Categories ArchivesEnterprise Security

Fun Research on Information Flows standard

I am doing some research on inference attacks in advance of one of my RSA Conference sessions and happened across this very interesting piece of research by Roya Ensafi, Mike Jacobi, and Jedidiah R. Crandall from the University of New Mexico’s Department of Computer Science entitled, “Students Who Don’t Understand Information Flow Should be Eaten: An Experience Paper.” Not only is it absolutely true (and frankly, this applies to practitioners too), but it’s another fascinating example of how games (and game theory) can teach us about real scenarios we face every day. One key element to understand in this paper is this is a lab environment that is closely monitored with a tight feedback loop that allowed the game makers ...

Continue Reading

Big Data Fuels Intelligence-Driven Security standard

On Tuesday, RSA released a new security brief entitled “Big Data Fuels Intelligence-Driven Security.” Indeed, one of the themes of this blog over the last year or so has been looking for the bad guys hiding in plain sight. Your standard controls won’t catch them—or at least won’t catch them in time. Instead, you will probably rely on poorly constructed logs and expensive forensics to try and piece together exactly what happened. The brief identifies two key shifts are driving the need for behavior-based controls: Dissolving network boundaries whereby legitimate users are probably not doing all of their activity within the physical four walls of the building, and Adversaries are getting much more sophisticated and they surgically attack organizations using ...

Continue Reading

Deceit as a Defense standard

An information security professional’s job is becoming more like military defense every day. We are charged with battling on multiple fronts, typically without enough resources to do the job well. Yet, our creativity can serve us well in defeating any number of attackers before they steal our goods. Now we have another great example of a company taking military defense techniques to a new level and leveraging deception in their daily process. Keep in mind, deception of this level is much different from throwing a honeypot on your network and waiting for a low to mid-level hacker to stumble upon it. This is the kind of deception designed to confuse even the most sophisticated bad guys by using one of ...

Continue Reading

IDC Releases Alarming Trends for the Digital Universe standard

Nobody disputes the growth of digital information over the last decade enabled by technology developments in storage further put to use in the hands of consumers. We all create content every day; and as the phones get bigger and better processors, cameras, and radios, we can expect this to continue. To put the growth of digital information into perspective, think about how painful it was to download a thirty second HD movie clip five years ago or an entire music album ten years ago. Now we do it on our phones or tablets without thinking about it (until that data-bill comes in!). IDC released a study today (in conjunction with EMC) projecting that the digital universe will be so large ...

Continue Reading

The Biggest Thing The PCI Council Can Do standard

The PCI Council has been pretty influential in our lives since its inception on September 7, 2006. They were handed control of the PCI Data Security Standard and have turned it into a cascading group of standards that govern (or recommend controls) for nearly every aspect of payment acceptance and processing. So it almost seems like this PCI problem is sort of solved, doesn’t it? When you look at the PCI DSS ecosystem, many of the big rocks have already been addressed. This has some interesting side effects, one of which is a camp of merchants that have been hounded to get compliant (Levels 1-3) and a mass of merchants that have no clue about PCI DSS until they are ...

Continue Reading

PCI Council Releases Risk Assessment Guidelines standard

The PCI Security Standards Council announced today a new set of guidelines for risk assessments, as output from one of the major Special Interest Groups selected by the Participating Organizations in 2011. This topic is one I have written about before, and in fact it was one of the SIGs that I voted for. I’ve been through the output and I must say, I don’t see it as any different from any other risk guidance out there. It’s fairly comprehensive when it comes to listing common risk methodologies, it gives some sample frameworks and processes, and aims to give some clarity to the larger 12.1.2 subrequirement of PCI DSS. As with most risk-related topics, you will have people hailing its ...

Continue Reading

Securing Distributed Infrastructure standard

With Harvard Business Review calling the Data Scientist the sexiest career for the next 10 years, security professionals are going to have their hands absolutely full with securing the distributed infrastructure that powers big data analytics. The Hadoop infrastructure isn’t just one tool that you download to get you some Big Data fun, it’s really a framework of a multitude of tools (and options for substitution) that each carry out specific tasks in a distributed and flexible way. Part of the driving force behind wide-scale Hadoop environments is the notion that it is easier to move computation capabilities than it is to move data. This means that nodes will have some slice of data, but the end result analytics would ...

Continue Reading

Game Theory and Cyber Defense standard

One of my colleagues is working with a bunch of crazy-smart people at RSA Labs to explore how attacker-defender games can be used to help model behaviors and outcomes in the cyber defense realm. Notice how I am not saying “Information Security.” I know a lot of you hate the term “cyber,” but in this case it is a more accurate usage of what these games really teach us about. Check out this latest blog by Bob Griffin. In it, he discusses how game theory is making its way into the information security mainstream starting with several presentations at RSA Europe 2012 (and next week at GameSec in Budapest). The FlipIt game that these guys created is quite ground breaking, ...

Continue Reading

On Whitelisting ASVs standard

This topic has made the rounds again—both due to the community meetings happening over the last four weeks and with some customer discussions I became involved in. Essentially, the issue is this. ASVs need the ability to scan through perimeter defenses like IPS and companies being scanned want to showcase their defenses such that they activate (like they should) upon a scan. Both groups have valid points. The ASV is following the program guide. In order to provide passing scans they must be able to scan through perimeter defenses to the actual systems to generate an accurate vulnerability report. Having a scan instantly blocked doesn’t necessarily eliminate the possibility that a vulnerability could be exploited, it just stops that scan’s ...

Continue Reading

Slow Down Patching? standard

The whole discussion around patching and vulnerability management is a big problem in general, but typically exacerbated by compliance initiatives like PCI DSS. Companies want to be secure, in general, but they have different risk procedures that can change the manner in which they do things like patching or how they lock down desktop controls. A good friend of mine turned me on to a presentation that happened at the San Diego ToorCon this past weekend that I am curious about. The abstract pushes us into dangerous territory, that of interpretation of QSAs (something we have often chatted about here). In the abstract, the presenter takes the opinion that rushing to patch is undesirable (potentially agree) and that the language ...

Continue Reading

This is a unique website which will require a more modern browser to work!

Please upgrade today!