Month: March 2017

Posted on

The Outlook for Biometrics Security

Deloitte Technology, Media and Telecommunications predicted recently that more than 1B devices would be reader-enabled for biometrics by the end of 2017. This is a very significant milestone for many reasons.

Over the years, there has been a lot of hype about the potential of biometrics for authentication and other purposes, but the lack of availability to consumers meant adoption was behind the hype curve. Device manufacturers have since changed this picture with native biometric support of mobile and tablet devices.

In a broader sense, it is important to understand the benefits of biometrics and how they can fit into an organization’s security strategy.

The death of the password – are we there yet?

Biometrics are used for individuals to authenticate to a service or a device. In some instances, authorization of a transaction has been built into applications. Due to its many intuitive uses, biometrics have long been a favorite of those who sing the tales of the demise of the password. While it is unlikely that we’ll get rid of passwords anytime soon, biometrics can offer a lot of value.

Why biometrics?

Biometrics have some significant benefits. Their adoption into ever more uses bring with it a number of benefits.

For a start, biometrics are user-friendly. After years of passwords and pins on fiddly mobile device keyboards, having a simple fingerprint reader is a welcomed alternative, particularly when, as Deloitte research noted, biometric readers are used on main devices, on average, 30 times a day.

Another benefit of biometrics is increased accountability. As biometrics rely on something you are, the days of sharing authenticators could be numbered.

Biometrics also are cheap. The device manufacturers have already distributed upwards of a billion readers to date.

Lastly, where the system is properly architected, biometrics can have the advantage that attacks won’t scale. Proper design entails not using the representation of the body feature as a secret and, in turn, not storing such representations in a central location. Often it is these databases that are a target for motivated attackers.

How do I embed biometrics in my digital strategy?

Organizations should definitely consider using biometrics in their consumer authentication strategy, but this should be part of a wider security model. Having a single factor (in this case of biometrics, something you are) might be enough for simple uses – for example, to log into your electricity provider to review your latest bill. This will not be enough for other uses, though, such as authorizing a major payment from your bank current account. There are a few things to keep in mind for organizations in all industries:

  • Balance a good user experience with appropriate security. Happy consumers can be a real differentiator; lack of security can lead to significant losses and cause real damage to your company’s reputation.
  • Make customer authentication and use of biometrics a part of a wider strategy. For some use cases, a fingerprint might be enough to authenticate. In other cases, you want another factor, such as out-of-band authentication. In some, very high-value use cases, you might even want to continuously monitor that your authenticated user is still likely to be the same user. This is known as behavioral biometrics.
  • What do you do if your main authentication mechanism is breached? Do you have a fall-back plan? Will you have strong protection for the consumer to increase adoption in the first place? Are you able to detect and respond to such an event? Your authentication strategy should be part of a much wider security-by-design strategy.

Multifactor authentication is here to stay, and biometrics are fast gaining pace. As part of your overall customer-facing initiatives, build in a strong authentication mechanism, and leverage the growing presence of biometrics to enhance security and user experience.

Kristian Alsing, head of identity and access management, Deloitte UK

[ISACA Now Blog]

Posted on

Faces of ISACA: Integrity Central to Santor’s Career Success

One of the most influential conversations in Cheryl Santor’s career required plenty of gumption.

Santor, working in IT at a mortgage banking firm in the 1990s, had major concerns about non-proprietary memory that had been installed, jeopardizing the main system for collecting loan information. She voiced her concerns to her CIO in no uncertain terms, believing the integrity of the loan origination system was at stake.

It turns out, Santor’s candor – and insights – were respected more than she could have anticipated. About a year later, that same CIO hired her to work at a national bank where she eventually became CISO.

“He appreciated my diligence, integrity and forthrightness,” Santor said. “This boosted my career and provided the backdrop for my future.”

Santor, a longtime ISACA member, recently retired as the Information Security Manager of Metropolitan Water District of SoCal, where she ensured the security of the business and SCADA network systems. Her responsibilities included review of all national and global intelligence that might affect water system reliability. She continues her ISACA involvement, and work with the FBI InfraGard and other professional organizations, to provide expertise in her areas of focus.

The fourth-generation Californian recently was nominated by a colleague as a finalist in the Los Angeles Business Journal’s CTO Awards.

“I have been in this work for 28-plus years and it has always been a passion, so to be recognized for that passion is reward in itself,” Santor said.

An information security professional “before there was such a title,” Santor said she emphasizes awareness of security best practices, including disaster recovery exercises and access controls.

Santor has been actively involved in ISACA’s Los Angeles chapter for 17 years. She was an IT auditor when she first joined.

“Seeing that audit and security went hand-in-hand, in providing the best for any organization, I joined ISACA,” Santor said. “I knew that ISACA would provide me the intelligence and expertise as I moved through my career.”

In recent years, Santor has become especially passionate about ISACA’s Cybersecurity Nexus (CSX) program as a resource for cyber security professionals to gain the needed skills and training to keep pace with fast-evolving cyber threats.

