RiskPundit

The most overrated security technologies and what to do about them

CSOonline published an article entitled, "What Are the Most Overrated Security Technologies?" At the head of the list are, no surprise, Anti-Virus and Firewalls.

Anti-Virus - signature based anti-virus products simply cannot keep up with the speed and creativity of the attackers. What's needed is better behavior anomaly based approaches to complement traditional anti-virus products.

Firewalls - The article talks about the disappearing perimeter, but that is less than half the story. The bigger issue is that traditional firewalls, using stateful inspection technology introduced by Check Point over 15 years ago, simply cannot control the hundreds and hundreds of "Web 2.0" applications. I've written about or referenced "Next Generation Firewalls" here, here, here, here, and here.

IAM and multi-factor authentication - Perhaps IAM and multi-factor authentication belong on the list. But the rationale in the article was vague. The biggest issue I see with access management is deciding on groups and managing access rights. I've seen companies with over 2,000 groups - clearly an administrative and operational nightmare  I see access management merging with network security as network security products become more application, content, and user aware. Then you can start by watching what people actually do in practice rather than theorize about how groups should be organized.

NAC - The article talks about the high deployment and ongoing administrative and operational costs outweighing the benefits. Another important issue is that NAC does not address the current high risk threats. The theory in 2006, somewhat but not overly simplified, was that if we checked the end point device to make sure its anti-virus signatures and patches were up-to-date before letting it on the network, we would reduce worms from spreading.

At present in practice, (a) worms are not major security risk, (b) while patches are important, up-to-date anti-virus signatures does not significantly reduce risk, and (c) an end point can just as easily be compromised when it's already on the network.

A combination of (yes again) Next Generation Firewalls for large locations and data centers, and cloud-based Secure Web Gateways for remote offices and traveling laptop users will provide much more effective risk reduction.

Verizon Business extends its thought leadership in security incident metrics

The Verizon Business Security Incident Response team, whose yearly published Data Breach Investigations Reports I've written about here, has has extended its thought leadership in security incident metrics with the release of its Incident Sharing Framework. Their purpose is to enable those responsible for incident response to "create data sets that can be used and compared because of their commonality. Together, we can work to eliminate both equivocality (sic) and uncertainty, and help defend the organizations we serve." The document can be found here.

Of course Verizon Business is a for-profit organization and the license terms are as follows:

Verizon grants you a limited, revocable, personal and nontransferable license to use the Verizon Incident Sharing Framework for purposes of collecting, organizing and reporting security incident information for non-­‐commercial purposes.

Nevertheless, I do hope that this or an alternative incident sharing framework becomes an industry standard which enables the publishing and sharing of a larger number incidents from which we can all learn and improve our security policies and processes.

Schneier vs. Ranum: Should we (can we) ban anonymity?

The February 2010 issue of Information Security magazine has a face-off between Bruce Schneier, the realist, and Marcus Ranum, the dreamer, on the topic of anonymity on the Internet. 

Schneier says attempting to eliminate anonymity cannot work. More importantly, he goes on to say:

"Mandating universal identity and attribution is the wrong goal. Accept that there will always be anonymous speech on the Internet. Accept that you'll never truly know where a packet came from. Work on the problems you can solve: software that's secure in the face of whatever packet it receives, identification systems that are secure enough in the face of the risks. We can do far better at these things than we're doing, and they'll do more to improve security than trying to fix insoluble problems."

Schneier's piece is so good, you must read the whole thing.

Verizon Business 2009 DBIR Supplemental Report provides empirical guidance for unifying security and compliance priorities

The Verizon Business security forensics group's recently released 2009 Data Breach Investigations Supplemental Report provides common ground between those in the enterprise who are compliance oriented and those who are security oriented. While in theory, there should be no difference between these groups, in practice there is.   

Table 8 on page 28 evaluates the breach data set from the perspective of data types breached. Number one by far is Payment Card Data at 84%. Second is Personal Information at 31%. (Obviously each case in their data set can be categorized in multiple data breach categories.) These are exactly the types of breaches regulatory compliance standards like PCI and breach disclosure laws like Mass 201 CMR 17 are focused on.

Therefore there is high value in using the report's "threat action types" analysis to prioritize risk reduction as well as compliance programs, processes, and technologies.

While the original 2009 DBIR did provide similar information in Figure 29 on page 33, it's the Supplemental report which provides the threat action type analysis that can drive a common set of risk reduction and compliance priorities.

Breach detection methods reported by Verizon Business

Detailed empirical data on IT Security breaches is hard to come by despite laws like California SB1386. So there is much to be learned from Verizon Business’s April 2009 Data Breach Investigations Report.

The specific issue I would like to highlight now is the section on methods by which the investigated breaches were discovered (Discovery Methods, page 37). 83% were discovered by third parties or non-security employees going about their normal business. Only 6% were found by event monitoring or log analysis. Routine internal or external audit combined came in at a rousing 2%.

These numbers are truly shocking considering the amount of money that has been spent on Intrusion Detection systems, Log Management systems, and Security Information and Event Management systems. Actually, the Verizon team concludes that many breached organizations did not invest sufficiently in detection controls. Based on my experience, I agree.

Given a limited security budget there needs to be a balance between prevention, detection, and response. I don’t think anyone would argue against this in theory. But obviously, in practice, it’s not happening. Too often I have seen too much focus on prevention to the detriment of detection and response.

In addition, these numbers point to the difficulties in deploying viable detection controls, as there were a significant number of organizations that had purchased detection controls but had not put them into production. Again, I have seen this myself as most of the tools are too difficult to manage and it’s difficult to implement effective processes.

Theory vs. Practice

Here is a quotation regarding theory vs. practice that resonates repeatedly in my day-to-day activities. It sums up an important lesson I have learned over the years.

“In theory, there is no difference between theory and practice. But in practice, there is."

I’ve done some research on this and I am fairly convinced it should be attributed to Jan L. A. van de Snepscheut, although there are some who believe it was first said by Yogi Berra. Some links to lists of pithy quotes that include this one are here, here, here, and here. And a brief Wikipedia biography of Snepscheut is here.