CNET | Aug 28, 2014
Investigation into attack on JPMorgan Chase may have expanded to seven of the world’s top banks, amid a report that hackers altered records.
“Getting access to bank records is uncommon but not unheard for hackers, who often change computer logs to cover their tracks but can’t always get to more sensitive data,” said RedSeal cybersecurity expert Robert Capps.
The phase between design and implementation for JRSS and JIE is critical. During this phase the most important thing is to have full visibility of the entire JIE infrastructure, even before it is migrated. RedSeal provides the bridge mechanism needed during this critical assessment phase.
Visualization can lead to deeper understanding of the current behavior of segmentation and the effectiveness of controlling access to these segments or enclaves, which in turn helps in reducing redundancy and increasing efficacy.
Visualization, identification and measurement allows you to identify and measure all the avenues of access, understanding them visually and through technical reports. RedSeal provides identification and measurement that are not restricted to live networks or devices. The model can be created using proposed configurations or design considerations and present what the network and controls will look like before deployment or in between deployment and cut over. This distinct capability will provide the bridge mechanism needed during critical assessment phases between design and implementation for JRSS and JIE.
Another benefit of the RedSeal network model is faster artifact development, as we will discuss in the next post.
| Aug 22, 2014
Just as news of one large point of sale (SuperValu) hack begins to recede, another pops up to reclaim the headlines. This time the victim is shipping giant United Parcel Service (UPS), which has confirmed a long-running data breach at 51 of its UPS Stores, across 24 states.
“This shows that sophistication of IT isn’t an inoculation against a breach,” said Steve Hultquist, chief evangelist at RedSeal Networks. “The combination of complexity and continuous change–including both growth and technological advancement–mean that it’s virtually impossible to be aware of all the potential paths of attack.”
On Wednesday, August 20th, UPS announced that a breach may have compromised customer data during up to 105,000 transactions between January and August. While UPS is to be commended for coming forward so quickly, this breach underscores the truth that organizations with highly sophisticated and advanced capabilities in information technology aren’t inoculated against breaches. It is easy to think that organizations that are breached must not be focused on their technology or current in their capabilities. This breach shows us how very wrong that thinking is. In fact, just last month, Fortune wrote an article about how challenging UPS’s analysis must be, and how they solve it with technology.
Ultimately, this is a lesson to every organization that the combination of complexity and continuous change–including planned and organic growth of technology deployed and the inexorable advancement of technology–mean that it’s virtually impossible to even be aware of all the potential paths of attack, much less be able to protect against them. Gone are the days of having sufficient understanding of the network in the heads of one or two people, allowing fast and accurate analysis and countermeasures.
Unfortunately, today no human being can possibly know what the network is capable of allowing to happen.
It is critical for all enterprises to deploy not only reactive security analysis such as IDS/IPS, but also to use a cyberattack prevention system to analyze their entire network as it is actually implemented, to expose all potential paths and to provide guidance in plugging inappropriate holes. Otherwise, we will continue to see more and more breaches, with broader and more devastating impact. Enterprises must take action by using cyberattack prevention to avoid being the next casualties.
eSecurity Planet | Aug 20, 2014
A major contributing factor in many recent data breaches has been the fact that many IT security teams are simply overwhelmed by the volume of data they’re handling.
Mike Lloyd, CTO of RedSeal Networks, said that kind of data provides IT security teams with a serious challenge. “I don’t meet any security teams these days that say, ‘You know, what I lack is data,'” he said. “In fact, we’re drowning in data. The problem is turning that data into facts you can use.”
Defense in depth is a term and idea that is not new to the information technology world. A classic implementation at the network level of defense in depth is segmentation, or building enclaves. In certain cases, segmentation was taken to an extreme level, resulting in massive decentralization of computing environments. Unfortunately this decentralization does not remove the need for these segments or enclaves to communicate with other information assets. Thus the segments or enclaves are connected to the network from which they may have originally been divested. This does not mean that security controls restricting or monitoring access to these enclaves was removed. What it does mean is that there is a very high likelihood of major redundancy implemented while attempting to secure or control these segments.