“Whether they are entering the field, changing careers or just becoming the person who is taking cyber security on for their company, they can look to ISACA’s knowledge to support their efforts,” Santor said.

Santor and her husband, Louis, have four children and eight grandchildren. Rather than having a hard time keeping up with her grandchildren, it might be the other way around; Santor is a car enthusiast whose hobbies include racing Corvettes and Cadillacs.  A less adrenaline-infused passion is quilting, which Santor said benefits from a similar mindset to her professional wiring.

“I like to take fabric, cut it up and create a new version or outcome,” she explained. “To me it is somewhat like computer forensics. You are presented with a puzzle and you need to make sense of it as the final outcome – an investigative process in both instances.”

[ISACA Now]

Posted on

Gearing Up for the Collegiate Cyber Defense Competition

It’s that time of the year when we get to root for our alma mater or favorite college competing in the Collegiate Cyber Defense Competition (CCDC). This year, Palo Alto Networks is supporting all 10 regional competitions, and the national competition, through the donation of our next-generation firewall, which CCDC teams will use to defend their networks. The Academy Team has set up a Moodle training course for competing teams to learn how to deploy and configure our next-generation firewall to defend their competition networks. Currently, there are more than 800 participants from CCDC teams on our Moodle training site. We also have teamed with the Network Development Group to provide CCDC competing teams with access to our NETLAB+ VM-100 lab pod. Teams are accessing these resources now to prepare for this competition.

Just like the “Sweet 16,” the winning team at each of the regional competitions goes on to compete in the National CCDC, where the winning team is crowned the national champion. This year, the national competition will take place from April 13 to 15, 2017 in the Henry B. Gonzalez Convention Center in San Antonio, Texas.

The national CCDC website includes the mission of the program and a brief description of the competition framework: “CCDC competitions ask student teams to assume administrative and protective duties for an existing “commercial” network – typically a small company with 50+ users, 7 to 10 servers, and such common internet services as a web server, email server and e-commerce site.

Each team begins the competition with an identical set of hardware and software and is scored on its ability to detect and respond to outside threats; maintain the availability of existing services, such as mail servers and web servers; respond to business requests, such as the addition or removal of additional services; and balance security needs against business needs. Throughout the competition an automated scoring engine is used to verify the functionality and availability of each team’s services on a periodic basis, and traffic generators continuously feed simulated user traffic into the competition network.  A volunteer red team provides the “external threat” all internet-based services face and allows the team members to match their defensive skills against live opponents.

When students enter their competition area, they are told they are replacing an IT staff that was fired for negligence and incompetence. As a result, the clients and servers on their networks may be infected with malware and/or configured insecurely, allowing easy access to external attackers. The CCDC competitions last for 20 hours spread over two to three days. The winner of the competition is the team that can keep its services up the longest and scores the highest points for correctly answering the business “injects.”

The competition is organized into color-coded teams. The Blue Team is the student team consisting of five to eight students, two of which can be graduate students; there are multiple such teams in each competition. The Red Team provides the external threat for the Blue Team. Red Team members are usually professional penetration testers. Last year Raphael Mudge, the developer of Armitage for Metasploit, was a Red Team member at the Northeast CCDC. The White Team provides the referees for the competition and generates the business tasks for the Blue Team. At the end of the competition, the White Team determines the winner based on up-time and business inject points. The Orange Team provides customers with whom the Blue Team interacts. The Black Team is responsible for setting up the competition environment for the Blue Team.

Representatives from our Academy and Delivery teams will be at all 10 regional CCDCs in addition to the National CCDC. They will provide technical advice to the competition teams, information about our college internship opportunities, and information about our great academy program. Additionally, Rinki Sethi, our Senior Director of Information Security, will be a member of the White Team at the Midwest CCDC.

Here is the CCDC competition schedule:

