Attacks/Breaches

1/5/2011
05:34 PM
50%
50%

Schwartz On Security: First, Know You've Been Breached

Spain's national aeronautics institute found three Mariposa botnet infections on internal PCs, thanks to constant testing. But when it comes to breaches, many organizations still have their heads in the sand.

Until a security incident or data breach gets discovered, does it really exist? The non-existential answer is: of course. And the longer it goes undetected, the greater the potential damage.

One 2010 study found that 41% of organizations can't determine how frequently they're targeted by advanced attacks, and half of organizations take at least a month to detect such attacks.

Likewise, the data breach list maintained by the Identity Theft Resource Center (ITRC) lists numerous breaches that have an estimated start date, sometimes months or even a year prior to an organization publicly declaring that the breach occurred. Half of all organizations involved in known 2010 data breaches also didn't disclose the attack vector or number of affected records. Perhaps they simply don't know the answers.

So as it comes time to make, break, or pursue resolutions for the new year, let's set one for information security. Rather than obsessing over which security technologies are in play, why not ask bigger questions: How do we know when we've been breached, and can we trace the attack back to prevent it from happening again?

One lesson comes from INTA, Spain's national aeronautics institute, where 1,600 scientists demand easy access to information, not to mention WebEx, unencumbered by security policies. How do you secure that environment -- and enforce security policies -- while not strangling people's ability to locate essential information or collaborate?

It's a difficult environment to secure. "They are working with a lot of top secret information," said Jesus Garrido Antonio, INTA's head of information security, speaking this past autumn at an event hosted by Palo Alto Networks. Furthermore, top secret data, such as the range of the Meteor air-to-air missile project, may involve just two numbers. How do you secure that?

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-7268
PUBLISHED: 2018-05-21
MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information exposure vulnerability in which a local unprivileged user is able to read any root (uid 0) owned file on the system, regardless of the file permissions. Confidential information suc...
CVE-2018-11092
PUBLISHED: 2018-05-21
An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.
CVE-2018-11096
PUBLISHED: 2018-05-21
Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account information remotely.
CVE-2018-11320
PUBLISHED: 2018-05-21
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs.
CVE-2018-8142
PUBLISHED: 2018-05-21
A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1035.