The RedSeal model can be leveraged to not only identify these redundancies visually, but to also identify the efficacy of these controls by measuring access across and through the entire network. Investigating one segment of the network and the control mechanisms related to the segment is not sufficient. The network must be measured as a whole operating entity or system to effectively identify all possible access and points of control. Through these means, RedSeal will be providing another unique benefit to JRSS and enhancing the preparedness for JIE.
Understanding the current behavior of segmentation and the effectiveness of controlling access to these segments or enclaves will assist with reducing redundancy in the current operational system while increasing efficacy. There may be too many rules in a firewall creating overly-restrictive access and operational bog to the system. There may be too many routers providing similar or identical access to systems, between systems, or across network boundaries. Perhaps there are too many layers of load balancing performing additional address translations and VIP presentations that are not only difficult to manage but not really providing any more security. RedSeal will identify and measure all the avenues of access and represent it visually and via a myriad of reporting techniques in technical depth.
Our next blog will discuss Step 3 – Visualization before Migration.
New York Times | Aug 15, 2014
“This looks much the same as the attack that impacted Target last year,” said Steve Hultquist, an executive at RedSeal Networks, a security firm. “These breaches continue to demonstrate the sophistication of the attackers and the reward they receive being worth the investment they make in their attacks.”
InfoSecurity Magazine | Aug 14, 2014
Tennessee Electric Company (TEC Industrial) is suing its bank, TriSummit, after falling victim to a $327,000 cyber-heist. The attackers likely used password-stealing malware, and then logged in to the bank using TEC credentials to siphon the funds.
“This action underscores the increasing focus on responsibility for maintaining end-to-end security for customers,” said Steve Hultquist, chief evangelist at RedSeal Networks, in a comment to Infosecurity.
The first and arguably most critical step in any data center consolidation or migration is to first understand what you have. Most complex or large-scale networks have grown so rapidly over the years or decades that there is no clear picture of the functioning system. As the opportunity to refresh large-scale global infrastructure becomes available today, experts are building security in on the front end. The challenge is understanding what exists today, how it is (or isn’t) being secured, and then designing the security requirements in tandem with the new system/network. RedSeal Networks provides a unique perspective on what is happening today on the network, how the network is actually connected, and the efficacy of security controls deployed in the network.
RedSeal Networks can provide this unique perspective by aggregating the configurations of core components that comprise the network, more specifically routers, firewalls, load balancers and switches. The RedSeal platform then analyzes these configurations and creates a model of the network. This is a visual representation of the network itself, but it is also a full model of all possible access based on the devices and the configurations of those devices. This model is a critical first step in understanding the DoD infrastructure today and will be the foundation upon which RedSeal will continue to provide unique data for the success of JRSS and JIE.
The model of networked infrastructure that RedSeal is providing to the JRSS project will not only help understand access at a high level. This model allows the capability to drill down into specific access areas, enclaves, single path analysis, and even model access that doesn’t yet exist. It is this flexibility that will allow architects and design experts to understand, from a high level down to fine detail, what is working today and what is not, so the new infrastructure can be designed effectively and efficiently.
Our next blog post will address Step 2 – Defense in Depth.
The United States Department of Defense Joint Information Environment (JIE) began to take shape in 2010, as part of efficiency initiatives to consolidate Defense IT infrastructure and generate savings, provide full situational awareness across all defense networks, and improve the Department’s ability to share information between the services and with its industry partners and other government agencies. While full capabilities are not expected to be realized until the 2016-2020 timeframe, DoD is already hard at work with industry to procure and configure IT in a more secure fashion and the first demonstration of JIE will take place in Europe this year, hosted by the U.S. European Command. Many organizations are asking themselves if they are JIE-ready, yet what exactly does this mean?
RedSeal Networks is playing a key part in the security component of the JIE program. Part of the JIE program is to migrate to a Single Security Architecture (SSA). The deployment of this SSA will be realized through what is commonly referred to as Joint Regional Security Stacks (JRSS). Within these stacks are integrated technology components that will provide comprehensive security to the JIE environment. The development and deployment of JRSS along with the overall JIE program will take a significant effort of consolidation and migration to realize the financial and organizational benefits. RedSeal’s role in this effort is recognized through four key use cases of the RedSeal Networks platform.
The four key areas where the RedSeal platform will have impact with respect to JIE are aligned with the phases of JRSS development and can be seen as:
Our next blog post will discuss how to model and visualize legacy environments.