Saturday, June 27, 2009
Big Changes Coming in the SANS Top 20
The risk focus was chosen for three reasons:
1. Vulnerability listings had outlived their usefulness because nearly all mature organizations automate vulnerability remediation and do not actively manage individual vulnerabilities.
Also so many critical new vulnerabilities were found every month that the list was becoming unwieldy. Risks on the other hand reflect the vulnerability, threat and the impact. We measure those by finding actual attack data.
2. The new, more complex attacks must be met with multi-layered defenses and can sometimes only be met with adequate detection of their presence after successful penetration. The risk focus enables mitigation discussions to be more complete and therefore more useful.
3. Federal agencies and large commercial organizations are now prioritizing their security programs based on the Top 20 Most Critical Security Controls (published by the Center for Strategic and International Studies). Those 20 controls reflect the known risk as of early summer 2009. The new risk report will be a reliable means of ensuring the 20 Critical Controls are regularly updated to reflect changes in the risk picture.
SANS is the most trusted & by far the largest source for information security training, certification & research in the world. We offer renowned Computer, Software & Network Security Training, Certification through our GIAC affiliate, Free Resources for Research & Global Incident Response, In-depth Training in Computer Security, Firewall Protection, Hacking, Intrusion Detection, CISSP CBK and more....
Wednesday, June 24, 2009
Your PC might be traded online - without you knowing it!
The following article was posted on the Dark Reading site and is based upon the most recent Finjan Cybercrime Intelligence Report
Issue no.2, 2009
Cybercrime Intelligence
Your PC might be traded online - without you
knowing it!
For more information about Finjan, please visit: www.finjan.com
This article can be viewed in its original form at the following link: http://www.darkreading.com/security/vulnerabilities/showArticle.jhtml?articleID=218000254
Finjan Releases "Cybercrime Intelligence Report"
Compromised PCs of individuals and corporations are turned into digital assets that cybercriminals potentially trade online, according to reportJun 17, 2009 | 06:43 PM
San Jose, CA, USA, June 17, 2009 " Finjan Inc., a leader in secure web gateway products and the provider of a unified web security solution for the enterprise market, today announced that its Malicious Code Research Center (MCRC) managed to research a trading network and botnet, where compromised PCs are bought and sold for profit. In the second issue of its "Cybercrime Intelligence Report" of 2009, Finjan shows the operations of the Golden Cash network consisting of an entire trading platform of malware-infested PCs. The trading platform utilizes all necessary components (buyer side, seller side, attack toolkit, and distribution via "partners"). This advanced trading platform marks a new milestone in the cybercrime evolution.
By turning compromised PCs from a one-time source of profit into a digital asset that can be bought and sold again and again, cybercriminals are maximizing their illegal gains. The cybercrime intelligence report covers the following:
"As reported by Finjan before, cybercriminals keep on looking for improved methods to generate profit. In addition to stealing data and selling them on, they now also trade compromised PCs to as many buyers, sellers and partners as possible. Looking at the list of compromised PCs we found, it is clear that no individual, corporate or governmental PC is safe," said Yuval Ben-Itzhak, CTO of Finjan.
In the report released today, Finjan also indicates how organizations can detect and deal with infections, and how they can prevent their corporate PCs from being compromised and turned into bots.
To download the report, please visit www.finjan.com/Cybercrime_Report
Technical analysis is provided on Finjan's MCRC blog post at www.finjan.com/MCRCblog About MCRC Finjan's MCRC specializes in the detection, analysis and research of web threats, including Crimeware, Web 2.0 attacks, Trojans and other forms of malware. Our goal is to be steps ahead of hackers and cybercriminals, who are attempting to exploit flaws in computer platforms and applications for their profit. In order to protect our customers from the next Crimeware wave and emerging malware and attack vectors, Finjan MCRC is a driving force behind the development of Finjan's next generation of security technologies used in our unified Secure Web Gateway solutions. For more information please also visit our info center and blog.
About Finjan Secure Gateway provides organizations with a unified web security solution combining productivity, liability and bandwidth control via URL categorization, content caching and applications control technologies.
Crimeware, malware and data leakage are proactively prevented via patented active real-time content inspection technologies and optional anti-virus modules. Powerful central management enables intuitive task-based policy management, excellent drill-down reporting capabilities and easy directory integration for all network implementation options. By integrating several security engines in a single dedicated appliance, Finjan's comprehensive and integrated web security solution enables quick deployment, simplified management and reduction of costs. Business benefits include real-time web security (no patches or updates needed), lower total cost of ownership (TCO), cost savings in administration efforts, lower maintenance costs, and reduction in loss of productivity. Finjan's security solutions have received industry awards and recognition from leading analyst houses and publications, including Gartner, IDC, Butler Group, SC Magazine, eWEEK, CRN, ITPro, PCPro, ITWeek, Network Computing, and Information Security. With Finjan's award-winning and widely used solutions, businesses can focus on implementing web strategies to realize their full organizational and commercial potential. For more information about Finjan, please visit: www.finjan.com.
Click here to view more details
Tuesday, June 16, 2009
Working With Security Service Providers: What Every Small Business Manager Should Know
Jun 12, 2009 | 11:04 AM
By Tim Wilson
DarkReading
So you work in a small to midsize business, and you've decided to outsource security to a third-party service provider. Congratulations!
Now what?
