Year: 2014

There are many ways to look at cloud computing and what it means for your business. I personally like the definitions from cloud tutorial, which offers two classifications:

1. Based on where the cloud infrastructure is located: Private, public or hybrid
2. Based on the services that the cloud delivers, whether Infrastructure as a service (IaaS), Platform as a service (PaaS) and/or Software as a service (SaaS). Examples includeAmazon web services, or Rackspace (for IaaS), Google Application Engine, Force.com, or Microsoft Azure (for PaaS), Salesforce.com, Google Docs, (for SaaS). Online services like Facebook, Dropbox, Box.net and others that are used both by consumers for personal purposes but also by many B2C and even B2B companies to interact with their customers fall under this classification as well.

Technologists and network security administrators tend to focus on the first cloud classification because it’s based on how the cloud is being deployed, managed and what needs to be done to make it work and secure it. Business-oriented folks focus on the second classification because it provides a more explicit description of the service provided and its related benefits. End users and employees often refer to cloud computing as services or applications because of how they experience the cloud: as a service or an application on their computer or mobile device.

The mushrooming popularity of cloud services makes it impossible to continue to rely on a security approach focused primarily on the perimeter of your enterprise. Employees can too easily move data and content from protected areas on your own network to cloud services that you have no direct control over. And it’s too easy for the leakage of information to get out of control: your team starts using an online file repository tool to share large video or creative files with partners ahead of a major event. Maybe that sharing next turns into more strategic files – plans, roadmaps and other sensitive documents – posted on these external collaboration services because the service is so convenient to use.

Cyber criminals can also attack these 3^rd party services to steal credentials from your employees and in turn use these credentials to infiltrate your network. Targeting enterprise business partners has been a more common first step of many of the breaches that have made the headlines in the past 12 months.

For a full view of the infographic, visit: http://www.skyhighnetworks.com/resources/cloud-adoption-risk-q2-2014/.

Doing your security due diligence on cloud services requires you to understand these cloud services better and why your company and your employees turn to them. As a starting point, read the top 50 list published by one of our technology partners, Skyhigh Networks. Then, consider the following steps to get a handle on the use of cloud services in your organization:

• Identify cloud services in use in your organization, and the employees or departments that use them: Get our Palo Alto Networks enterprise security platform deployed in tap mode on your internet gateway and you’ll start to get visibility into many of these cloud services (note that this is a non-disruptive process and you can start to get valuable information in as little as 24 hours). Our App-ID technology can help you discover traffic for hundreds of file sharing and file storage cloud-based applications. This includes Dropbox, Box.net, and Evernote amongst others. You can visit our Applipedia database to see the full list of applications covered. In addition, turn on the url filtering function in our platform to enable the discovery of services that are 100% web based.
• Understand the business need behind the use of the newly discovered cloud services:Whether these services are vetted on not by your IT department, you should proactively approach users and work with departments’ heads and IT to understand what’s the business need behind the use of any cloud service. Then you can decide whether the use of any specific service is legitimate and needs to be secured, whether the use needs to be restricted to specific departments, or finally whether the service represents too much risk to the business and you need to implement security policies to explicitly block it.
• Diligently manage the lifecycle of these cloud services: One of the most overlooked aspects of cloud services is what happens (or rather what does not happen) when an employee leaves the company. You need to apply to cloud services all the off-boarding procedures that are standard to other enterprise applications to ensure that access is turned off once the employee has left. This is actually a great driver to pursue the discovery of who uses which cloud services. In addition, cloud services used for business purposes should never be attached to an employee personal email, but unfortunately that is often the case.
• Revisit and update your security policies for the use of cloud services: Because there will be new, enticing cloud services launched every month, you need to continuously monitor activity on your network for the emergence of new cloud services adopted by your workforce. Keep repeating the above process on a quarterly basis at a minimum and proactively maintain a regular dialog with employees and users of these services. You might actually discover a few great applications in the process that should be used by everybody!

