The SANS Top 20 will shift from vulnerabilities to risks by the end of the summer of 2009. That means we will be relying more on actual attack information and reporting the changing patterns in the attacks that organizations are actually experiencing. www.sans.org
The risk focus was chosen for three reasons:
1. Vulnerability listings had outlived their usefulness because nearly all mature organizations automate vulnerability remediation and do not actively manage individual vulnerabilities. Also so many critical new vulnerabilities were found every month that the list was becoming unwieldy. Risks on the other hand reflect the vulnerability, threat and the impact. We measure those by finding actual attack data. 2. The new, more complex attacks must be met with multi-layered defenses and can sometimes only be met with adequate detection of their presence after successful penetration. The risk focus enables mitigation discussions to be more complete and therefore more useful. 3. Federal agencies and large commercial organizations are now prioritizing their security programs based on the Top 20 Most Critical Security Controls (published by the Center for Strategic and International Studies). Those 20 controls reflect the known risk as of early summer 2009. The new risk report will be a reliable means of ensuring the 20 Critical Controls are regularly updated to reflect changes in the risk picture.
Individual, corporate and governmental PCs at risk
Finjan Releases "Cybercrime Intelligence Report"
Compromised PCs of individuals and corporations are turned into digital assets that cybercriminals potentially trade online, according to report
Jun 17, 2009 | 06:43 PM
San Jose, CA, USA, June 17, 2009 " Finjan Inc., a leader in secure web gateway products and the provider of a unified web security solution for the enterprise market, today announced that its Malicious Code Research Center (MCRC) managed to research a trading network and botnet, where compromised PCs are bought and sold for profit. In the second issue of its "Cybercrime Intelligence Report" of 2009, Finjan shows the operations of the Golden Cash network consisting of an entire trading platform of malware-infested PCs. The trading platform utilizes all necessary components (buyer side, seller side, attack toolkit, and distribution via "partners"). This advanced trading platform marks a new milestone in the cybercrime evolution.
By turning compromised PCs from a one-time source of profit into a digital asset that can be bought and sold again and again, cybercriminals are maximizing their illegal gains. The cybercrime intelligence report covers the following:
On the buyer side of the trading platform, batches of 1,000 malware-infected PCs can be purchased for $5 up to $100; depending on territory
Partners are paid for successfully distributing the bot and collecting FTP-credentials of legitimated websites through the infected PCs
On the seller side of the trading platform, cybercriminals sell batches of 1,000 malware-infected PCs for $25 up to $500
Compromised malware infected PCs may be infected with additional malware each time they are purchased by a new "owner"
For attacks and exploitations, an exploit toolkit with obfuscated code and the Trojan Zalupko attack toolkit are provided
"As reported by Finjan before, cybercriminals keep on looking for improved methods to generate profit. In addition to stealing data and selling them on, they now also trade compromised PCs to as many buyers, sellers and partners as possible. Looking at the list of compromised PCs we found, it is clear that no individual, corporate or governmental PC is safe," said Yuval Ben-Itzhak, CTO of Finjan.
In the report released today, Finjan also indicates how organizations can detect and deal with infections, and how they can prevent their corporate PCs from being compromised and turned into bots.
Technical analysis is provided on Finjan's MCRC blog post at www.finjan.com/MCRCblog About MCRC Finjan's MCRC specializes in the detection, analysis and research of web threats, including Crimeware, Web 2.0 attacks, Trojans and other forms of malware. Our goal is to be steps ahead of hackers and cybercriminals, who are attempting to exploit flaws in computer platforms and applications for their profit. In order to protect our customers from the next Crimeware wave and emerging malware and attack vectors, Finjan MCRC is a driving force behind the development of Finjan's next generation of security technologies used in our unified Secure Web Gateway solutions. For more information please also visit our info center and blog.
About Finjan Secure Gateway provides organizations with a unified web security solution combining productivity, liability and bandwidth control via URL categorization, content caching and applications control technologies.
