blog Archives - Page 9 of 16

Information Rights Management Monitor: Survey: Insider attacks cause more damage than outside assault

27. February 2011 · Comments Off · Categories: blog · Tags: Covertix, insider threats, SANS 20 Critical Controls

Information Rights Management Monitor: Survey: Insider attacks cause more damage than outside assault.

The debate continues about outsider vs. insider attacks. Which are more prevalent? Which are more costly?

A recent survey conducted by SCO Magazine and sponsored by Deloitte, claims that:

58 percent of attacks are caused by outsiders and only 21% by insiders. At the same time, however, 33% view the insider attacks to be more costly than outside attacks, compared to 25% in 2010.

Now one might think that it’s in Deloitte’s interest to promote the growing threat of insider attacks because it’s an audit firm. However, I found this statistic to be interesting:

The authors noted that the public may not be aware of the number of insider events or the level of the damage caused because 70% of insider incidents are handled internally without legal action.

In my view, the difference between an outsider and an insider attack is narrowing if you define an insider as one who has authorized access. This is due to the increasing prevalence of botnet attacks which steal credentials. Thus an outsider becomes an insider. Of course, if the definition is based on the identity type of the attacker the difference between outsider and insider is clearer.

Therefore when planning your security defenses, it’s critically important to use an approach which starts with identifying the attacker types and their objectives. That’s why I like the SANS 20 Critical Security Controls for Effective Cyber Defense.

YouTube – Seculert Cyber Threat Management

14. February 2011 · Comments Off · Categories: blog · Tags: botnets, Seculert, YouTube

YouTube – Seculert Cyber Threat Management.

Our partner Seculert has just published this video on YouTube, highlighting it’s ability to complement existing security controls to provide detailed information on systems compromised by botnets.

Seculert Research Lab: The New Trend in “Malware Evolution”

02. February 2011 · Comments Off · Categories: blog · Tags: botnets, Carberp, Seculert, Zeus

Seculert Research Lab: The New Trend in “Malware Evolution”.

This post by Seculert Research Labs provides an overview of the evolution of Carberp. Carberp is a relatively new botnet which is rapidly evolving into the one of the most sophisticated pieces of malware ever seen.

Some say it will be the successor to Zeus. Whether that happens remains to be seen, but its developers are surely competing for the cybercriminals’ software budget.

Schneier on Security: Whitelisting vs. Blacklisting

30. January 2011 · Comments Off · Categories: blog · Tags: blacklists, next-generation firewall, Positive Control Model, whitelisting

Schneier on Security: Whitelisting vs. Blacklisting.

Excellent discussion of whitelisting vs. blacklisting. In theory, it’s clear which approach is more appropriate for a given situation. For example:

Physical security works generally on a whitelist model: if you have a key, you can open the door; if you know the combination, you can open the lock. We do it this way not because it’s easier — although it is generally much easier to make a list of people who should be allowed through your office door than a list of people who shouldn’t–but because it’s a security system that can be implemented automatically, without people.

In corporate environments, application control, if done at all, has been done with blacklists, it seems to me, mainly because whitelisting was simply too difficult. In other words, in theory white listing is the right thing to do, but in practice the tools were simply not there.

However, this is changing. Next Generation Firewalls hold the promise of application whitelisting. If the NGFW can identify and classify all of the applications traversing the organization’s network, then you have the visibility to implement application whitelisting.

The advantage of network-based application whitelisting is that you get off the treadmill of needing to identify every new potentially malicious application and adding it to the blacklist.

The objective is that the last firewall policy rule is, “If application is unknown, then block.” At that point you have returned to the Positive Control Model for which firewalls were conceived.

SaaS Compliance solution from Navajo Systems

25. January 2011 · Comments Off · Categories: blog · Tags: compliance, Gmail, Navajo Systems, privacy, SaaS Compliance, Salesforce, security, SuccessFactors

While there are many compelling benefits to Software-as-a-Service solutions like Salesforce, SuccessFactors, and Gmail, there are also privacy, security and compliance inhibitors which arise from the fact that SaaS application data is stored in clear text.

For many organizations, encrypting the communication between users and SaaS applications is simply not enough. Some large organizations have resorted to installing SaaS applications in their datacenters to meet privacy, security and compliance requirements. This way they get some of the SaaS application benefits but still must endure the real estate, power, hardware, communications, and associated administrative expenses themselves.

Some organizations have restricted the use of SaaS applications to those where clear-text data does not run afoul of regulatory issues.

The ideal solution would be to encrypt data on the way into and back out of the SaaS applications. SaaS backup solutions, for example, have been doing this for years. The file metadata stays in clear text but the files themselves are encrypted. However, for data-oriented applications like Salesforce, SuccessFactors, and Gmail, standard data encryption does not work because once the data is encrypted, you cannot search or sort on it.

Finally, a solution has come to market – Navajo Systems – which allows you to meet regulatory compliance requirements for storing, for example, Personally Identifiable Information (PII) and Protected Health Information (PHI) in SaaS applications. Navajo’s breakthrough is an encryption algorithm which allows searching and sorting. In other words, data is encrypted before it leaves your organization and is stored in the SaaS application in that same encrypted form, yet can be searched and sorted in a way that is both transparent to the SaaS application and to the users!!

Only you have the encryption keys. No one at the SaaS vendor can read your data. Full disclosure, Cymbel is partnering with Navajo. We would be glad to show you exactly how this works.

Here are links to more information about SaaS Compliance and Navajo Systems.

Panda Security goes inside the web’s black market

24. January 2011 · Comments Off · Categories: blog · Tags: Cybercrime Black Market, FireEye, malware, Panda, trojans

Panda Security Goes Inside Web’s Black Market

PandaLabs released 44 page report called, The Cyber-Crime Black Market: Uncovered. If you are not familiar with the subject, this report is very good. Here are some highlights:

The exponential growth of malware

Five years ago, there were only 92,000 strains of malware cataloged throughout the company’s 15-year history. This figure rose
to 14 million by 2008 and 60 million by 2010, which gives a good indication of the rate of growth.

At this rate is it reasonable to rely on a signature-based approach to malware detection? No mention is made of 0-day malware. We like FireEye‘s behavioral approach to complement a signature-based approach to anti-malware.

The cyber-crime professions

Panda quotes the FBI’s list of ten different professions that make up the cyber-crime black market – Programmers, Distributors, Tech Experts, Hackers, Fraudsters, Hosted systems providers, Cashiers, Money mules, Tellers, and Organization Leaders. This division of labor should give you some idea of the maturity of the cyber-crime underground.

The process

Panda does a fairly good job of documenting the process although this section of the report could have been better organized.

The black market at-a-glance

This section show just how sophisticated the black market ecosystem is. Just like the markets we engage in every day, there are promotion, try & buy offers, discounts for volume purchases, multiple payment options, and post-sale support services.

What to do and what not to do

The report closes with some common sense advice as to what to do and what not to do to minimize your risk of cyber-fraud.

Zeus evolves to target online payment providers

24. January 2011 · Comments Off · Categories: blog · Tags: online payment providers, Trusteer, Zeus

Zeus Latest Evolution in Malware Trends – Targets Online Payment Providers.

Trusteer is reporting on the evolution of the Zeus malware. Originally it targeted users performing online bank transactions. It’s now targeting online payment providers like Money Bookers, Web Money, netSpend, and e-gold. These types of companies have millions of users. If one of these users has his or her account looted, what recourse does the person have? After all, these are not banks and are most probably not legally bound to make good to their abused clients.

RiskPundit