Author: admini

Review: ‘Hacker-in-a-Box’ Tool Tests Attack Scenarios

Posted on by admini

Today, most hacking is financially driven and well-organized, with attacks launched to steal information from banks, financial services firms and online retailers. With banks, for instance, hackers working with inside employees or identifying weak application exploits have been known to set up temporary offshore accounts to siphon tiny amounts from many of accounts. Stealing customer information is the most common attack, since it can be done with simple SQL-injection scripts to retrieve complete database tables.

With the arrival of Web 2.0 and Ajax, new vulnerabilities are popping up at the client level. To identify holes, developers must revalidate Ajax code at the server level before finalizing transactions. Essentially, Ajax creates the same types of vulnerabilities as server-based Web applications, but they’re more magnified because more code is exposed at the client side, with less validation done at the server side.

Cenzic promotes a “divide and conquer” methodology, in which security administrators make critical decisions on how to test applications during development and QA testing. The only security strategy promoted by ASPs and ISPs deals with providing firewall and SSL support to applications, leaving application logic completely out of their security infrastructure.

In addition to Hailstorm, Cenzic offers two ASP models to simplify remote testing and QA for customers that don’t have the resources in-house.

http://www.darkreading.com/document.asp?doc_id=102274&WT.svl=cmpnews2_1

Read more

Enterprises Still Not Sweet on Honeypots

Posted on by admini

“It’s a great alarm system — there are no false positives with honeypots.

Honeypots have long been used in research networks, federal government agencies (especially the Department of Defense), and law enforcement for tracking potential attacks, attackers, or perpetrators. One such application would be for detecting an internal user’s suspicious activity on the network, or if an outsider was poking around the network from the inside, says Logan. “Most times attackers will use an [enterprise’s] server or end-user PC to further explore the enterprise, so you could have an employee unwittingly being used.”

But once you put up that sexy honeypot and attackers start buzzing around, you’ve exposed yourself, critics say. Thomas Ptacek, a researcher with Matasano Security, says honeypots not only invite trouble, but they also generate operational overhead that most organizations don’t have the manpower to handle. Arbor Networks has a “dark IP” monitoring feature that uses unused IP addresses within an organization for the honeypot machines, so it’s obvious when an attacker is knocking. It used to run honeypots on its DMZs, says Mark Butler, manager of security and compliance services for H&R Block. The devices detect an attacker’s reconnaissance behavior and respond with “fake” information using ForeScout’s proprietary honeynet technology. “It gives me trends, such as what type of behavior is going on,” and if connections are coming from Russia, for example, and at what frequency, says Butler, who acknowledges it doesn’t catch everything.

“Once you turn on a honeypot in your network, you’ve created something to keep you up at night,” says Jeff Nathan, software and security engineer for Arbor Networks.

http://www.darkreading.com/document.asp?doc_id=102139&WT.svl=news1_2

Read more

IBM Up-Ends Security Services Market

Posted on by admini

“We see a $22 billion market opportunity in managed security services, and we intend to offer a single solution for companies that have not felt comfortable outsourcing until now,” says Val Rahmani, general manager for IBM’s Infrastructure Management Services unit.

“IBM has been showing a tendency to move back, in many ways, to the old mainframe days, where it owned an account top to bottom,” says Rob Enderle, president of the Enderle Group, an IT consultancy.

“I think this acquisition is definitely part of an overall trend, where the more mature parts of the security industry — things like firewalls — are aggregated into fewer, larger companies,” says Robert Richardson, editorial director at the Computer Security Institute.

Big Blue has been carefully vendor-neutral in its approach to managed services in the past, but it seems unlikely that the company will be able to maintain that stance as it integrates the ISS technology into its offerings. The acquisition comes less than two months after IBM storage rival EMC picked up RSA Security for $2.1 billion. “RSA had been shopping itself for some time, and I assume they probably spoke with IBM. But a deal that size [EMC-RSA] probably woke up a lot of larger vendors that this is going to be a major issue going forward, and it’s better having the IP and services in house than relying on partners. “The only thing that is similar is when EMC wanted to jump into the security space they went for a household brand.

http://www.darkreading.com/document.asp?doc_id=102103&WT.svl=news1_3

Read more

Standard Could Unify Security Apps

Posted on by admini

Security managers have been frustrated by the proliferation of “point products” in their environments, which generate a ton of data but offer no method to filter or correlate it to find the root cause of a violation.
Security information management (SIM) tools offer a possible solution, but each has its own proprietary means of collecting and presenting security data.

