Blog

Posted on

Geek Out Over 4 New WildFire and Threat Prevention Features in PAN-OS 7.0

PAN-OS 7.0 is out and is jam-packed with new features including the following noteworthy WildFire and threat prevention features:

Grayware Verdict

The new WildFire grayware analysis result is introduced to clearly identify executables that behave similarly to malware, but are not malicious in nature or intent. A grayware result might be assigned to executables that do not pose a direct security threat, but display otherwise obtrusive behavior (for example, installing unwanted software, changing various system settings, or reducing system performance). Examples of grayware software can typically include adware, spyware, and Browser Helper Objects (BHOs). The grayware verdict allows the security responder to quickly distinguish malicious files on the network from grayware, and to prioritize accordingly. While antivirus signatures are not generated for grayware, WildFire logs can continue to alert the security responder to endpoints endpoints downloading grayware, in order to assess if such events are concerning.

Read more >> WildFire Grayware Verdict.

Blocking of Encoded Content

A new file type classification, Multi-Level-Encoding, can now be used to log or block content that has been compressed or otherwise encoded to a high degree. As the firewall can now decode and inspect up to four levels of encoding (see Increased Inspection Depth for Multi-Level Compression and Encoding), the new classification can be used to block files that have been encoded five times or more. Multiple levels of encoding can be used as an evasion technique to circumvent security devices; using the Multi-Level-Encoding file type to perform file-blocking ensures that unidentified files that have not been processed for threats are not passed through the firewall.

Read more >> Blocking of Encoded Content.

Hybrid Cloud

Security responders no longer have to choose between cloud-based and on-premise sandboxing and signature generation. Our hybrid cloud capabilities allow security responders more sandboxing flexibility, as they’re able to define which file types are sent to the WildFire public cloud versus the on-premise WF-500 appliance (used to host a private cloud). The new WildFire Hybrid Cloud feature enables customers to alleviate privacy or regulatory concerns by utilizing WildFire private cloud analysis for certain file types, and benefit from the comprehensive analysis capabilities of the WildFire public cloud for all other file types.

Read more >> WildFire Hybrid Cloud.

Intuitive Workflow to Forward Samples for WildFire Analysis

PAN-OS 7.0 introduces the new WildFire Analysis profile to set up a firewall to forward unknown files and email links for WildFire analysis—the WildFire analysis profile replaces the need in previous release versions to use a file-blocking profile to setup file-forwarding. Use a WildFire analysis profile to define traffic to be forwarded to the WildFire public cloud or a WildFire private cloud based on file type, application, or transmission direction (upload or download). Attach the WildFire analysis profile to a security policy rule, so that traffic allowed by the rule is evaluated against the WildFire analysis profile and forwarded to either the WildFire public cloud or private cloud for analysis.

Can’t Get Enough of PAN-OS 7.0?

Check out the New Features Guide 7.0 and the PAN-OS 7.0 Release Notes on the Technical Documentation Site, or select the 7.0 facet (under OS Version) on the Document Search page! Also, check out a few of our recent Technical Documentation posts highlighting other awesome features of PAN-OS 7.0:

Happy reading!
Your friendly Technical Publications team

[Palo Alto Networks Blog]

Posted on

Why China Wants Your Sensitive Data

Since May 2014, the Chinese government has been amassing a ‘Facebook for human intelligence.’ Here’s what it’s doing with the info.

Leading into 2015, the cybersecurity community was still reeling from the impact of a destructive attack unlike any other we have seen in terms of visibility, scale, and impact. Already halfway into 2015, there is no shortage of breaches. We have already witnessed major compromises in healthcare, the US government, the Bundestag, and media being attacked by sophisticated adversaries, in most cases, roaming freely on networks for months at a time.

