Categories ArchivesEnterprise Security

One of my colleagues is working with a bunch of crazy-smart people at RSA Labs to explore how attacker-defender games can be used to help model behaviors and outcomes in the cyber defense realm. Notice how I am not saying “Information Security.” I know a lot of you hate the term “cyber,” but in this case it is a more accurate usage of what these games really teach us about. Check out this latest blog by Bob Griffin. In it, he discusses how game theory is making its way into the information security mainstream starting with several presentations at RSA Europe 2012 (and next week at GameSec in Budapest). The FlipIt game that these guys created is quite ground breaking, ...

Last week I spoke at RSA Conference about using social engineering techniques as a form of espionage—a way to “game” big data, as it were. I believe that our current estimation of what can be derived from innocuous appearing data is not only lacking, but it’s nearing the level of irresponsibility. In our talk, we discussed how an attacker might go after a prized piece of information, say the formula for Coca Cola. If an attacker wants to re-assemble such a formula, he could apply techniques often used in social engineering. Social engineers don’t bluntly ask targets for their social security number, they ask them for pieces they can use to reconstruct it. For example, people tend to give out ...

Security professionals are fraught with crazy obstacles unseen in other parts of the technology space. For example, we are often fighting enemies we cannot see. They out-maneuver us by attacking our partners, informational supply-chain, and even the people. But they are not completely invisible if we know what to look for. There was a recent thread on the SIRA mailing list that discussed the concept of “non-observables,” or elements in the security space that cannot be feasibly observed by defenders. These elements, in theory, would be critical in event detection, thus providing defenders with better capabilities to shrink the window of vulnerability. This is a foolish notion that leads security people into an unnecessary state of helplessness. Consider Locard’s Exchange ...

IT and IS professionals have long acknowledged and lamented the dissolution of the network perimeter amid a global economic crisis and shrinking IT budgets. We must do more with less, be more efficient, and create and leverage economies of scale and scope to achieve all of this. But that doesn’t necessarily represent why the perimeter is dissolving, so what is going on? Businesses are exchanging information in real time (both providing and consuming) over public networks as opposed to frame relay or MPLS links behind the scenes. The number of telecommuters ((The State of Telework in the US – Five Year Trend and Forecast.)) in the US grew 61% from 2005-2009. This means more laptops over desktops, and now more ...