_Overview.pdf [550KB] Share:

Has your SIEM failed to meet expectations despite significant investment? Has your platform failed to keep up with emerging threats and scalability requirements? If you are questioning whether your existing product or service can get the job done, you are not alone. Given the rapid evolution of requirements, and the changing needs of enterprise users, it is no surprise that many vendors have been passed by as they work to address market demands from 4 years ago. You are likely more than a little frustrated by the difficulty of managing, scaling, and actually doing something useful with SIEM. But there comes a point where the futility of riding a mule in a horse race becomes obvious, and then it’s time to find a replacement steed. Security Management 2.5: Replacing Your SIEM Yet? takes a candid look at the emerging needs of SIEM users and how changes have made some platforms obsolete. In this research paper we discuss the specific customer demands that have forced SIEM evolution, as well as the technical capabilities that should be present to meet these requirements. We then walk through each aspect of the decision process to determine whether you should stay with your incumbent vendor or find a replacement. We provide a complete process to migrate – if the benefits outweigh the risks. This includes figuring out your requirements, whether your existing platform can meets them, and if not then how to select a new platform to make sure you don’t make the same mistakes again. Here is the table of contents, so you can get an idea of the paper’s depth. It is pretty comprehensive, and we understand it’s a handful, but we packed it with all the information needed to make an educated decision. We would like to thank IBM and McAfee for licensing this research. Download: Security Management 2.5: Replacing Your SIEM Yet? Attachments SecurityManagement2.5_FINAL-multi.pdf [1.7MB] Share:

iOS 7 is a significant update, with serious implications for enterprise management and data security (don’t worry, all good). The short version is that iOS is quite secure – far more than a general-purpose computer. But you need to understand Apple’s security philosophy to comprehend their design decisions and your integration options. Apple has a clear vision of the future for BYOD, and it is very different than the way most organizations have managed personal devices in the past. This paper updates our guidance for iOS and includes a deep dive into iOS 7 security and management features. Special thanks to WatchDox for licensing this content so we can release it for free! Defending Data on iOS 7 (PDF) And for historical purposes, here is the previous version of this paper: Defending Data on iOS Version 1.0 (PDF) Attachments Defending_Data_on_iOS.v.1.0.pdf [1.4MB] Defending-Data-on-iOS-v.2.pdf [1.5MB] Share: