Day: January 17, 2014

Getting the most out of big data sets and seemingly unrelated security information

Ericka Chickowski

As more CISOs begin to lean on data scientists to discover new threats in security feeds and increasingly more IT security departments institute security analytics programs, infosec pros have started to reap the obvious benefits of security analytics. Most evident among them is a broader and deeper visibility into IT security data sources, which in turn in offers a better understanding of security risks and faster response times.

But as security programs mature their analytics practices, they often find themselves surprised at the discrete benefits they start seeing from programmatic exploration of security-related data feeds. Here are just a few of the top positive surprises.

1. Uncover Data Leaks You’d Never Guess You Had
One of the first jolts that security analytics programs may give your organization is concrete evidence of data leaks it never before suspected were happening.

“The one that comes up regularly is that they discover leaks that have been ongoing for some time,” says Matthew Gardiner, senior product marketing manager for RSA.

As he explains, this may not even necessarily be a leak at the hands of some kind of complicated nation-state spying or even a data that’s being stolen by a crime syndicate.

“They’re just leaks caused by data moving out of the enterprises to places the organization didn’t know about, didn’t expect and maybe doesn’t like,” he explains. “The question then is figuring out what to do about that flow of data at that point.” [Are you getting the most out of your security data? See 8 Effective Data Visualization Methods For Security Teams.]

2. Sniff Out Questions You Didn’t Know Needed Asking Before
The huge amount of unstructured data pumped out by IT infrastructure and security tools makes it difficult for security analysts to even begin to start querying data for answers to common questions about its risk posture. The simple act of organizing analytics programs to answer those obvious questions may turn up unexpected returns as other patterns emerge to answer questions that the team may never have even thought to ask.

“Often companies may not know exactly what they are looking for or what exact problem they want to solve before the data is stored and made accessible,” says Dan Hubbard, CTO of OpenDNS. “Analytics can uncover security intelligence and capabilities that we would otherwise have no way of knowing is possible.”

What’s more, the visualization of those trends can also help better communicate risks to the business and start collaboration with business leaders who may start to come up with their own important questions to be answered based on data that was never as accessible without analytics.

“They start to ask good questions, so it gives a different perspective on not only what you should be looking at but how you should be looking at it,” says Ron Schlecht, managing partner for security service provider BTB Security. “It’s a good way to collaborate with different business leaders and it starts to pull together why security is important to the overall organization.”

3. Make Connections Between Data Sources You Might Not Have Made Before
Often times security analytics programs will start making associations between data sources that a security team may have never uncovered on its own.

“Most security analytics programs require feeding data from multiple sources in to a single engine for processing to look at patterns and anomalies,” says Corey Lanum, general manager for North America at Cambridge Intelligence. “When I’m working with customers who are loading in data from disparate sources, they will often immediately see connections between individual data elements that were previously stored in different databases and had no connection.”

For example, one police agency his firm worked with extended his security analytics engine out toward information sources about offenders and crime, with everything from 911 call information, jail records and the like.

“After loading in their crime reports and pawn shop records, we immediately started to see connections,” Lanum says. “It was immediately obvious that stolen property was being sold at pawn shops in the same general neighborhood of the theft. We generated leads on several burglaries on the first day we were using the software.”

This kind of modeling can easily translate to find connections between disparate parts of the network, different departmental information and so on.

4. Discover operational IT issues you never knew were there
The benefits of security analytics programs may well extend beyond IT security and bleed into IT operations as well. In many cases, the modeling and dot-connecting performed on security data can uncover IT operational problems that could impact availability, workflow and efficiency department-wide.

“One benefit that has surprised many companies is that the security analytics have also helped find operational IT issues, likely due to the sheer volume of information and depth of insight that can be gained with a proper analytics program,” Schlecht says.

For example, when he worked in-house years ago he found that a new analytics program not only helped identify security issues but was also able to pinpoint development issues in the company’s applications that were draining many hours of troubleshooting from its dev team. A look at application and security event logs for something completely unrelated ended up helping to spot the root cause of the development frustration.

5. Find policy violations you didn’t know were happening
Another beneficial surprise offered up from analytics–one that can often be a bit of a double-edged sword–is the discovery of policy violations across the organization. They won’t always necessarily be malicious, but they’re there and the difficult thing about it is that once the team has seen these violations, it can’t unsee them no matter how inconvenient response may be.

“You hear about rogue cloud services and with analytics you’ll see they’re very real,” Gardiner says. “It’s beneficial because you have better visibility, but you can’t be an ostrich once you see it. You have to do something about it and make the determination of whether it’s important and whether you have to investigate it and respond.”

[Source: DarkReading]

Flaw could allow an attacker to crash or remotely execute code on Web-based SCADA software product

Kelly Jackson Higgins

S4x14 CONFERENCE — Miami – A well-known and prolific ICS/SCADA vulnerability researcher here today revealed a zero-day flaw in a Web server-based system used for monitoring, controlling, and viewing devices and systems in process control environments.

Luigi Auriemma, CEO of Malta-based zero-day vulnerability provider and penetration testing firm ReVuln, showed a proof-of-concept for executing a buffer overflow attack on Ecava’s IntegraXor software, which is used in human machine interfaces (HMIs) for SCADA systems.

The ICS-CERT responded later in the day with a security alert on the zero-day vulnerability, and requested that Ecava confirm the bug and provide mitigation. Ecava as of this posting had not responded publicly, nor had it responded to an email inquiry by Dark Reading.

The IntegraXor line is used in process control environments in 38 countries, mainly in the U.K., U.S., Australia, Poland, Canada, and Estonia, according to ICS-CERT.

Auriemma says the stack buffer overflow bug causes the system to crash, but could in some cases allow an attacker to run malicious code remotely. “It was quite simple to find and even simpler to exploit,” he says.

Ecava is no stranger to the SCADA research community. The Malaysia-based software company in July announced a controversial bug bounty program that gives away points towards its software license rather than the standard cash reward that other such vendor vulnerability programs offer researchers. “It’s already difficult for a vendor to attract researchers with offers like money, and it’s even more difficult in this case because the researcher needs to spend time for points or the license,” Auriemma says.

He says he decided to disclose the buffer overflow bug in IntegraXor he had found because it was “a perfect example of a stack overflow vulnerability.”

[Cyberattacks could have real-world economic consequences in the oil and gas markets, even at the pump. See Destructive Attacks On Oil And Gas Industry A Wake-Up Call .]

Auriemma and Donato Ferrante, co-founder and security researcher with ReVuln, here also gave an update on their SCADA Shield prototype product, which provides an alternative to applying ICS/SCADA vendor patches. SCADA Shield is basically hot-patching utility that performs in-memory patching without having to power down the systems. Traditional patching typically requires a shutdown of the system and thus poses an unpalatable option for many plants.

There’s now an intrusion detection system (IDS) feature in SCADA Shield, Ferrante says.

“It’s [SCADA Shield] a proactive solution that combines information from our internal vulnerability [research] and exploit prevention techniques,” Ferrante says. It’s built to mitigate specific classes of vulnerabilities, including stack and heap overflow, directory traversal, file inclusion/overwrite, use-after-free, and injection flaws. SCADA Shield is still under development.

[Source: DarkReading]

Mobility has the potential to open up gaping security holes in the perimeter of enterprises – but in the government vertical that potential has become reality, according to new research.

A full 41% of the government employees in a Cisco-sponsoredassessment survey from Mobile Work Exchange were found to be putting themselves and their agencies at risk with existing mobile device habits. They are practicing potentially dangerous behaviors, including the use of public Wi-Fi (31%), a lack of multifactor authentication or data encryption (52%) and failure to use passwords on mobile devices for work (25%). Even when employees do use a password, nearly one in three admits to using an “easy” password and 6% of those admit to having it written down.

