Endpoint
5/9/2014
12:00 PM
Jason Sachowski
Jason Sachowski
Commentary
Connect Directly
LinkedIn
RSS
E-Mail
100%
0%

A New Approach to Endpoint Security: Think ‘Positive’

It's time to move away from traditional blacklisting models that define what should be restricted and implicitly allow everything else.

Traditional approaches of managing security through checklists, rules, and compliance can't keep up with the increasing malware volumes and propagation rates we are seeing today. A case in point is several recent "Threat Reports" detailing the severity of the modern threat landscape where:

With the rapid proliferation of mobile technology, traditional personal computing devices today represent a much smaller share of endpoint devices than in the past.

In the report "Enterprise Endpoint Protection When the Consumer Is King" (subscription required), Gartner indicates that, even though traditional personal computing devices like laptops and desktops represent a smaller share of endpoint devices used, they still represent the most infected and require the most effort to secure. Additionally, due to our continued use of traditional signature-based or blacklisting technologies, these devices remain the primary target for cyberattacks.

A game of cat and mouse
At a high level, the four primary goals of almost all cyberattacks are to target a vulnerability, drop payload, remain undetected, and harvest data. But today, it's not feasible to continue playing "cat and mouse" with cyber criminals when they have invested significant effort in understanding our blacklisting technologies' weaknesses, strengths, and even how they handle different attacks patterns. With this knowledge, cyber criminals are able to wreak havoc by:

  • Developing attacks that have limited distribution and are intended for targeted individuals/organizations
  • Circulating attacks quickly to guarantee blind spots in blacklisting technologies can be exploited
  • Creating noise to divert the security team's attention and increase the possibility of an attack going unnoticed.

As the ineffectiveness of blacklisting creates greater opportunities for attacks, we as security professionals must re-evaluate whether continuing to model our methodologies on the principle of constant "known-bad" protection is working. More important, as our IT infrastructure expands further to accommodate mobile computing platforms, desktop virtualization and cloud, we must work towards implementing security controls that are based on dynamic "known-good" protection.

To do this, we have to turn our attention to the security strategies that reduce our attack surface(s) through deny by default application control mechanisms and vulnerability management.

Consider all of the security controls we deploy to traditional personal computing devices -- anti-virus, intrusion prevention, data loss prevention, etc. These are just a few of the security technologies that contribute -- in varying degrees of effectiveness -- to endpoint protection. However, to maintain acceptable risk levels in the face of increasing threats and evolving technologies, we must change our outlook and approach to an endpoint protection strategy with a risk-based perspective.

There are many technologies that contribute to reducing the attack surface of traditional personal computing devices. Historically, our industry has followed blacklisting security models that define what should be restricted and implicitly allows everything else but this is proving to be ineffective due to declining detection rates.

Look on the bright side
With a risk-based approach, instead of managing threats through specific technology functionalities, we manage the attack surface with the goal of reducing a much larger number of threats without getting into specifics. In 2010, for example, when the Australian Signals Directorate adopted a risk-based approach to mitigate targeted cyber intrusions, it found that no single security control prevents malicious activity, but a combination of specific "positive security" strategies proved to be 85% effective in mitigating intrusions.

A risk-based or positive security methodology will also result in demonstrable business benefits with respect to traditional personal computing devices by:

  • Displacing security controls (such as antivirus) that have become ineffective and/or contribute little value to the overall endpoint protection
  • Improving overall endpoint performance by eliminating (blacklist) signature databases that consume significant network and system resources
  • Reducing the strain on supporting infrastructure(s) for deploying (blacklisting) signature updates across remote locations
  • Enhancing operational efficiencies by lessening the work effort required to reactively maintain security technologies.

By changing our endpoint protection strategy to follow positive security models, we align with proven industry practices of least-privilege, or deny-by-default, and we position ourselves as attack-agnostic where we can be more relaxed when it comes to attack-signature deployment. In an environment where threats are a constantly moving target, this approach is a far more effective endpoint protection strategy.