[Palo Alto Networks Blog]

Today we published a new research paper on WireLurker, a family of malware targeting both Mac OS and iOS systems for the past six months. We believe that this malware family heralds a new era in malware attacking Apple’s desktop and mobile platforms based on the following characteristics:

• Of known malware families distributed through trojanized / repackaged OS X applications, it is the biggest in scale we have ever seen
• It is only the second known malware family that attacks iOS devices through OS X via USB
• It is the first malware to automate generation of malicious iOS applications, through binary file replacement
• It is the first known malware that can infect installed iOS applications similar to a traditional virus
• It is the first in-the-wild malware to install third-party applications on non-jailbroken iOS devices through enterprise provisioning

WireLurker was used to trojanize 467 OS X applications on the Maiyadi App Store, a third-party Mac application store in China. In the past six months, these 467 infected applications were downloaded over 356,104 times and may have impacted hundreds of thousands of users.

How It Works

WireLurker monitors any iOS device connected via USB with an infected OS X computer and installs downloaded third-party applications or automatically generated malicious applications onto the device, regardless of whether it is jailbroken. This is the reason we call it “wire lurker”. Researchers have demonstrated similar methods to attack non-jailbroken devices before; however, this malware combines a number of techniques to successfully realize a new brand of threat to all iOS devices.

WireLurker exhibits complex code structure, multiple component versions, file hiding, code obfuscation and customized encryption to thwart anti-reversing. In this whitepaper, we explain how WireLurker is delivered, the details of its malware progression, and specifics on its operation.

We further describe WireLurker’s potential impact, as well as methods to prevent, detect, contain and remediate the threat. We also detail Palo Alto Networks Enterprise Security Platform protections in place to counter associated risk.

WireLurker is capable of stealing a variety of information from the mobile devices it infects and regularly requests updates from the attackers command and control server. This malware is under active development and its creator’s ultimate goal is not yet clear.

We recommend users take the following actions to mitigate the threat from WireLurker and similar threats:

• Enterprises should assure their mobile device traffic is routed through a threat prevention system using a mobile security application like GlobalProtect
• Employ an antivirus or security protection product for the Mac OS X system and keep its signatures up-to-date
• In the OS X System Preferences panel under “Security & Privacy,” ensure “Allow apps downloaded from Mac App Store (or Mac App Store and identified developers)” is set
• Do not download and run Mac applications or games from any third-party app store, download site or other untrusted source
• Keep the iOS version on your device up-to-date
• Do not accept any unknown enterprise provisioning profile unless an authorized, trusted party (e.g. your IT corporate help desk) explicitly instructs you to do so
• Do not pair your iOS device with untrusted or unknown computers or devices
• Avoid powering your iOS device through chargers from untrusted or unknown sources
• Similarly, avoid connecting iOS devices with untrusted or unknown accessories or computers (Mac or PC)
• Do not jailbreak your iOS device; If you do jailbreak it, only use credible Cydia community sources and avoid the use or storage of sensitive personal information on that device

Download “WireLurker: A New Era in OS X and iOS Malware” here.

Visit Unit 42 for new research and a full list of speaking appearances, as well to subscribe to updates.

Unit 42 On the Road

Unit 42 team leads regularly appear at industry conferences throughout the world. In November, Unit 42’s regular roadshow will make three stops in Canada. Click each link to register, and watch for more Unit 42 roadshows coming to cities near you.

• Tuesday, Nov. 18 in Toronto, Ont.
• Wednesday, Nov. 19 in Calgary, Alberta
• Thursday, Nov. 20 in Vancouver, B.C.

[Palo Alto Networks Blog]

Organizations are facing persistent, elusive and sophisticated cyber-attacks more than ever. Sometimes these attacks might seem unavoidable, leading you to believe that your network and data cannot be protected. But if you think about how cybercriminals need to successfully infiltrate your network, remember the various steps in the cyber kill chain required to do so, including “breach premier,” “deliver malware,” “endpoint operation” and “exfiltrate data.”

The good news is that blocking just one step in this cyber-attack chain, you can protect your network and data from attack.

The above model shows how we think about the cyber kill chain at Palo Alto Networks. PAN-DB plays a critical role in three of the four stages, highlighted in red. As we discussed in the recent blog post, “Web security tips: How PAN-DB works,” PAN-DB has a rich database of malicious URLs that can be used to block malware downloads, and to disable Command and Control (C&C) communications. This database will help you to block attacks throughout the cyber kill chain.