“When you consider the sensitive nature of information government employees have access to, it is worrying to see that employees are still opening themselves up to such high levels of risk,” said Matt Bancroft, CEO for mobile security specialist Mobile Helix, in an email to Infosecurity. “Using public networks, having weak passwords (or no password at all!), downloading personal app and losing devices all expose ways in which data can fall into the wrong hands.”

He added, “This report shows that even in highly regulated areas, where employees are working within a framework of tight policies and procedures in relation to security, users will always find a way to bypass security if it makes life easier for them.”

This is a particular issue considering the scale of mobile use: report noted that 90% of government employee respondents use at least one mobile device – laptop, smartphone, and/or tablet – for work purposes.

Ironically, many government respondents are taking basic steps to secure agency data for fixed endpoints. A majority (86%) lock their computer when away from their desk; additionally, 86% have a safe and alternative workplace compatible for work, and 78% always store files in a secure location.

Despite these secure actions, government employees are not showing the same caution for mobile devices.

There’s also a lack of a top-down security approach. When the appropriate security policies and procedures are in place and enforced, a mobile workforce can be a tremendous asset to a government agency. However, 57% of respondents who took the assessment from an agency/enterprise-wide perspective are failing to secure agency data, with gaps in mobile policies and security systems. Despite the Federal Digital Government Strategy, more than one in four government employees have not received mobile security training from their agencies.

Additionally, just 50% of respondents noted that their agencies have formal, employee-focused mobile device programs. Half of the agencies that took the assessment are missing fundamental mobile security steps, like utilizing a remote wipe function, or adding multifactor authentication or data encryption on mobile devices.

“In the near future, the number of mobile devices will exceed the world’s population, and by 2017, we expect more than 10 billion connected mobile devices,” said Larry Payne, Cisco vice president, U.S. Federal. “With the proliferation of devices, security continues to be a major concern. The 2014 Mobilometer Tracker study shows that 6% of government employees who use a mobile device for work say they have lost or misplaced their phone. In the average federal agency, that’s more than 3,500 chances for a security breach. Organizations need to take the necessary steps to protect their data and minimize the risk of data loss.”

Interestingly, the US federal government is not alone, as this is a common problem across public and private sector. And in many ways, the government performs better. About half (53%) of government agencies require employees to register mobile devices with the IT department, versus just 21% of private-sector organizations. And, only 15% of government respondents have downloaded a non-work-related app onto the mobile device they use for work, versus 60% of private-sector respondents.

“While the government is significantly safer than its counterparts, there is still much work to be done,” said Cindy Auten, general manager of Mobile Work Exchange. “Ensuring policies are being enforced is the best way to secure critical government data. Closing this gap equips government employees with the knowledge to thwart potential security breaches.”

[Source: InfoSecurity Magazine]

On Monday a security researcher made full disclosure of an issue he had found in Starbucks’ iOS mobile application: “username, email address, and password elements are being stored in clear-text.” Now Starbucks has admitted, “We were aware. That was not something that was news to us.”

Daniel Wood is a professional pentester. As a coffee drinker he decided to look at the Starbucks app before trusting it with his credit card information. What he found was, “Within session.clslog there are multiple instances of the storage of clear-text credentials that can be recovered and leveraged for unauthorized usage of a users account on the malicious users’ own device or online at https://www.starbucks.com/account/signin.”

He reported the matter to Starbucks in December, but received no direct reply. On 13 January he posted his findings on the Full Disclosure mailing list.

Starbucks has made little response. Computerworld reports Chief Digital Officer Adam Brotman saying that the issue should no longer be a concern because “we have security measures in place now related to that” and “we have adequate security measures in place now.” He declined to say what those security measures were, but said that customers’ “usernames and passwords are safe,” because Starbucks has added “extra layers of security.”

