-- Although standard Web browsers are becoming more secure, attackers continue to rely on automated toolkits, obfuscation, and the prevalence of unpatched browsers and plug-ins to successfully gain hold of new endpoint victims.
-- In the first half of 2008, 94 percent of public exploits affecting Web browserrelated vulnerabilities were released on the same day as the disclosure.
· Independent researchers are almost twice as likely to have exploit code published on the same day as their vulnerability disclosure in comparison to research organizations.
· Although virtual machine breakout vulnerabilities tend to get a lot of attention from the press, they are rare and predominantly target x86 platforms and Type II (virtualization solutions that require a host operating system).
· “Complex” spam (spam that uses images, PDFs, or complex text/HTML) is on the decline and a simpler type of spam is taking its place.
· This simpler spam relies on Web links and short text messages inside spam e-mails, which may be more difficult for some antispam technologies to detect.
· For the first half of 2008, a password stealer family that targets online games is in first place on the top ten malware list, and, in the password stealer category, gamerelated malware takes 50 percent of the top ten spots overall.
http://www-935.ibm.com/services/us/iss/xforce/midyearreport/xforce-midyear-report-2008.pdf
]]>“We are very excited about this release of StealthWatch.
“As the national IPv6 test center for Ireland and with over 40 active projects, it is critical for us to gain visibility into IPv6 network” said Jerry Horgan, chief infrastructure officer of the Telecommunications Software & Systems Group (TSSG, http://www.tssg.org) of Waterford Institute of Technology.
Powers added, “StealthWatch delivers enterprise-wide picture of communications and interdependencies between users, applications, and systems to expedite troubleshooting and proactively address network performance issues,” said Adam Powers, CTO of Lancope.
By providing network visibility of IPv6 networks, StealthWatch helps enterprises manage risk, reduce the mean time to resolution (MTTR) and improve the end user experience. StealthWatch’s pervasive monitoring delivers visibility before, during and after IPv6 rollouts to minimize threats, such as neighbor discovery attacks, amplification attacks, application vulnerabilities and tunneling. Enterprises can now use StealthWatch behavioral analysis and response to aid WAN optimization.
Introducing powerful network security capabilities that support multiple, ongoing compliance initiatives, StealthWatch’s newly enhanced bot detection and packet capture search capabilities dramatically reduce network risk by minimizing MTTR.
Other enhancements include deepening integrations with existing network infrastructure and third-party technologies to authenticate users and provide high availability credentials.
http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/www/story/07-29-2008/0004857757&EDATE=
]]>“We are very excited about this release of StealthWatch.
“As the national IPv6 test center for Ireland and with over 40 active projects, it is critical for us to gain visibility into IPv6 network” said Jerry Horgan, chief infrastructure officer of the Telecommunications Software & Systems Group (TSSG, http://www.tssg.org) of Waterford Institute of Technology.
Powers added, “StealthWatch delivers enterprise-wide picture of communications and interdependencies between users, applications, and systems to expedite troubleshooting and proactively address network performance issues,” said Adam Powers, CTO of Lancope.
By providing network visibility of IPv6 networks, StealthWatch helps enterprises manage risk, reduce the mean time to resolution (MTTR) and improve the end user experience. StealthWatch’s pervasive monitoring delivers visibility before, during and after IPv6 rollouts to minimize threats, such as neighbor discovery attacks, amplification attacks, application vulnerabilities and tunneling. Enterprises can now use StealthWatch behavioral analysis and response to aid WAN optimization.
Introducing powerful network security capabilities that support multiple, ongoing compliance initiatives, StealthWatch’s newly enhanced bot detection and packet capture search capabilities dramatically reduce network risk by minimizing MTTR.
Other enhancements include deepening integrations with existing network infrastructure and third-party technologies to authenticate users and provide high availability credentials.
http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/www/story/07-29-2008/0004857757&EDATE=
]]>Davis added:It is clear that Information security is changing radically and will continue to change. The pressure for this comes from within the profession and from external forces such as businesses, regulators and changes in culture and behaviour.Although differences exist between both geographical regions and industry sectors, common themes can be identified.
The Report entitled, the Role of Information Security in the Enterprise, is one of over 200 authoritative reports available free of charge to ISF Members.
]]>These audits were conducted in the first six months of 2008 in enterprises of different sizes and revealed that not even one organization was completely clean from internal threats, and the minimum number of threats found was three.
]]>Blogspot.com accounts for 2 percent of all of the world’s malware hosted on the web.
]]>Intrepidus provides templates to help organizations simulate attacks and allows organizations to measure, track and report on employees’ responses to the tests.
PhishMe does not collect sensitive information, Higbee said, explaining that JavaScript on the Web site overrides anything users actually input into fields during tests.
]]>As we build software, regardless of whether we’re in an agile or a waterfall world, we need agreement on what we’re building, what we’re not building, and what we’re doing to ensure we’re building the right thing. In the past few years, a perception that threat modeling is a heavy, bureaucratic process has been generated. There are some good reasons to move toward adding processes; I’d like to talk about them, some lessons learned from these processes, and how to put the fun back in threat modeling while making it an efficient, agile-friendly activity that anyone can do.
Approaches to Threat Modeling
There are many things called threat modeling. Rather than argue about which is “the one true way,” consider your needs and what your skills, abilities, and schedules are, and then work with a method that’s best for you. As part of that approach, some people ask, “What’s your threat model?” and “Have you threat modeled that component?”