Attackers from China, Russia, North Korea, ISIS, and even potentially friendly governments have dominated the headlines. In case you have your head in the sand, this is not going away anytime soon. Compared to traditional espionage, “cyber espionage,” or CNE as the military likes to designate it, has a lower cost of entry, less risk if you are caught or compromised, and can often yield equivalent intelligence to feed an ever-growing set of interested consumers. For criminals, the use of e-commerce systems and vulnerable payment mechanisms provides an avenue for rapid monetization and prosperity. Activists or hacktivists as they present themselves on the Internet are able to use electronic mediums to disseminate messaging from banal greets to truly meaningful causes that impact people’s lives across the globe.

Since May of 2014, the Chinese government has been amassing what can only be described as the “Facebook for human intelligence targeting” from the databases lifted from some of our most fundamental and essential systems. Why would anyone want healthcare records? If you take a step back, these records are part of a bigger picture, used in concert with the personnel records of US government workers and any other databases that have been stolen over the years. The beneficiary of that data can build an interesting picture detailing the confidential history, preferences, behavioral patterns, and more, of millions of potential intelligence targets.

The point that most people miss is that “cyber” data doesn’t just get used for cyber attacks, or cyber bullying, or cyber theft. The People’s Republic of China doesn’t only conduct network-based espionage, they are a major government on the world stage. They have human intelligence collectors whose job is to identify people with access to interesting or useful information and to collect that information. MICE is a common acronym we use in the information security industry — Money, Ideology, Compromise, and Ego – a simple set of motivations that can be used to entice or coerce a target to provide continued or temporary access to data.

Using stolen healthcare data, these human collectors can identify someone with access to sensitive information who unfortunately has a sick relative. As the healthcare bills pile up and they become increasingly despondent to help their sick relative get the medical treatment they need, an opening begins to emerge. The human collector, if they are able to identify this opening, can approach the target and begin to sow the seed for access, a simple trade of money for information, information that may seem insignificant to the target, but in aggregate across many different sources becomes quite valuable.

[Learn more from Adam about how to consume, operationalize and integrate threat intel during his training session on the fundamentals of intelligence-driven security, Black Hat 2015 Las Vegas August 1-2 & 3-4.]

It has been said that the network defender must be right 100 percent of the time, while the attacker need only be lucky once. The asymmetry of this is terrifying! Your network defenders should be in front of 10 monitors with an intravenous drip of caffeine and sugar twitching at every packet surging across your enterprise. The reality is that this is true, but we have systems and tools to help deter and detect these attackers.

These tools out of the box, while capable, don’t necessarily have all the smarts they need to root out these attackers:  these tools need intelligence. Intelligence-driven security means learning from previous attacks whether successful or not, and incorporating what you have learned into your defense posture. The military, in dealing with asymmetry encountered in Latin America in the 1980’s pioneered a process for incorporating intelligence into their targeting processes that has been continuously improved upon in the past 10 years.

This process involves taking the intelligence gleaned from every action, operation, or encounter and feeding it into the next operation to rapidly adapt to the changing environment. This same process introduced into security operations, what I call intelligence-driven security, can drive the cost of protecting the enterprise down, while simultaneously allowing the Security Operations Center (SOC) to have meaningful conversations with the business owners, the C-Suite, and the Board. Enterprise security isn’t just about blocking malware anymore, it’s about protecting the business and against dedicated and sophisticated threat actors.

Adam Meyers has over a decade of experience within the information security industry. He has authored numerous papers that have appeared at peer reviewed industry venues and has received awards for his dedication to the field. At CrowdStrike, Adam serves as the VP of Intelligence. Within this role it is Adam’s responsibility to oversee all of CrowdStrike’s intelligence gathering and cyber-adversarial monitoring activities. Adam’s Global Intelligence Team supports both the Product and Services divisions at CrowdStrike and Adam manages these endeavors and expectations. Prior to joining CrowdStrike, Adam was the Director of Cyber Security Intelligence with the National Products and Offerings Division of SRA International.

