Posts

US & UK Joint Wargames – let’s not wait for Pearl Harbor

The idea of the US and UK working together on war-games is a good one.  It recognizes that we are in a war, and that we are losing.  We need to improve our defensive game.  Chris Inglis, the former NSA director, has commented that the state of security today massively favors the attacker – he suggests that if we kept score, it would be 462-456, just 20 minutes into the game, because our defense is so poor.

The continuous stream of announcements of new breaches, along with the UK stats indicating the vast majority of large companies are suffering serious breaches, adds up to clear evidence of weak defense.  War games are a good way to get one step ahead, shifting to a proactive rather than purely reactive stance.  Nation states can do this with teams of people, but this is too labor intensive and expensive for most organizations.  This is why the security industry puts so much emphasis on automation – not just the automated discovery of weaknesses, but automating the critical process of prioritizing these vulnerabilities.  The inconvenient truth is that most organizations know about far too many security gaps to be able to fix them all.  War-gaming is a proven approach to dealing with this reality – find the gaps that are most likely to be used in a breach, and fix those first.  Perfect security is not possible, but realistic security comes from understanding your defensive readiness, stack-ranking your risks, and acting on the most critical ones.

Security’s Nightmare: Negative Unemployment

Unemployment is bad, so negative unemployment must be good, right?  Um, no.  (I’ll steal a line from Douglas Adams: “It’s unpleasantly like being drunk” … “What’s so unpleasant about being drunk?” … “Well, ask a glass of water.”)  Security as an industry is short-staffed – critically so, and it’s getting worse.

This came into sharp focus with the recent suit between MasterCard and Nike.  I’ve no comment on the specifics of the case, but the general lesson is clear: security geeks are in desperately short supply.  When I think of where this industry was just a few years ago, it would have been preposterous to imagine two household name, world class companies unleashing lawyers over such a fracas.

This is why security automation is such a big deal.  Security teams everywhere are drowning in unaddressed, basic problems.  We know plenty about what we need to do, but we just can’t get it all done – there aren’t enough fingers on the keyboards.  (Anyone remember “The 5,000 Fingers of Dr T”?)  We need machines to prioritize all the signal overload; there’s no other way to make headway.

Is Nothing Sacred Anymore?

It’s unthinkable: hackers targeting that sacrosanct American institution, the sports team? The recent incident in which the Houston Astros’ internal trade discussion were hacked and posted on the Internet shows that, today, no target is off limits.  Jeff Luhnow, GM for the Astros, was quite right when he said: batter_swinging_baseball_bat_at_a_pitched_ball_0515-1104-1601-5532_tn“It’s a reflection of the age we living in. People are always trying to steal information” The main problem that encourages this kind of illegal activity is that it’s really relatively easy.  Nobody thinks the hacker who stole the information from the Astros was heavily funded by a foreign government, or anything like that.  Indeed, it’s quite possible the person or people involved had no more motivation than curiosity, and found it easy to get in. The challenge, of course, is that every business has secrets – how it approaches negotiation, or the pricelist for its upcoming products, or its next quarter of advertising plans.  All that information is useful to others if it’s exposed.  Many businesses like the Astros have treated IT security as a “high end” problem – something for banks, the military, or energy companies to worry about.  But it’s just not possible to operate that way anymore – the risk of corporate embarrassment, or worse, is escalating.  Attackers are finding our complex defenses are badly deployed, badly coordinated, and easy to walk through.  All the attacker needs is persistence, and the search for a forgotten, unlocked “side door” onto the business can be largely automated.  Defenders need to understand all the gaps, and how all the security defenses work together, even if their only target is “good enough” security.  As the Astros have found, the standards of “good enough” are rising rapidly.

Project Zero – A Smarter Way Forward

Google’s move to set up Project Zero is very welcome.  The infrastructure on which we run our businesses and our lives is showing its fragile nature as each new, successful attack is disclosed.  green-arrowUnfortunately, we all share significant risks, not least because IT tends towards “monoculture”, with only a few major pieces of hardware and software being used most of the time.  Organizations use the common equipment because it’s cheaper, because it’s better understood by staff, and because we all tend to do what we see our neighbors doing.  These upsides come at a cost, though – it means attackers can find a single defect, and it can open thousands or even millions of doors, as we recently saw with Heartbleed.  This situation isn’t likely to change soon, so it’s welcome news whenever there are more eyes on the problem, trying to find and disclose defects before attackers do.

Attacks proliferate rapidly – very rapidly, in a quite robust market for newly found, highly effective vulnerabilities.  As they do so, it has become crystal clear that traditional passive, reactive methods of defense are insufficient. Google’s investment underscores the critical importance of proactive analysis of potential attack vectors. Any organization that is not developing a set of defenses from proactive analysis through reactive defenses is leaving the door open to attacks. Defenders need ways to automate – to pick up all the discoveries as they are found by the “good guys”, so they can assess their own risk and keep up with remediation. Recent incidents like Code Spaces and Target make clear that the health of enterprises and the careers of their executives are at stake; just expecting defenses to hold without some way to automate validation is not tenable.  Hope is not a strategy.

