Who Says Software-Defined Security Is What We Want?

Forbes | Dec 21, 2017

By Dr. Mike Lloyd, RedSeal CTO

Gartner’s Hype Cycle is always a fun read. For the 2017 version, I’d like to draw your attention to the dot for Software-Defined Security — you can find it sliding down the precipitous slope from the Peak of Inflated Expectations to the Trough of Disillusionment.

It’s easy to trace the rise and fall. Back in 2014, there was no Software-Defined-Security marker, but Gartner’s annual chart of hype, hope and hallucination had an entry for Software-Defined Anything (way over on the far left), where dreams turn into … well, more dreams (at least for a while). The intervening years saw Software-Defined Security charge up that first hill of expectations, crest over and eventually slide down.

Network Segmentation, Security and RedSeal

Over the last few decades, many network security architecture products have come to market, all with useful features to help secure networks. If we assume that all of these security products are deployed in operational networks, why do we still see so many leaks and breaches?

Some say the users are not leveraging the full capabilities of these products – which is true.

Other say the users are not fully trained on how to use the product. Also true, and probably why they’re not using the full capabilities of their products.

Instead, we might benefit from remembering a basic truism: We humans are lazy.

Most of us, if offered a button that simply says “fix,” will convince ourselves that it will fix any network problem. We’ll buy that button every day of the week.

Our belief in fix buttons has led to a situation where many of us aren’t following standard security practices to secure our networks. When a network is designed or when you inherit a network, there are some basic things that should be done.

One of the first things to do is isolate, or segment, your network.  Back in the 1990s, network segmentation was done more for performance reasons than security. As we moved from hubs to large, switched networks, our networks have become flat, with less segmentation. Today, once attackers get in, they can run rampant through a whole enterprise.

If we take the time to say, “Let’s step back a second,” and group our systems based on access needed we can avoid much trouble. For instance, a web server most likely will need access to the internet and should be on a separate network segment, while a workstation should be in another segment, printers in another, IoT in one of its own, and so on.

This segmentation allows better control and visibility. If it’s thought out well enough, network segmentation can even reduce the number of network monitoring security products you need to deploy. You can consolidate them at network choke points that control the flow of data between segments versus having to deploy them across an entire flat architecture. This also will help you recognize what network traffic should and should not be flowing to certain segments based on that network segment’s purpose.

This all seems to make sense, so why isn’t it done?  In practice, network segmentation is usually implemented at the start. But, business happens, outages happen, administrators and network engineers are under enormous pressure to implement and fix things every day. All of this causes the network design to drift out of compliance. This drift can happen slowly or astonishingly fast. And, changes may not get documented. Personnel responsible for making the changes always intend to document things “tomorrow,” but tomorrow another event happens that takes priority over documentation.

Network segmentation only works if you can continuously ensure that it’s actually in place and working as intended. It is usually the security teams that have to verify it. But, as we all know, most security and networking teams do not always have the best partnerships. The network team is busy providing availability and rarely has the time to go back and ensure security is functioning.

Even if the security teams are checking segmentation in large enterprises, it is a herculean effort. As a result, validating network segmentation is done only yearly, at best. We can see how automating the inspection of the network security architecture is a clear benefit.

RedSeal enables an automated, comprehensive, continuous inspection of your network architecture. RedSeal understands and improves the resilience of every element, segment, and enclave of your network. RedSeal works with your existing security stack and network infrastructure (including cloud and SDN) to automatically and continuously visualize a logical model of your “as-built” network.

RedSeal’s network modeling and risk scoring platform enables enterprise networks to be resilient to cyber events and network interruptions in an increasingly digital and virtualized world, and to overcome one of the main enemies of cybersecurity – human nature.

Leading Federal Cybersecurity Experts Agree: Federal Agencies Need Integrated and Automated Approach

Recently RedSeal hosted its annual Federal Customer Forum. One of the panels featured a discussion with several luminaries in the federal government cybersecurity ecosystem. The topic: the importance of the integration and automation of cybersecurity operations.