[Dark Reading]

Posted on

Engaging with Clients on EMV Migration

Cyber security is universally important to businesses, whether they are large, global enterprises or small business retailers. Its importance is underscored by the looming October 2015 Europay, MasterCard, Visa (EMV) liability shift that can transfer transaction fraud responsibility in the US from financial institutions to businesses. With the shift now less than five months away, it is essential for individuals who advise businesses—including security, governance, and audit professionals—to broadly help companies understand the rewards of EMV adoption and risks of non-adoption so business owners can be adequately prepared to meet the new status quo for transaction security.

To help business owners understand how best to prepare for the October liability shift, there are a few priority items that business consultants in the security, governance, and audit spaces should fast track in conversations with clients, including:

  1. Know your customers. Knowing your customer is an integral component in the world of financial transactions, especially at the world’s most systemically important institutions; however, it is also very important to retailers that transact on a business-to-business and customer level. Pulling together an intelligent view of a customer base through continuous internal audit allows business owners to efficiently assess where security weaknesses lie. For example, if a merchant frequently works with third parties that have poor security protocols, it would benefit that merchant to implement the right EMV tools to ensure that customers’ personally identifiable information and transaction data are effectively secured from every angle. Knowing your customer is especially important for e-commerce merchants as a move to EMV shifts fraud toward e-commerce merchants.
  2. Understand the risks involved. It is also critically important for business owners to understand the cost-benefit analysis of EMV adoption as it relates to their businesses. If a business owner decides to forgo adoption due to concerns over cost, it is important that he or she understands how inaction or delays will impact him or her. Businesses that delay EMV do not qualify for the liability shift associated with counterfeit cards—this means that you are liable for fraud from counterfeit cards. A host of other issues—including potential revenue losses that far outweigh EMV adoption costs, reputational damage and a decrease in customer loyalty—are big factors for merchants to consider as well.
  3. EMV does not solve all security issues. EMV is an anti-counterfeiting fraud countermeasure, not an encryption, tokenization or security standard. To ensure your business is protected, you must layer security technologies like encryption and tokenization on top of your EMV deployment to be adequately protected.
  4. Gauge your EMV need and prepare for PCI compliance audits. If a business owner determines EMV adoption is right for his or her business—and it is important to emphasize that EMV adoption is not federally mandated by law—then an IT and technology audit of their business is immensely useful in helping them determine how best to activate adoption. By nature of the different technologies available in today’s market, each business owner will discover that they have unique EMV needs, so determining which payment terminal is compatible with EMV or which technology is needed to properly secure customer data is essential (and cost-effective!) Furthermore, it is important for small businesses that are not EMV-compatible to prepare for a heightened incidence of PCI compliance audits as transaction liability shifts to them. Companies that are EMV ready will be more secure and less prone to security breaches—and therefore less likely to experience the audits that usually follow cyber thefts.

As noted previously, there are many nuanced and detailed considerations that businesses need to take into consideration when deciding if or how to adopt an EMV-ready stance. These waters are difficult for companies to navigate themselves, so it is immeasurably useful for them to have a partner or business consultant to help guide them through the process. As you engage clients in these important conversations—whether before, during or after the liability shift in October of this year—just remember that each client’s needs are unique and their paths to EMV readiness will be equally unique as well.

Branden Williams
CTO of Cyber Security Solutions at First Data

EMV™ is a trademark owned by EMVCo LLC.

[ISACA]

Posted on

Palo Alto Networks Traps Covers Top High Risk Vulnerabilities Highlighted By US-CERT

US-CERT recently issued an alert regarding the 30 most prevalent vulnerabilities in targeted attacks that took place in 2014. Each of these vulnerabilities, when exploited, equals a compromised endpoint.

From this compromised endpoint the attacker will expand to other endpoints and servers in your network until it reaches its goal, possibly stealing the crown jewels it set out for.

The CERT list is a valuable source, reflecting the actual threat landscape. Security decision makers can derive important knowledge from reading between its lines:

The prevailing attack scenario is still a user browsing or opening an attachment.According to the CERT list, the only exceptions are one OpenSSL and four ColdFusion vulnerabilities. The following discussion does not relate to these vulnerabilities.