Crimeware, malware and data leakage are proactively prevented via patented active real-time content inspection technologies and optional anti-virus modules. Powerful central management enables intuitive task-based policy management, excellent drill-down reporting capabilities and easy directory integration for all network implementation options. By integrating several security engines in a single dedicated appliance, Finjan's comprehensive and integrated web security solution enables quick deployment, simplified management and reduction of costs. Business benefits include real-time web security (no patches or updates needed), lower total cost of ownership (TCO), cost savings in administration efforts, lower maintenance costs, and reduction in loss of productivity. Finjan's security solutions have received industry awards and recognition from leading analyst houses and publications, including Gartner, IDC, Butler Group, SC Magazine, eWEEK, CRN, ITPro, PCPro, ITWeek, Network Computing, and Information Security. With Finjan's award-winning and widely used solutions, businesses can focus on implementing web strategies to realize their full organizational and commercial potential. For more information about Finjan, please visit: www.finjan.com.
Choosing the right provider is only the beginning, experts say. The real key is building a relationship
Jun 12, 2009 | 11:04 AM By Tim Wilson DarkReading
So you work in a small to midsize business, and you've decided to outsource security to a third-party service provider. Congratulations!
Now what?
If your answer is, "I don't know," don't feel too badly -- you're not alone. In fact, experts say, most SMBs don't know much more about managing or negotiating with security service providers than they knew about security technology in the first place.
"Most SMBs don't know the difference between MSSPs [managed security service providers], SaaS [software as a service] providers, or cloud security providers," says Joel Smith, CTO at AppRiver, which provides a variety of security services for small businesses. "That's not their job. That's why they call us."
Khalid Kark, senior analyst for security at Forrester Research, agrees. "We're seeing increased activity among SMBs in the services space," he says. "The external threats are becoming more complex. They have limited resources, and their security skill level is not very high. They're looking for help."
So if they don't have the time or skills to do security themselves, how can SMBs build a relationship with a security service provider -- without getting rooked?
The first step is not to expect too much, experts say. "One of the first mistakes we see with people who are looking to outsource is that they want to dump the entire burden on someone else," says Kevin Prince, CTO at Perimeter eSecurity, a managed services rovider that offers a wide range of services for SMBs. "They think they're going to give the job to the provider, and they won't have to worry about it anymore. But that's not the right way to approach it."
Kark concurs. "A lot of SMBs have an expectation that they are not only outsourcing the responsibility for security, but also the accountability for security," he says. "That's wrong. Even if they've brought in a third party to manage security, they're still accountable if something goes wrong. You can't just hire somebody and forget about it."
The best relationships between SMBs and third parties develop when both parties view the relationship as a partnership, experts say. "If you know your environment well, and you know your business, then you can get the skills and services you need," Kark says. "If you aren't sure what you need, if you don't know what your priorities are, you're going to have problems with any provider."
Most SMBs start their security outsourcing relationships with just one or two services, observers say. "That's an effective strategy," Kark says. "You don't want to hand off everything right away. The [service provider] doesn't know your business. You don't know them. You want to hand off capabilities slowly, and see how they do."
Prince says that's how most SMBs get into security outsourcing in the first place. "Our average customer has five different services from us," he says. "But in most cases, they started out with one. They work with us, we learn about their business, and we tell them about the threats and the risks. They begin to see the value of some of the other services."
The key to building a strong relationship with a service provider, AppRiver's Smith says, is to continually test and give feedback to the provider as the relationship develops. "The first thing you want to do is befriend a sales rep and somebody on the support side," he says. "You want to be able to ask how you can do this or that, and get an educated response from someone who understands your business."
But while SMBs need a flexible relationship with their providers, they should also be careful to build some minimum expectations into the service contract, Kark warns. "If you don't set any expectations, then the outsourcer will probably do the bare minimum," he says. "Establish some service level agreements. Monitor them to be sure they're meeting their promises."