Those present were:

  • Wayne Lloyd, RedSeal (Moderator)
  • Kevin Phan, Splunk
  • Tim Jones, ForeScout
  • Wade Woolwine, Rapid7
  • John America, Mystek Systems

The following questions and answers were lightly edited for better comprehension:

Why is integration and automation important in defending against cyberattacks?

Not enough time to manage cybersecurity. The mundane tasks use up all the people and there is stuff to do afterwards. Humans need to focus on high level actions. Let the tools talk together and that will increase speed to resolution and limit damage. Attacks are automated by hackers, so defense needs to be automated, too.

Are security vendors doing enough to integrate with each other to support their customers’ needs? If so what have you seen work well? If not, what should we as an industry be doing better?

No. No one vendor does it all, and often have trouble integrating with others, so customers need to do a better job integrating solutions from different vendors or hire a managed security services provider.

When it comes to securing IoT devices, where does responsibility lie? Is it with the manufacturer, the user, or both?

Most say that there should be shared responsibility. Devices should be patchable and upgradable. “Know your network” is hard with IoT. There are many, many more endpoints to worry about. Organizations need to develop safe processes for adding IoT to the networks, and segment them onto less secure networks. Organizations need to develop a patching strategy generally, but specifically for IoT devices.

There was a recent example where drones were purchased by the DOD. It turns out that the chips had been white-label manufactured by Huawei in China. These drones were exfiltrating data without user’s knowledge to parties unknown. This kind of supply chain issue is going to be a bigger problem going forward.

If you were to go into an organization that is standing up a new, from scratch, security stack, what capabilities would you recommend they choose?

Detection is important, but how do you trust the decisions that the software makes? You need to get to the raw, unfiltered data. Also, the key is to set up network segments to prevent intruders from roaming freely across your infrastructure. Third, you need to set up hunt teams to proactively search for those intruders. Fourth, setting up a continuous config management process that inventories unpatched software is mandatory now. Penetration testing is useful, but penetration testers usually quit after they find a way in. What about the other thousands of vulnerabilities that they didn’t find?

Good cybersecurity teams are always looking to tear down silos. Bad ones stick to themselves. Hackers are known for sharing code, tools and vulnerabilities, so it seems obvious that cybersecurity teams should do the same. NOCs and SOCs are starting to talk more, which is a good thing, however cloud and dev ops teams seem to be still off on their own. Executive priorities still drive decision making, and no one can prevent those decisions from creating security issues. Cyber teams need to be stewards of data. Implement CIS 20 and set up a risk management framework.  Use table top exercises to train and improve execution, rather than focus on checkboxes and processes.

It appears that you cannot truly protect yourself if you are not using integrated products. Does it make sense to keep buying solutions piecemeal or should security teams look for packages that already integrate?

Most systems integrators do a good job integrating various cybersecurity tools in government. The private sector is much less advanced in this area. Most commercial companies get technologies then push them to a managed services provider.

Do you see threat intelligence playing a big role with federal customers in protecting their networks?

It’s notable that the same old threats pop up all the time. What is unknown is the scary part of the day. For threat detection, we need a faster and faster process of identification, integration and remediation. Hackers share data. We need a better understanding of where the whole threat environment is coming from. That said, we need to protect high value assets (HVA) first. That means mapping out access from HVAs. The average detection time nowadays is 170 days, so you had better set up your organization for maximum resilience. Attacks are now coming from POS systems and, famously, a fish tank in a Las Vegas hotel.

Experts Weigh In On Information Security Predictions For 2018

Techaeris | Dec 14, 2017

The world of information security was certainly a whirlwind of activity in 2017. It seemed no one was immune to some sort of security breach or incident and it only got worse through the year. Some of the affected companies involved in incidents are still paying the price for those breaches.

With 2018 coming, the landscape for information security is wide open. We’re lucky enough to have a group of information security experts who are making some predictions for the industry in 2018.

Silicon Valley VC Plays His Final Encore as a Cybersecurity CEO

Silicon Valley Business Journal | Dec 14, 2017

After years as a successful venture capitalist in Silicon Valley, Ray Rothrock is spearheading the digital resilience movement as the chairman and CEO of cybersecurity firm RedSeal. An outspoken technological evangelist, Rothrock continues to be driven by his personal values, creativity and a desire to do good while also turning a profit.