If your answer is, "I don't know," don't feel too badly -- you're not alone. In fact, experts say, most SMBs don't know much more about managing or negotiating with security service providers than they knew about security technology in the first place.
"Most SMBs don't know the difference between MSSPs [managed security service providers], SaaS [software as a service] providers, or cloud security providers," says Joel Smith, CTO at AppRiver, which provides a variety of security services for small businesses. "That's not their job. That's why they call us."
Khalid Kark, senior analyst for security at Forrester Research, agrees. "We're seeing increased activity among SMBs in the services space," he says. "The external threats are becoming more complex. They have limited resources, and their security skill level is not very high. They're looking for help."
So if they don't have the time or skills to do security themselves, how can SMBs build a relationship with a security service provider -- without getting rooked?
The first step is not to expect too much, experts say. "One of the first mistakes we see with people who are looking to outsource is that they want to dump the entire burden on someone else," says Kevin Prince, CTO at Perimeter eSecurity, a managed services rovider that offers a wide range of services for SMBs. "They think they're going to give the job to the provider, and they won't have to worry about it anymore. But that's not the right way to approach it."
Kark concurs. "A lot of SMBs have an expectation that they are not only outsourcing the responsibility for security, but also the accountability for security," he says. "That's wrong. Even if they've brought in a third party to manage security, they're still accountable if something goes wrong. You can't just hire somebody and forget about it."
The best relationships between SMBs and third parties develop when both parties view the relationship as a partnership, experts say. "If you know your environment well, and you know your business, then you can get the skills and services you need," Kark says. "If you aren't sure what you need, if you don't know what your priorities are, you're going to have problems with any provider."
Most SMBs start their security outsourcing relationships with just one or two services, observers say. "That's an effective strategy," Kark says. "You don't want to hand off everything right away. The [service provider] doesn't know your business. You don't know them. You want to hand off capabilities slowly, and see how they do."
Prince says that's how most SMBs get into security outsourcing in the first place. "Our average customer has five different services from us," he says. "But in most cases, they started out with one. They work with us, we learn about their business, and we tell them about the threats and the risks. They begin to see the value of some of the other services."
The key to building a strong relationship with a service provider, AppRiver's Smith says, is to continually test and give feedback to the provider as the relationship develops. "The first thing you want to do is befriend a sales rep and somebody on the support side," he says. "You want to be able to ask how you can do this or that, and get an educated response from someone who understands your business."
But while SMBs need a flexible relationship with their providers, they should also be careful to build some minimum expectations into the service contract, Kark warns. "If you don't set any expectations, then the outsourcer will probably do the bare minimum," he says. "Establish some service level agreements. Monitor them to be sure they're meeting their promises."
Another mistake...involving money.
It's also a mistake to enter into a security services relationship where cost is the primary driver, Kark says. "We see a lot of SMBs looking into outsourcing because they think it will save them money, but that's a myth," he says. "About 70 percent of the companies that outsource security end up spending as much or more on their outsourced services as they would have spent doing it themselves. It's true that they usually get more for their money -- in terms of skills and support -- but if you go into outsourcing with cost as your primary filter, you're not going to get the protection you need."
Support, not cost, is what separates one service provider from another, AppRiver's Smith says. "You need to understand their support philosophy even before you get into the contract," he advises. "Are they going to give you a trusted adviser who will work with your business to understand what you need and what your priorities are? If they give you a trusted adviser, will that person be responsive, or be overwhelmed with too many clients?"
Many SMBs end up purchasing their security services from a value-added reseller (VAR) that chooses its own provider and then delivers advice and support on top of the service, Smith observes. "The good VARs have looked at all the services out there and found the ones that really work," he says. "The shakeout in the services market is always faster in the SMB space because the VARs try them out and choose their favorites. VARs don't stick with bad providers the way big companies sometimes do."
But SMBs should be careful to vet potential VARs, just as they would vet potential service providers, experts say. "A lot of traditional VARs and hardware resellers have been moving into the managed security space because they like the recurring revenue," Prince notes. "Not all of them know security, and not all of them offer 24x7 support. All too often, they don't take the time to really get to know the client's business."
Prince says Perimeter doesn't extensively vet VARs before allowing them to resell its services, but it does require them to go through extensive training and certification to maintain their status as resellers. "We expect a lot of them," he says.
Whether they use VARs or work directly with the service providers, SMBs should set up methods to regularly test and monitor their security services to be sure they're getting what they're paying for, experts say. "A lot of SMBs want to turn on the service and then forget about it, but it doesn't work that way," Smith says. "We tell customers to go by the rule of ABT -- always be testing. You need to find out what the threats are, then find out whether your provider is handling them.
"If [the provider] giving you Web filtering, there are lists of bad URLs out on the Web that are updated all the time -- test out a few bad URLs and make sure your provider is blocking them," Smith adds. "If they're giving you spam filtering, go through your quarantines and see how they're doing on false positives or false negatives. You should test all the time, even after you get comfortable that the service is working."
Most SMBs find a security service provider they like and stick with it for the long term, experts say. "A good service provider relationship is an investment -- you get to know them, and they get to know you," Kark says. "You don't want to give up that investment and switch providers just because you're getting 95 percent spam filtering and some other provider gets 97 percent. But you should build your expectations about service levels into the contract -- if it's not written down, you can't be sure you'll get that level of service over the long term."