Driving Blindfolded

I recently wrote about the necessity of getting the right data for security analytics.  But I’m continuously reminded how typical organizations lack an even roughly complete understanding of their network, or even a map of it.  I can understand why this happens – entropy is just as inevitable for organizations as it is in Physics.  Records don’t just keep themselves – networks change, and ideally it’s all planned and well controlled, but in practice, emergencies happen, corners get rounded off, triage goes on, and perfect record keeping is lost.  I know organizations who aim to have very strong processes, control, and accountability, and while I commend them for it, I find that if I look at their data, I still find enough gaps and unknowns to be a worry.  Sure, the mature organizations do better – they don’t tend to have records in the moral equivalent of a shoe-box under the bed (but I see enough of those). But the records still don’t add up.

driving_blindfoldedI think what worries me more are the organizations who know they have information gaps, but don’t treat them as a priority.  I see this as driving a car while blindfolded.  How is security possibly going to be effective if you can’t map out the infrastructure – the whole infrastructure, warts, labs, virtualization and all – and just look at it, let alone ask decent, proactive questions about how to defend yourself?  Imagine physical security – for example, badge reader installation – without having a map of the building, or even a vague idea of the number of doors that need to be secured.

Of course, I’m preaching to the choir – anyone reading this blog probably already understands that this is important.  I sometimes wonder if the real challenges are political, not technical or intellectual.  When a security team can’t get the blueprints to the network, what exactly is going on?  Is it overload?  Is it lack of people to go hunt down what’s missing?  Or is it the classic challenge of “nagging for a living”?  Many security teams I meet don’t have direct access to the network assets that are critical to defensive posture.  This means they have to ask, or beg, or cajole the NetOps team into providing data.  The strength of that team-to-team relationship seems to be a really important issue.  I’ve seen organizations vary hugely in speed and success with data analytics, depending on whether someone in Team Security has a buddy in Team Networking or not.  Perhaps the worst cases I’ve seen involve outsourced IT and networking – then it can get to levels nothing short of passive-aggressive.

Got war stories?  Advice?  Rotten fruit?  Comments welcome …

Data, Data Everywhere, nor Any Time to Think

I remember when I first started trying to solve network security problems, using fancy network analytics.  I applied the classic suspension of disbelief that’s necessary to work on any emerging technology – first, you assume all the hard problems will be easy, and second, you assume the impossible ones will just go away.  Happily, much of this is true – it’s funny how well it works.  Only later do you learn which problems are the truly hard ones.

What’s hard about network security analytics?  Well, not the security, and not the analytics – we’ve found we can do plenty on both of those that pays off really well, given the data.  The pesky data, now that’s a different kettle of enchiladas.

data-everywhereAt first, I didn’t want to talk about data gaps – that sounded like a challenge to good analytics.  I was half right.  Eventually, enough CISO’s got it through my skull that uncovering data gaps may be pointing to reasons why analytics will be held back, but it’s also major value, in and of itself.  I was being dense – if we try to analyze security data, and we find it’s got holes in it, well, this means the security team didn’t know what was going on to start with!  Turning up these gaps is one of those inconvenient truths.  These days we’ve gotten pretty good at it.

But then what?  Typical security organizations are drowning in data, so how can I complain about needing more?  Well, facts are just facts; useful information, or better yet, actionable intelligence is something else altogether.  We stockpile data from sensors, but we struggle to find useful signal in there.  We deploy automated signal reduction engines, but they just turn mountains of alerts into hills of alerts, and we still don’t have time or people enough to climb those.  And along come these network security analytics people saying “what you need is more data”.  Hmmm.

Of course, what we need is the RIGHT data, processed the right way, at the right time.

Negative Unemployment

I recently attended a gathering of Wall St CISOs, one of whom referred to the “negative unemployment” in our industry.  I thought this was a great phrase, and I’ve found it’s a quick way to get across some quite deep points about current security.

At first, it just sounds cute, but in practice, it’s about as cute as the Oil Crisis.  Bad guys have figured out how to make money by attacking our weak defenses.  We’re scrambling to catch up.  The C-Suite and the board are more accommodating than they have ever been – something to do with the recent dismissal of the Target CEO, I shouldn’t wonder.  We know we need people, so we go to hire them, and what do we find?  Bad resumes.

knowledgegapHave you found it easy to hire the talent you need?  If so, lucky you – feel free to drop hints in the comments section (or just gloat – your peers tell me they aren’t having it so easy).

It makes for an ugly choice.  Do we hold standards high, waiting for people with the right skills to come along?  Or do we hope to train people new to the field?  As I look around, I can see our discipline soaking up some people of – how should I put it? – marginal aptitude.  I’ve seen this before – I remember the go-go days of the late 90’s, when Silicon Valley start-ups sucked in all kinds of people with no business working in such environments.  When that went all pear-shaped, it wasn’t so bad – sure, some stock options suddenly lost a zero or two in value, but it’s not really fair to whine about that.  Watching the same thing happen in corporate IT security is a much scarier proposition.