  1. Rocky Mountain CCDC, March 10–11, Regis University, Denver, Colo.
    • Regis University
    • Colorado State University
    • Brigham Young University
    • Utah Valley University
    • Southern Utah University
    • LDS Business College
    • Front Range Community College
    • USAF Academy
    • University of New Mexico
    • University of Nebraska/ Kearney
  1. Northeast CCDC, March 17–19, RIT Rochester, N.Y.
    • Champlain College
    • Harvard University
    • Northeastern University
    • Rochester Institute of Technology
    • Syracuse University
    • University at Buffalo
    • University of Maine
    • University of New Hampshire
    • Utica College
    • Westchester Community College
  1. Midwest CCDC, March 17–18, Moraine Valley Community College, Palos Hills, Ill.
    • Participating teams to be announced.
  1. Southwest CCDC, March 17–19, University of Tulsa, Tulsa, Okla.
    • Participating teams to be announced.
  1. Pacific Rim CCDC, March 24–26, Highline College, Des Moines, Wash.
    • Central Washington University
    • Clover Park Technical College
    • Columbia Basin College
    • Green River College
    • Lewis & Clark College
    • Peninsula College
    • Spokane Falls Community College
    • The Evergreen State College
    • University of Idaho
    • University of Washington, Bothell
    • University of Washington, Seattle
    • University of Washington, Tacoma
    • Western Washington University
    • Whatcom Community College
  1. Western Regional CCDC, March 24–26, Cal Poly Pomona, Pomona, Calif.
    • Arizona State University
    • UC Berkley
    • Cal Poly Pomona
    • CSU Northridge
    • CSU San Bernardino
    • Stanford University
    • UC Riverside
    • University of Advancing Technology
  1. At Large CCDC, March 24–26, Online
    • Participating teams to be announced.
  1. Mid Atlantic CCDC, March 30–April 1, John Hopkins University, Laurel, Md.
    • Participating teams to be announced
  1. North Central CCDC, March 30–31 Dakota State University, Madison, S.D.
    • Participating teams to be announced.
  1. Southeast CCDC, April 5–6 Kennesaw State University, Kennesaw, Ga.
    • Participating teams to be announced.
  1. National CCDC, April 13–15, Henry B. Gonzalez Convention Center, San Antonio, Texas
    • The winners from the 10 regional CCDCs.

[Palo Alto Networks Research Center]

Posted on

Traps “Can Can” Prevent RanRan Ransomware

A recent Unit 42 blog post breaks down the newly identified ransomware “RanRan,” targeting multiple Middle Eastern government organizations. Driven by what appear to be political motives, the RanRan attacker encrypts data until victims make a negative public statement against a particular political leader.

Prevention against ransomware, like RanRan, is possible with Palo Alto Networks Traps advanced endpoint protection. Traps prevents malicious executables with one-of-a-kind multi-method malware prevention, which provides multiple kill points throughout the attack lifecycle.

Reduce the Attack Surface

Traps has a number of features that allow admins to proactively reduce the attack surface, including execution restrictions and admin override policies. Restrictions can be set using rules for folders (like temp directories), external media (such as USB drives), child processes and others.  Admin override policies give admins granular control over which applications should or should not be able to execute.

Superior Threat Intelligence and Automated Prevention

In real time, Traps cross-references our WildFire threat intelligence cloud to determine if the hash has already been identified as malicious elsewhere within the broader Palo Alto Networks community. If the file has been seen before and identified as safe, it proceeds to execute. If the file is identified as malicious, Traps instantly prevents it from executing.

Better Approach to Preventing Unknown Threats

If an executable is unknown, Traps uses static analysis to identify whether it contains malicious characteristics or not. Rather than utilizing a signature-based approach, Traps uses local static analysis to identify malware characteristics derived through machine learning. Should the executable contain malicious characteristics, Traps prevents it from executing.

Verdicts, benign or malicious, are fed back into the threat intelligence cloud so that any other endpoint that tries to execute this file is informed and protected instantly.

 

The Traps multi-method malware and exploit prevention enables protection against known, unknown and zero-day threats, including new ransomware such as RanRan.

Learn more about Traps advanced endpoint protection.  

Ignite ’17 Security Conference: Vancouver, BC June 12–15, 2017

Ignite ’17 Security Conference is a live, four-day conference designed for today’s security professionals. Hear from innovators and experts, gain real-world skills through hands-on sessions and interactive workshops, and find out how breach prevention is changing the security industry. Visit the Ignite website for more information on tracks, workshops and marquee sessions.

[Palo Alto Networks Research Center]

Posted on

Palo Alto Networks Unit 42 Vulnerability Research March 2017 Disclosures

As part of Unit 42’s ongoing threat research, we can now disclose that Palo Alto Networks Unit 42 researchers have discovered three code execution vulnerabilities affecting Adobe Flash (APSB17-07) that were addressed in Adobe’s monthly security update release:

  1. CVE-2017-2997: Tao Yan
  2. CVE-2017-2998: Tao Yan
  3. CVE-2017-2999: Tao Yan

For current customers with a Threat Prevention subscription, Palo Alto Networks has also released IPS signatures providing proactive protection from these vulnerabilities. Traps, Palo Alto Networks advanced endpoint solution, can block memory corruption based exploits of this nature.

Palo Alto Networks is a regular contributor to vulnerability research in Microsoft, Adobe, Apple, Google Android and other ecosystems. By proactively identifying these vulnerabilities, developing protections for our customers, and sharing the information with the security community, we are removing weapons used by attackers to threaten users, and compromise enterprise, government, and service provider networks.

Ignite ’17 Security Conference: Vancouver, BC June 12–15, 2017

Ignite ’17 Security Conference is a live, four-day conference designed for today’s security professionals. Hear from innovators and experts, gain real-world skills through hands-on sessions and interactive workshops, and find out how breach prevention is changing the security industry. Visit the Ignite website for more information on tracks, workshops and marquee sessions.

[Palo Alto Networks Research Center]

English
English
Exit mobile version