RedSeal Awarded CIS Benchmark Certification

SUNNYVALE, Calif. – December 12, 2017 – RedSeal announced today that its market leading network modeling and risk scoring platform has been certified by CIS to compare the configuration status of network devices against the consensus-based best practice standards contained in the Cisco IOS 15 CIS Benchmark. Organizations that leverage RedSeal can now ensure that the configurations of their critical assets align with the associated CIS Benchmarks consensus-based practice standards.

“RedSeal customers using Cisco network devices can combat the evolving cybersecurity challenges they face by following CIS’s proven guidelines,” said Kurt Van Etten, vice president of product management at RedSeal. “Adhering to standards, industry best practices and organizational policies is critical as organizations strive to become digitally resilient. RedSeal customers can now compare the configurations of their Cisco network devices with the CIS Benchmarks and verify compliance.”

RedSeal’s network modeling and risk scoring platform builds an accurate, up-to-date model of an organization’s entire, as-built network to visualize access paths, prioritize what to fix, and target existing cybersecurity resources to protect their most valuable assets. With RedSeal’s Digital Resilience Score, decision makers can see the security status and benchmark progress toward digital resilience.

“Cybersecurity challenges are mounting daily, which makes the need for standard configurations imperative. By certifying its product with CIS, RedSeal has demonstrated its commitment to actively solve the foundational problem of ensuring standard configurations are used throughout a given enterprise,” said Curtis Dukes, Executive V.P. & G.M., CIS Security Best Practices & Automation.

In order for a product to receive the CIS Benchmark Certification, a CIS SecureSuite Product Vendor member must adapt its product to accurately check/score/report as compared to the security recommendations in the associated CIS Benchmarks profile. CIS Benchmark Certified Products demonstrate a strong commitment by the vendors to provide their customers with the ability to ensure their assets are secured according to consensus-based best practice standards.

The CIS Benchmarks program is recognized as a trusted, independent authority that facilitates the collaboration of public and private industry experts to achieve consensus on practical and actionable solutions. CIS Benchmarks are recommended as industry-accepted system hardening standards and are used by organizations in meeting compliance requirements for Federal Information Security Management Act, PCI, Health Insurance Portability Accountability Act and other security requirements.

About the CIS

CIS is a forward-thinking nonprofit entity that harnesses the power of a global IT community to safeguard private and public organizations against cyber threats. Our CIS Controls and CIS Benchmarks are the global standard and recognized best practices for securing IT systems and data against the most pervasive attacks. These proven guidelines are continually refined and verified by a volunteer global community of experienced IT professionals. CIS is home to the Multi-State Information Sharing & Analysis Center (MS-ISAC®), the go-to resource for cyber threat prevention, protection, response, and recovery for state, local, tribal, and territorial government entities.

About RedSeal

RedSeal’s network modeling and risk scoring platform is the foundation for enabling enterprise networks to be resilient to cyber events and network interruptions in an increasingly digital world. RedSeal helps customers understand their network from the inside, out – and provides rich context, situational awareness and a Digital Resilience Score to help enterprises measure and ultimately build greater resilience into their infrastructure. Government agencies and Global 2000 companies around the world rely on RedSeal to help them improve their overall security posture, accelerate incident response and increase the productivity of their security and network teams. Founded in 2004, RedSeal is headquartered in Sunnyvale, California and serves customers globally through a direct and channel partner network. Follow RedSeal on Twitter at @redseal_co and on LinkedIn.

Contact:
Dean Fisk, Finn Partners
+1 (707) 292-4201
dean.fisk@finnpartners.com

When IoT Devices Go Rogue, Automation Saves the Day

SIGNAL Magazine | Dec 1, 2017

By J. Wayne Lloyd, RedSeal Federal CTO

By 2025, an estimated 75 billion or more devices will be connected via the Internet. While the ability to access data on any device from any device multiplies productivity exponentially, it also creates unforeseeable vulnerabilities that organizations are only beginning to understand.

Last year’s Mirai botnet distributed denial-of-service attack, which infected millions of devices, demonstrates the multifaceted challenges federal agencies and private-sector companies face when securing their devices and networks. These challenges will only continue to grow both inside and outside of these domains.