Another mistake...involving money.
It's also a mistake to enter into a security services relationship where cost is the primary driver, Kark says. "We see a lot of SMBs looking into outsourcing because they think it will save them money, but that's a myth," he says. "About 70 percent of the companies that outsource security end up spending as much or more on their outsourced services as they would have spent doing it themselves. It's true that they usually get more for their money -- in terms of skills and support -- but if you go into outsourcing with cost as your primary filter, you're not going to get the protection you need."
Support, not cost, is what separates one service provider from another, AppRiver's Smith says. "You need to understand their support philosophy even before you get into the contract," he advises. "Are they going to give you a trusted adviser who will work with your business to understand what you need and what your priorities are? If they give you a trusted adviser, will that person be responsive, or be overwhelmed with too many clients?"
Many SMBs end up purchasing their security services from a value-added reseller (VAR) that chooses its own provider and then delivers advice and support on top of the service, Smith observes. "The good VARs have looked at all the services out there and found the ones that really work," he says. "The shakeout in the services market is always faster in the SMB space because the VARs try them out and choose their favorites. VARs don't stick with bad providers the way big companies sometimes do."
But SMBs should be careful to vet potential VARs, just as they would vet potential service providers, experts say. "A lot of traditional VARs and hardware resellers have been moving into the managed security space because they like the recurring revenue," Prince notes. "Not all of them know security, and not all of them offer 24x7 support. All too often, they don't take the time to really get to know the client's business."
Prince says Perimeter doesn't extensively vet VARs before allowing them to resell its services, but it does require them to go through extensive training and certification to maintain their status as resellers. "We expect a lot of them," he says.
Whether they use VARs or work directly with the service providers, SMBs should set up methods to regularly test and monitor their security services to be sure they're getting what they're paying for, experts say. "A lot of SMBs want to turn on the service and then forget about it, but it doesn't work that way," Smith says. "We tell customers to go by the rule of ABT -- always be testing. You need to find out what the threats are, then find out whether your provider is handling them.
"If [the provider] giving you Web filtering, there are lists of bad URLs out on the Web that are updated all the time -- test out a few bad URLs and make sure your provider is blocking them," Smith adds. "If they're giving you spam filtering, go through your quarantines and see how they're doing on false positives or false negatives. You should test all the time, even after you get comfortable that the service is working."
Most SMBs find a security service provider they like and stick with it for the long term, experts say. "A good service provider relationship is an investment -- you get to know them, and they get to know you," Kark says. "You don't want to give up that investment and switch providers just because you're getting 95 percent spam filtering and some other provider gets 97 percent. But you should build your expectations about service levels into the contract -- if it's not written down, you can't be sure you'll get that level of service over the long term."
Shortly before the Russian military drove tanks into the restive region of South Ossetia last year, a cyber-attack hit neighboring Georgia, knocking government and news organization websites offline for days. In January, a similar digital assault paralyzed Kyrgyzstan’s main Internet service providers.
Cyber-attacks have become more prevalent around the world and defending against them has become harder and harder, experts say. The U.S. government’s computers, too, have become a target. They have attracted tens of thousands of onslaughts in recent years. U.S. Central Command networks in November were hit by an electronic attack thought to have Russian origins.
In an effort to beef up the country’s defenses in cyberspace, the Comprehensive National Cybersecurity Initiative, established last year by the Bush administration, seeks to reduce network vulnerabilities, protect against intrusions and anticipate future threats.
As part of the initiative, the Defense Advanced Research Projects Agency has awarded $30 million in contracts to spur the development of a facility where researchers and scientists can test their latest cybersecurity technologies.
Ultimately, the “national cyberrange” will be a hybrid of a Consumer Reports-type testing laboratory and the Army’s National Training Center, says program manager Michael VanPutte.
“We want the national cyberrange to do for cyber what the National Training Center did for the Army and the Department of Defense in joint war fighting,” the retired Army colonel says.