Jason is currently the senior manager of the security research-and-development team within the Scotiabank group, where he has worked for the past decade. During his career with Scotiabank Group, he has been responsible for digital investigations, software development, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JasonSachowski
50%
50%
JasonSachowski,
User Rank: Author
5/16/2014 | 7:17:36 AM
Re: A New Approach to Endpoint Security: Think 'Positive'
Defense-in-depth involves a series of administrative, technical, and physical security controls that function at different operating layers; such as 0-DATA, 1-APPS, 2-USERS, 3-HOST, 4-INTRANET, 5-INTERNET.  Traditionally, this strategy has followed the assumption that all devices are – and will always be – connected to, trusted by, and managed from your organization.

Through an assessment, it would most likely be noted that the majority of these security controls are enforced within two layers: 3-HOST and 4-INTRANET.  Focusing on layer 3-HOST, there are any number of security controls that currently contribute - in varying percentages – to the endpoint protection; to which some can be surprisingly higher or lower than expected.  And for the most part, security controls operating at layer 3-HOST also have counterparts that operate at layer 4-INTRANET. 

"Postive security" for endpoint protection changes the perceived need for functional threat management into more attack surface reduction.  As you've stated that by "putting the securtiy emphasis on the data itself, and then bolstering the endpoints, APIs, devices, etc. through which it's shared and stored", we are better positioned to be attack-agnostic and gain such benefits as I've outlined previously.

By implementing "positive security" controls at layer 3-HOST while enhancing security controls within the reminaing layers, future endpoint protection will focus on reducing attack surface risk and further enable data access from anywhere, at any time, and on any-device.
IMjustinkern
50%
50%
IMjustinkern,
User Rank: Strategist
5/14/2014 | 10:30:35 AM
Layers and new endpoints
This sounds like a good approach and the people using endpoint tools probably adapt to a more positive, enablement approach rather than FUD & "NO!" all of the time. Something Gartner has also been push a lot of late is endpoint security as just one layer. Specifically, putting the securtiy emphasis on the data itself, and then bolstering the endpoints, APIs, devices, etc. through which it's shared and stored. How do you see this positivity approach fitting in with a layered perspective?
JasonSachowski
100%
0%
JasonSachowski,
User Rank: Author
5/13/2014 | 3:31:20 PM
Re: A New Approach to Endpoint Security: Think ‘Positive’
The biggest challenge with "positive security" is the technical InfoSec professionals.  For the most part, these are the people who are down in the weeds every day and are focused on threat mitigation.  The idea here is that instead of being concerned with managing threats, through signatures or functionalities we should focus on reducing the risk surfaces through attack-agnostic approaches; this can be challenging to change their point of view.  An example of this could be if we are to limit administrative access on a system, we inherently reduce the risk of unauthorized applications being installed and lessen the reliance on reactive mitigation.

The biggest success from implementing "positive security" would be in the operational cost savings/avoidance.  Some examples of where these benefits could be realized include:
1) displacement of several signature-based technologies that are no longer required;
2) improved system performance from lower resource utilization;
3) fewer incidents as a result of misconfigured signatures;
4) re-prioritization of staff from maintaining infrastructure functionality to enhancing business capabilities
Doug Finley
50%
50%
Doug Finley,
User Rank: Apprentice
5/13/2014 | 11:48:49 AM
Re: Excellent article! And here is a product that operates on those principles...
"You cannot have a whitelist approach if you allow your users access to the internet, because even known good websites, such as Yahoo!, can be compromised by malicious ads that only need a user to click."

You haven't seen Security Assistant. This paper describes it - be sure to see the remarks about infected web sites on page 6.

It works, and can lock a system down as tight (or not) as desired.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/13/2014 | 9:26:23 AM
Re: A New Approach to Endpoint Security: Think ‘Positive’
Jason, wondering if you can share some of your experiences transitioning to a positive security model in your workplace. What have been your biggest challenges and successes? 
JasonSachowski
50%
50%
JasonSachowski,
User Rank: Author
5/12/2014 | 9:10:02 PM
Re: A New Approach to Endpoint Security: Think ‘Positive’
For "positive security" to truly work after becoming exposed to "negative security" for so long, we have to make small changes over time and eventually we will reach the end goal.  This strategy does not have to be intrusive if we follow an plan that involves socializing the concepts with users/business, learning what is "known-good" behavior within our organization, and gradually implementing controls.