Here are a few examples

Breach perimeter

Advanced attacks commonly try to breach the perimeter. PAN-DB gives you protection against breach perimeter by blocking risky websites such as hacking, phishing, malware, drive-by-download and exploit sites.

Deliver malware

Once the perimeter is breached, attackers try to make you download malware on to your network. PAN-DB helps you to block downloads from malware sites. In addition, by blocking file downloads from unknown URL category (as we discussed in another recent blog, “Web security tips: Using URL categories in your security policy”), you can reduce the risk of downloading malware significantly.

Exfiltrate data

Malware can enter your network by evading your gateway security, such as through an employee’s own laptop or USB drive. Malware in your network communicates with the attackers and exfiltrates data. But PAN-DB helps you to disable such C&C communications by utilizing C&C URL and IP database as provided in WildFire.

URL filtering should do more than prevent unwanted web browsing

Traditional URL filtering was born to block non-business web access for productivity and compliance purposes. Although those purposes still hold true for URL filtering, the solution is incomplete unless it can also filter harmful websites to protect your network and data from cyber-attacks.

PAN-DB will add more protection to your Palo Alto Networks Enterprise Security Platform. We hope you utilize the power of PAN-DB to protect your network from advanced attacks.

To learn more about web security, please visit our resource page, “Control Web Activity with URL Filtering.”

[Palo Alto Networks Blog]

Ask firewall administrators about their day-to-day challenges and sooner or later they will come around to one that I am calling policy chaos. The term chaos aptly defines both the daily fire drills associated with physical firewall appliances as well as the rapid rate of change typical of moving into a cloud or virtualized environment. Maybe the marketing team needs a new application and the deadline is tomorrow, or an employee needs access to a restricted database for research. The necessary management approvals on the business side might go quickly, but in most companies, the firewall policy changes require more steps– review, approve, request change control, implement, push live.

As companies move toward virtualization and cloud computing, this chaos will only increase. The beauty of virtualization is that it lets organizations efficiently use of a pool of compute resources to create virtual machines and associated applications that are spun up and taken down in minutes to meet changes in demand. But that rate of change in a virtualized or cloud computing environment is far faster than the traditional process for deploying security policies allows. Enter more policy chaos.

One of the many ways to address a chaotic environment is through automation, a technique that has proven effective across a wide range of industries in bringing order to policy chaos. At Palo Alto Networks, we can bring some semblance of order to your policy chaos using Dynamic Address Groups, VM-Monitoring and the XML API – all standard features in PAN-OS.

Here’s how these features work. Your computing resource pool may include a combination of both physical and virtual servers. These servers all have an IP address, but they also have other attributes or characteristics such as the OS, the application, and perhaps location. The policy automation with begins with VM-Monitoring collecting the compute resource attributes from resource management tools such as vCenter, ESXi and AWS-VPC or the XML-API. PAN-OS then converts those attributes into tags, which you can use to define a Dynamic Address Group.

Based on the tags you use in the group definition, the associated compute resource IP addresses are collected and used as part of the security policy. As new VMs or physical servers that fulfill your group definition are added or their attributes change, the policy automatically updates. The result is your security policy can now keep pace with the rate of change occurring in your virtualization environment.

Another piece that excites firewall administrators is automated policy removal. As servers or VMs are taken out of service, the address group is updated automatically, as is the policy. The end result is your policy chaos is reduced and you may say, “We don’t know what that rule is, but we left it because it might have broken something,” far less frequently.

Check out a short video below to see these features in action.

[Palo Alto Networks Blog]

Many advanced persistent threat (APT) solutions only detect these APTs – and don’t prevent them. These same solutions only support two applications rather than the host of applications attackers now use. This approach simply won’t solve the larger problem.

We invite you to read a new whitepaper, co-authored with MeriTalk, Defeating APTs in Government Networks, to learn about the growing problem of APTs on government networks and how your security platform must adapt for this new era.

Download the report here.

For more

• Visit our Government resources page
• Read more entries on the Government blog and follow us on Twitter (@NGS_Gov)
• Download a technical document covering Palo Alto Networks solutions for government
• Check out our APT whitepaper as featured on MeriTalk’s Noteworthy blog

[Palo Alto Networks Blog]