The Seattle Times quotes an email from Starbucks spokesman Zack Hutson, saying the company had “taken steps to safeguard customers’ information and protect against the theoretical vulnerabilities raised in the report, but we are unable to discuss any of the details because we want to protect the integrity of our security measures.”

But The Verge reports, “it’s unclear what steps [Starbucks] could have taken. Daniel Wood, the security researcher who originally discovered the vulnerability in November, says that the latest version of the app still includes the same unencrypted passwords and usernames. Starbucks would have to update the application to fix the issue, Wood tells The Verge, and it hasn’t done that since May. ‘Anything they have done on their end won’t matter as the vulnerability lies within the application on end user devices,’ he says.”

There is an air of ‘denial’ coming from Starbucks, reminiscent of that from Snapchat following GibsonSec’s revelation of its own security issues. Snapchat called it a theoretical problem that should be of little concern – and a few days later 4.6 million emails and partial phone numbers were leaked onto the internet.

That won’t happen to Starbucks because an adversary would need physical access to each phone in order to extract the individual credentials, but that will be of little reassurance to users who lose or have their phone stolen.

Nevertheless there is some surprise that the company has not been more proactive in reassuring its customers. “Yes, it does surprise me,” Gartner security analyst Avivah Litan told Computerworld. “I would have expected more out of Starbucks. At least they should have informed consumers.” There is no mention of the issue on the Starbucks blog, even though those app-using consumers accounted for 11% of Starbucks transactions in Q3 last year, and contributed to a record volume of more than $1.3 billion in Starbucks card loads in the US and Canada.

[Source: InfoSecurity Magazine]

When it comes to IT security, data is the crown jewel. This is not to say that networks and other systems are not important. A compromise anywhere could expose resources in your enterprise to manipulation or theft. But it is the data your systems store and use that are the most valuable targets.

This is why mobile computing and BYOD are problematic. How do you protect your data when it is being accessed by and used on devices outside your control? The immediate reaction to this challenge is to forbid access, but that can be counterproductive, warns Alexander Watson, director of security research at Websense.

“People will find a way around things that stop them from getting their jobs done,” says Watson.

And employees today expect to use mobile devices to get their jobs done, no matter where they are. If balked, they will work around restrictions and create an inside threat — unintentional, perhaps, but a threat just the same. The solution is to make data security an enabler for mobile working rather than a roadblock.

The underlying problem in mobile computing is not new. Security generally has been an afterthought in computing, and security operations were set up separately from the IT shop. As a result, security is the bad guy who tells you that you can’t do something and stops you from doing it. It didn’t take long for this to be recognized as a problem. Consequently, the trend has been to move security from its silo and integrate it more tightly with IT and business operations. That way it can help with missions rather than interfere.

But patterns tend to be repeated in IT, and as new technologies are introduced this mistake often is repeated. Belated attempts at security inhibit the use of new tools until they are forced on the enterprise. However, security in mobile devices, particularly in increasingly powerful and useful smartphones and tablets, is evolving to help enable meaningful authentication, access control and data security.

Biometric authentication is emerging for phones with Apple’s introduction of a fingerprint scanner in its iPhone 5s. It’s imperfect, but a step forward in security and convenience. Card readers for devices can enable use of government CAC and PIV cards, and software credentials derived from these cards can be used for authentication and access.

Software agents can also apply data-loss-prevention policies on mobile devices. And there are software-hardware solutions such as the Trusted Execution Environment, which is a secure area on a phone’s main processor to provide security against software attacks. Independent processor chips can also be included in handsets to enable a secure work environment and secure communications channels.

None of these solutions are fully mature and no security is perfect. But if users and organizations demand these features in products out of the box, personal devices —which already are finding their way into government and private sector work  environments — can become not only safe to use, but productive. “Security becomes an enabler,” Watson said.

Posted by William Jackson

[Source: GCN]