Going a step further, even though the focus was on shifting technologies I am not saying that this is the one and only silver bullet to making this "positive security" strategy work.  What we tend to forget with InfoSec challenges is that there are three pillars involved; people first, followed by process, and supported through technology.  In order for any InfoSec strategy to be truly effective, I think that all three must coexist and complement each other.
Stus
50%
50%
Stus,
User Rank: Apprentice
5/12/2014 | 12:48:14 PM
Re: Excellent article! And here is a product that operates on those principles...
@Robert - the combination of a whitelist for executables which block malware instantly, and a whitelist for websites where a user has the option to create a personal whitelist for websites (which -does- get scanned after the fact for malware) is a great way to solve that problem. Both shields reinforce each other and malware cannot call home to its command & control server.

Warm regards, Stu 
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/12/2014 | 11:52:23 AM
Re: Excellent article! And here is a product that operates on those principles...
While I agree that this is the direction endpoint security must proceed in order to stay ahead of today's threats, it is currently an operational headache.

Allow me to explain.  By eliminating a blacklist (blocking known bads) and moving to a whitelist (only allow known good) you can accomplish better security but only if you implement it completely.  You cannot have a whitelist approach if you allow your users access to the internet, because even known good websites, such as Yahoo!, can be compromised by malicious ads that only need a user to click.  Therefore, this approach requires you to block all internet sites except for those needed for business, all emails except from known senders, etc.  Now, if business needs to visit a new site, it first must be evaluated and vetted before being added to the whitelist.  All of this takes time and could stand in the way of making the business money.

I have yet to run across an effective whitelisting program or policy that doesn't inhibit the flow of business.  Once someone (smarter than me) comes up with a solution that can move at the speed of business then I will be ready to sign on.
MichaelD063
50%
50%
MichaelD063,
User Rank: Apprentice
5/11/2014 | 8:53:30 AM
Re: Excellent article! And here is a product that operates on those principles...
You cant rely on lists be it black, white, gray etc etc etc. It doesnt work and is easily bypassed.   you must reduce (even eliminate) the attack surface as the article states and raise the cost of the bad guy.  Make it infinitly more difficult to attack the desktop and network.   
Stus
50%
50%
Stus,
User Rank: Apprentice
5/10/2014 | 7:50:03 AM
Excellent article! And here is a product that operates on those principles...
This article is reflecting exactly what I have been thinking and operating off these last few years. 
More Blogs from Commentary
Phishing: What Once Was Old Is New Again
I used to think the heyday of phishing had passed. But as Symantec notes in its 2014 Internet Security Threat Report, I was wrong!
Dark Reading Radio: Data Loss Prevention (DLP) Fail
Learn about newly found vulnerabilities in commercial and open-source DLP software in the 7/30 episode of Dark Reading Radio.
The Perfect InfoSec Mindset: Paranoia + Skepticism
A little skeptical paranoia will ensure that you have the impulse to react quickly to new threats while retaining the logic to separate fact from fiction.
Weak Password Advice From Microsoft
Tempting as it may seem to do away with strong passwords for low-risk websites, password reuse is still a significant threat to both users and business.
Internet of Things: 4 Security Tips From The Military
The military has been connecting mobile command posts, unmanned vehicles, and wearable computers for decades. It’s time to take a page from their battle plan.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0914
Published: 2014-07-30
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management f...

CVE-2014-0915
Published: 2014-07-30
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8...

CVE-2014-0947
Published: 2014-07-30
Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authenticated users to execute arbitrary code via a crafted update site.

CVE-2014-0948
Published: 2014-07-30
Unspecified vulnerability in IBM Rational Software Architect Design Manager and Rational Rhapsody Design Manager 3.x and 4.x before 4.0.7 allows remote authenticated users to execute arbitrary code via a crafted ZIP archive.

CVE-2014-2356
Published: 2014-07-30
Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to obtain sensitive information via a crafted HTTPS request.

Best of the Web
Dark Reading Radio