A researcher, for example, might have a new network protocol that he wants to try out. Network protocols are the rules that a network uses in order to communicate. The scientist could install the protocol on the national cyberrange and run it through realistic threat scenarios to assess the network’s security.
There are a number of existing test beds that provide some of the capabilities that DARPA is asking for, but none has the scale of automation or sophistication that scientists need, VanPutte says.
“To really understand the attacker, we need an environment where we can set up a large-scale defense, let the attackers go, watch it and measure, and then make changes in the environment and see if that helps or hinders security,” says VanPutte. “The cyberrange will give us that laboratory to see how we can improve security.”
Setting up a sterile environment to test cybertechnologies presently is a laborious, time-intensive process, he points out. Just as the average consumer would go about setting up a new computer from scratch — installing an operating system, hardware and software and then configuring it — scientists must do the same for their devices, but on a greater scale of hundreds of computers.
“When you get above 300 machines, it gets really hard and really time-consuming,” says VanPutte. “I’m trying to flip that paradigm.”
The cyberrange will simplify that process with graphic user interfaces and other systems that automatically configure an entire network so that scientists can concentrate on conducting their research, he explains.
Simulated users and realistic adversaries would then test the technologies against a full spectrum of threats to give a comprehensive, unbiased assessment of security, he says.
The facility is intended for use by organizations and research institutions nationwide. Scientists from academia, industry and various government and law enforcement agencies could all run trials simultaneously at a variety of classification levels.
For the military, the range will offer opportunities to test the Defense Department’s vision for future network-centric operations in a virtual reality network, VanPutte points out.
While the primary purpose of the facility is to help develop cutting edge technologies for countering cyber-attacks, its secondary goal is to foster innovation on cybertesting, itself. Many of the challenges there — slowing down and speeding up test times and replicating human behavior — are problems that the modeling and simulation community faces. “Those are all really, really hard problems that there aren’t solutions to today,” says VanPutte. “The purpose of the NCR is to build out that research and field the results back out to the testing community, to really increase the capability of all U.S. test beds, not just the national cyberrange.”
DARPA has awarded contracts to seven teams that will provide detailed engineering plans, concepts of operation and visions of how the national cyberrange will run. Proposals for building the prototype are due July 13. Officials will select one or more of the plans for a phase II contract. Depending on the outcome of prototype testing, the final contract will be awarded to build the range.
U.S. Cyber Czar On The Horizon; New Legislation, Too?
Posted by John Sawyer, May 27, 2009 02:55 PM
The buzz surrounding President Obama's efforts at securing our cyber-infrastructure is audible. The release of a 60-day review of the government's cybersecurity efforts, which started back in February, is expected soon, along with the naming of a new White House official -- a "cyber czar," as some are calling the position -- who will reportedly have purview over developing a strategy for securing both government and private networks.
While we're all waiting, I'm left wondering how far government will go to help protect not only itself, but private industry. And will it be enough? I've personally seen positive changes come about as a result of HIPAA, but it has been far from a silver bullet. The lack of understanding about responsibilities regarding IT (like secure wireless networking) I've seen at smaller doctors' offices is frightening.
I should narrow my "Is it enough?" question to be a little more specific: How committed is the government to protecting not only its own networks, but those of private companies (and individuals), and to getting the word out to small businesses about what they are supposed to be doing? Who will be responsible for making sure companies, and possibly individuals, comply with any legislation brought forth as result of the report and cyber czar?
We've seen other governments try to protect its citizens and companies from security issues posed by such threats as unsecured wireless networks and inappropriate Web content. For example, at the beginning of this year, several articles covered the efforts by India's police in Mubai who were searching for and eliminating open wireless networks. The campaign was a result of terrorists using unsecured wireless networks for their communications and eavesdropping on others communications.