One is requirements elicitation, the other design analysis. At Microsoft, we almost always mean the latter technique. There are more threat modeling methods out there than I can dream of covering in one column. There’s also a tremendous diversity of goals. Should your threat modeling process be fast or deep? Should it focus on assurance and completeness, or ease of use? Should you involve experts or developers in every meeting? Do you have organizational or industry rules you need to follow, such as the Microsoft® Security Development Lifecycle (SDL) or the rules for medical device manufacturers?
The high level objective should be to understand security issues early so you can address them in the design rather than try to overcome design flaws later. Some of the major ways to approach threat modeling activity include the following:
Assets
Asset-driven threat modeling is much like thinking about what you want to protect in your house. You start by listing what assets your software has associated with it, and then you think about how an attacker might compromise those assets. Examples include a database that stores customer credit cards or a file that contains encrypted passwords. Some people may interpret an asset as an element of the threat modeling diagram, thinking that a Web server itself is an asset. Digital assets are things an attacker wants to read, tamper with, or deny you the use of.
Attackers
Attacker-driven threat modeling involves thinking about who might want your assets, and it works from an understanding of their capabilities to an understanding of how they might attack you. This works great when your adversary is a foreign army with a known strategic doctrine, physical world limits, and long-lead-time weapons systems development. This works less well when your adversary is a loosely organized group of anonymous hackers. More generally, it’s not clear this is useful in software threat modeling. There are certainly people for whom “think like an attacker” is an effective part of design analysis. It’s less clear that this is a reproducible process in which people can get training. If you’re going to start from attackers, it’s probably worth using a standard set. It will be helpful to have a small set of these anti-personas written out.
Software Design
Design-driven threat modeling is threat modeling based on where your fences and windows are. You draw diagrams and worry about what can go wrong with each thing in your diagram. (This is the essence of the SDL threat modeling process today because everyone in software knows how to draw diagrams on a whiteboard.) The software equivalents of fences and windows are the various forms of attack surface, such as file parsers or network listening services---sockets, remote procedure call (RPC) services, Web services description language (WSDL) interfaces, or AJAX APIs. They’re the trust boundaries where you should expect an attacker to first get a foothold.
A Quick and Dirty Threat Model
Threat modeling doesn’t have to be a chore. Following the process illustrated in Figure 1, here is the outline of a basic threat modeling process that will get you going quickly and painlessly: Diagram your application, and use this to tell your app’s story in front of the whiteboard (see Figure 2). Use circles for code, boxes for things that exist outside of it (people, servers), and drums for storage. Our team uses funny looking parallel lines for data stores. Draw some trust boundaries using dotted lines to distinguish domains. When you get stuck, apply the STRIDE threat model, described in Figure 3, on each element of your app. All the threats in one place may mean you’re worried about the front door and not worrying about anything else. A third order defense might be an alarm system on the door, and to mitigate the threat of someone cutting the wire, you send a regular message down the wire. If you find yourself worrying about the software equivalent of what happens when someone cuts the phone wire to the alarm system before you worry about locks on the doors, you’re worrying about the wrong things.
File bugs so you can fix what you found threat modeling. Modifying a DLL on disk or DVD, or a packet as it traverses the LAN. Allowing someone to read the Windows source code; publishing a list of customers to a Web site. Crashing Windows or a Web site, sending a packet and absorbing seconds of CPU time, or routing packets into a black hole. Elevation of Privilege Authorization Gain capabilities without proper authorization.
Finally, you need to account for the availability of time and resources both for your threat modeling process and any resulting mitigation and testing.
Microsoft has found that threat modeling works better with a security expert in the room, but there isn’t always one available. You can get decent results by giving people structure and feedback on their work, and by breaking it down into small, easy pieces with rules and self-checks in each one. For problems validating the threat model and your mitigation plan, look to see whether the diagrams represent the code and whether you have agreement between developers and testers on that.
]]>The CA survey results show there has been significant time and IT budget spent on IT security compliance to help meet regulations and mitigate future risk. The survey results point to Identity Access and Management (IAM) solutions as a key and growing area of security investment by large U.S. organizations. Survey respondents indicate that more than 85 percent of large U.S. organizations are using an IAM solution, with 75 percent of those organizations planning to make further IAM investments within the next 12 months.
]]>“Over the course of the last 18 months we have been watching the profit-driven Cybercrime market maturing rapidly… This makes businesses today even more vulnerable for cybercrime attacks, especially considering the maturity of the cybercrime market and its well-structured cybercrime organizations,” said Yuval Ben-Itzhak, Finjan’s CTO.
The report explores the trend of loosely organized clusters of hackers trading stolen data online being replaced by hierarchical cybercrime organizations. These organizations deploy sophisticated pricing models, Crimeware business models refined for optimal operation, Crimeware drop zones, and campaigns for optimal distribution of the Crimeware. These cybercrime organizations consist of strict hierarchies, in which each cybercriminal is rewarded according to his position and task. Directly under him is the “underboss”, acting as the second in command and managing the operation. This individual provides the Trojans for attacks and manages the Command and Control (C&C) of those Trojans.
As a preventative measure, businesses should look closely at their security practices to make sure they are protected.
http://www.security-industry-today.com/news/news_all.asp?ID_key=381
]]>