“What the CEF offers is a standard way to normalize the data from the different devices and tools so that it can be analyzed,” says Steve Sommer, senior vice president of marketing and business development at ArcSight.

If it’s adopted across the industry, the CEF could play a role similar to SNMP, the IETF standard that unified network and systems management tools a decade ago. So far, however, the vendors that have announced support for CEF are those that were already ArcSight partners: AirTight Networks, CipherOptics, DeepNines, Intrusic, Reconnex, Vericept, and Vontu. Sommers says ArcSight is negotiating with “a multi-billion dollar competitor” in the SIM market, which is considering adopting the standard. He would not disclose the name of the vendor, but three of the multibillion vendors that make SIM tools are Cisco, Computer Associates, and Symantec. Even when a forum is selected, it will probably take six to 12 months to get on the agenda of the standards bodies, Sommers observes.

http://www.darkreading.com/document.asp?doc_id=102024&WT.svl=news2_4

Read more

How to Use Metrics

Posted on by admini

Internal controls, established to mitigate a variety of business risks, provide the dashboard to inform management on the status of core activities and to apply the brakes that keep the enterprise safely on course. The security organization plays a critical role in identifying, measuring, preventing and responding to a growing inventory of risks. We must be able to measure the probability and potential consequences of an identified risk, or management has no gauge to assess and prioritize what actions to take. Metrics are central to understanding the adequacy of security controls and where to focus our limited resources for the greatest contribution to the protection strategy.

This excerpt from the book Measures and Metrics in Corporate Security, Communicating Business Value gives a few examples of the ways CSOs can think about the data they collect as part of their security operations and identifies what is important to measure, and how to communicate with senior business executives about what the data indicates about their organization’s risk environment and how it’s being managed.

Security programs gather volumes of data every day. The successful security executive defines his business plan and the performance of resources and services around clearly articulated measures. Those measures should be aligned with core business strategy and priorities.

Figure 1 illustrates how a CSO has evaluated the importance of various security metrics, based on their relevance to business drivers such as managing costs and risks, focusing on return on investment, complying with the law and company policies, and protecting the lives and safety of employees. Note the last column on the right, which is checked every time: internal influence.

Effective use of metrics that matter to business leadership, demonstrating the value of security operations, wins a security executive important capital. Every CSO should have half a dozen dials to watch on a regular basis. These indicators could be “survival metrics,” the hot buttons on a dashboard you are expected to address that monitor the wellness of your organization or an issue of particular concern to management.

You may find that you have more than one dashboard—yours and the one your boss and a few key players expect you to watch and report on. The CFO could be an excellent resource to advise you on the presentation of dashboard metrics since this officer typically reports performance metrics to management on a regular basis. While these dashboards view an array of priorities, you need first to identify what risks are important.

One way to drill down on a particular risk and determine its priority level is through risk mapping. Risk mapping is about plotting the dynamics of the risk incident landscape. A presentation model of risk dynamics or risk profiling may be found in the risk map on Figure 2. More consequential incidents are at the top of the map, and more frequent ones are to the right. In Figure 2, eight types of internal misconduct cases were plotted for the month, and the five highlighted all had inadequate supervision and poor policy awareness as contributing causes of the infractions.

There is a valuable story to be told to management, and it is particularly useful in quarterly or annual presentations to display notable trends, their contributing causes and suggestions for mitigation tactics. Measures mapping helps you do that by looking at areas of risk, the contributing causes to those risks and actions implemented to mitigate those risks, and then measuring the effectiveness of those actions.

It’s a CSO’s job to find the appropriate model for security measurement and reporting objectives that fits his organization.

http://www.csoonline.com/read/080106/fea_metrics.html

Read more

US consumers losing billions in cyber attacks

Posted on by admini

Overall, a quarter of those surveyed suffered from a computer virus infection last year, with incidents being very costly for users, who had to spend an average of $109 remedying problems.

Spyware, which is also a type of malware, also represented a major problem for American computer users, who had to shell out $2.6 billion to cover the costs of infecting their machines with it.

Although total losses standing at $630 million were considerably lower than from malware, phishing has become a major problem for online users.

http://www.viruslist.com/en/news?id=195063107

Read more