In addition, right now Australia is working with ISPs to test content filtering options to protect its citizens against offensive content, such as child pornography. While the country's intentions are good, it's unlikely its efforts will be effective on a wide scale considering how easy it is to bypass content filtering systems. Even it direct attempts at evasion were not much of a concern, the issue of keeping up with all of the "bad" content out there is likely to be quickly overwhelming.
I'm willing to keep my fingers crossed that the Obama administration can pull this off, even it only partially successful, but I'm not blindly hopeful. In the past (and currently), legislation aimed at IT security has been a cause for companies to cover up breaches to avoid paying costly notifications and possible fines. At this point, I'm resigned to sitting back and watching what happens. At the very least, I'm sure the report will be an interesting read.
John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.
Obama: From Now On Digital Infrastructure Treated As Strategic National Asset
In a speech today from the White House, President Obama declared that the United States' computers and digital networks are strategic national assets and that he will personally appoint a cybersecurity coordinator to oversee the effort to protect this critical infrastructure. Excerpt from President's remarks today:
"This new approach starts at the top, with this commitment from me: From now on, our digital infrastructure—the networks and computers we depend on every day—will be treated as they should be: as a strategic national asset. Protecting this infrastructure will be a national security priority. We will ensure that these networks are secure, trustworthy and resilient. We will deter, prevent, detect, and defend against attacks and recover quickly from any disruptions or damage.
To give these efforts the high-level focus and attention they deserve—and as part of the new, single National Security Staff announced this week—I'm creating a new office here at the White House that will be led by the Cybersecurity Coordinator [or, as called by some, a Cyber Czar]. Because of the critical importance of this work, I will personally select this official. I'll depend on this official in all matters relating to cybersecurity, and this official will have my full support and regular access to me as we confront these challenges."
By LOLITA C. BALDOR, Associated Press Writer Lolita C. Baldor, Associated Press Writer – 1 hr 17 mins ago
WASHINGTON – America has failed for too long to protect the security of its computer networks, President Barack Obama said Friday, announcing he will name a new cyber czar to press for action.
Surrounded by a slew of government officials, aides and corporate executives, Obama said the U.S. has reached a "transformational moment" when computer networks are probed and attacked millions of times a day.
"It's now clear this cyber threat is one of the most serious economic and national security challenges we face as a nation," Obama said, adding, "We're not as prepared as we should be, as a government or as a country."
He said he will soon pick the person he wants to head a new White House office of cyber security, and that person will report to the National Security Council and the National Economic Council — a nod to his contention that the country's economic prosperity depends on cybersecurity.
While the coordinator's exact title has not yet been decided, Obama addressed concerns that the person might not have the budgetary and policy-making authority needed to force change. The coordinator, he said, will have "regular access to me."
As many as a half dozen candidates — from the public and private sector — are being considered for the job, according to officials familiar with the discussions.
Obama's announcement comes as the Pentagon is poised to create a new cyber command to improve protection of military networks and coordinate its offensive and defensive cyber missions.
Government officials have grown increasingly alarmed as U.S. computer networks are repeatedly assailed by attacks and scams, ranging from nuisance hacking to more nefarious probes and attacks, including suspicions of cyber espionage by other nations, such as China. Officials earlier this year revealed there was an attack against the electrical grid, and computers at the Pentagon were infected by a virus.
Even the president was a victim.
Obama said his presidential campaign's own computer system was attacked last year, and hackers gained access to e-mails and filed, but not to contributors or financial information.
"It was a powerful reminder: In this Information Age, one of your greatest strengths — in our case, our ability to communicate to a wide range of supporters through the Internet — could also be one of your greatest vulnerabilities," said Obama.
Laying out a broad five-point plan, the president said the U.S. must provide the education required to keep pace with technology and attract and retain a cyber-savvy work force. He called for a new education campaign to raise public awareness of the challenges and threats related to cyber security.
The newly interconnected world offers great promise, but it also presents significant peril, the president said, declaring: "Cyberspace is real, and so are the risks that comes with it."