Memory corruption, logical and Java Vulnerabilities:

CVE ID Targeted Application Vulnerability Type Zero Day
​CVE-2006-3227 Internet Explorer Charset obfuscation
CVE-2008-2244 MS Word Buffer overflow
CVE-2009-3129 MS Excel Excel featherhead record
​CVE-2009-3674 Internet Explorer Uninitialized memory corruption
​CVE-2009-3953 Adobe Reader\Acrobat Array overflow
CVE-2010-0806​ Internet Explorer Use after free yes
CVE-2010-3333 MS Office Stack buffer overflow
​CVE-2010-0188 Adobe Reader\Acrobat Stack buffer overflow yes
​CVE-2010-2883 Adobe Reader\Acrobat Stack buffer overflow yes
CVE-2011-0101 MS Excel Excel record parsing WriteAV
​CVE-2011-0611 Adobe Flash Player Object type confusion yes
​CVE-2011-2462 Adobe Reader\Acrobat Unspecified yes
CVE-2012-0158 MSOffice DOC\RTF Stack buffer overflow yes
CVE-2012-1856 MS Office Use after free
​CVE-2012-4792 Internet Explorer Use after free yes
CVE-2012-1723 Oracle Java Sandbox escape
CVE-2013-0074​ MS Silverlight Double Dereference
CVE-2013-1347 Internet Explorer Use after free yes
CVE-2013-2465 Oracle Java Sandbox escape
​CVE-2013-2729 Adobe Reader Integer overflow
CVE-2014-0322​ Internet Explorer Use after free yes
CVE-2014-1761 Word Object Type confusion yes
​CVE-2014-1776 Internet Explorer Use after free yes
CVE-2014-4114 MS Office logical yes

Credit: US-CERT 

The targeted applications are the most common ones.  This comes as no surprise. The list is solely comprised of Internet Explorer, Silverlight MS Office, Oracle Java and Adobe Flash, Reader and Acrobat.

Vulnerabilities from 2012 and backwards comprise more than half of the list. This tells us more about victims rather attackers. Apparently non-patching is a common practice. Updating vulnerable software is not prioritized. This enables attackers to successfully leverage old vulnerabilities (dating back as far as 2006!) for their purpose.

Browser and attachment attacks are equally distributed. The distribution of these two main attack vectors is around 50/50 with slightly more browser exploits shown. Browser exploits are common in watering hole attacks and are typically integrated in exploit kits. Attachments on the other hand (Office, Adobe Reader etc.) are utilized in spear phishing attacks, targeting specific users. The nearly equal distribution implies that both vectors remain areas of concern..

Half of these vulnerabilities are zero days.  One of the most pressing issues for current cybersecurity strategists is the correlation between sophistication and prevalence. The non -proportional zero day presence in the CERT list implies that today’s zero day is tomorrow’s common attack vector. Of course, there is a natural selection involved which determines which zero-days will spread and which will decline.

Most of the memory corruption vulnerabilities enable exploits to bypass DEP and ASLR. In recent years, Windows integrated exploit mitigations forced attackers to adjust how exploits are written. The CERT list suggests they have succeeded; ROP, for example is common to almost all exploits shown. This illustrates once more the ever changing nature of the cyber threat arena in which whenever a security measure is introduced, attackers reflect, learn, reshape and attack in alternative patterns.

Addressing the Security Gap

Palo Alto Networks Traps directly addresses the security gaps reflected in the CERT list.

Traps prevents exploitation in real time by mitigating the core techniques that are common to all exploits. Exploitations of the vulnerabilities on the CERT list are different from each other but all of them converge into a known pool of techniques. Traps proactively obstructs these techniques, providing protection without relying on signatures or prior knowledge.

Learn more about advanced endpoint protection here.

[Palo Alto Networks Blog]

English
English
Exit mobile version