He assured the business community, however, that the government will not dictate how private industry should tighten digital defenses. And he made it clear that the new cyber security effort will not involve any monitoring of private networks or individual e-mail accounts.
The Internet, he said, should remain open and free.
Corporate leaders and cyber experts, however, say they are concerned that the new coordinator will not wield enough power to force reluctant government agencies to put aside turf wars or dictate how they spend the millions of dollars the U.S. pours into its digital budgets.
"Placing a strategy "czar" in the White House will hinder Congress' ability to effectively oversee federal cybersecurity activities and will do little to resolve the bureaucratic conflicts, turf battles, and confusing lines of authority that have undermined past cybersecurity efforts," said Sen. Susan Collins of Maine, the top Republican on the Homeland Security and Governmental Affairs Committee.
Experts expressed similar reservations.
"I expect that a position that has a lesser role, that doesn't have budget authority, that is reporting up through the NEC, would probably not result in the kinds of changes that really need to be made," said Gene Spafford, computer security expert and professor at Purdue University, where candidate Obama first pledged last year to make cyber a priority.
Obama said the coordinator will work with the Office of Management and Budget to ensure that agencies reflect the spending priorities needed.
Overall, computer company executives and members of Congress hailed Obama's announcement as a good first step, while warning that there is much hard work still to be done.
"Because the private sector owns and operates the vast majority of our nation's critical infrastructure, government and business have a shared responsibility to defend our networks," said Ann Beauchesne, vice president of national security at the U.S. Chamber of Commerce.
Friday, May 29th, 2009 at 10:00 am Securing Our Digital Future
Melissa Hathaway, Cybersecurity Chief at the National Security Council, discusses securing our nation's digital future:
The globally-interconnected digital information and communications infrastructure known as cyberspace underpins almost every facet of modern society and provides critical support for the U.S. economy, civil infrastructure, public safety and national security. The United States is one of the global leaders on embedding technology into our daily lives and this technology adoption has transformed the global economy and connected people in ways never imagined. My boys are 8 and 9 and use the Internet daily to do homework, blog with their friends and teacher, and email their mom; it is second nature to them. My mom and dad can read the newspapers about their daughter on-line and can reach me anywhere in the world from their cell phone to mine. And people all over the world can post and watch videos and read our blogs within minutes of completion. I can’t imagine my world without this connectivity and I would bet that you cannot either. Now consider that the same networks that provide this connectively also increasingly help control our critical infrastructure. These networks deliver power and water to our households and businesses, they enable us to access our bank accounts from almost any city in the world, and they are transforming the way our doctors provide healthcare. For all of these reasons, we need a safe Internet with a strong network infrastructure and we as a nation need to take prompt action to protect cyberspace for what we use it for today and will need in the future.
Protecting cyberspace requires strong vision and leadership and will require changes in policy, technology, education, and perhaps law. The 60-day cyberspace policy review summarizes our conclusions and outlines the beginning of a way forward in building a reliable, resilient, trustworthy digital infrastructure for the future. There are opportunities for everyone—individuals, academia, industry, and governments—to contribute toward this vision. During the review we engaged in more than 40 meetings and received and read more than 100 papers that informed our recommendations. As you will see in our review there is a lot of work for us to do together and an ambitious action plan to accomplish our goals. It must begin with a national dialogue on cybersecurity and we should start with our family, friends, and colleagues.
We are late in addressing this critical national need and our response must be focused, aggressive, and well-resourced. We have garnered great momentum in the last few months, and the vision developed in our review is based on the important input we received from industry, academia, the civil liberties and privacy communities, others in the Executive Branch, State governments, Congress, and our international partners. We now have a strong and common view of what is needed to achieve change. Ensuring that cyberspace is sufficiently resilient and trustworthy to support U.S. goals of economic growth, civil liberties and privacy protections, national security, and the continued advancement of democratic institutions requires making cybersecurity a national priority.
