Risk
7/15/2013
12:08 PM
50%
50%

In-Q-Tel, HyTrust Fight Insider Threats

CIA's investment arm cuts deal with HyTrust, maker of virtual appliance that monitors virtualized and cloud-based environments to spot insider abuses.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
The actions of Edward Snowden, the National Security Agency contract employee who has been leaking information on vast classified data-gathering programs carried out by the agency, has raised fresh questions about how to guard against risks from insiders exposing government secrets.

Agencies might take a cue from In-Q-Tel, the investment arm of the U.S. intelligence community, which said it is investing in a strategic partnership with HyTrust. The California firm offers a virtual appliance that acts as a gateway between systems administrators and their virtualized and cloud-based systems that can help identify the risk of insider abuses.

Although In-Q-Tel's action isn't likely in response to the Snowden incident, it does reflect growing efforts to deal more effectively with insider threats, and shore up the defenses of virtual infrastructure and cloud environments.

"The world does an appalling job of securing against inside threats -- they just care about the perimeter," said Eric Chiu, president and cofounder of HyTrust, in an interview with InformationWeek.

[ Did you know about the government trade in bugs? Read Bug Data Buys Businesses Intel From U.S. Government. ]

"What's really happened here is a wakeup call to government agencies and commercial companies that inside threats are real. Whether systems administrators are trying to steal information [or it's] outside threats that are trying to act like sys admins, you need a system to protect the crown jewels that make up your organization," he warned. "If people don't care about protecting data from the inside, you get what happened with Snowden."

HyTrust's virtual appliance monitors all administrative requests made to the virtual infrastructure and matches them to the organization's defined policies for access and allowable actions; the appliance allows requests to go through if they fit the policies, but denies them if they're inappropriate.

"That leads to a key piece of functionality -- continuous role-based monitoring and alerting," said Chiu. "Everything is being logged. We can compare what's happening against what is supposed to be happening. We can detect breaches with near 100% accuracy, and within seconds."

The IQT partnership is significant for HyTrust, he said, both in financial investment and market reach. As the agencies of the intelligence community move to virtual environments for their computing and data management, the need to protect that infrastructure -- and avoid another big breach -- becomes more urgent, he said.

"The assurance of critical infrastructure and data assets is paramount, and we believe that the HyTrust solution has the potential to greatly benefit our government customers," said Robert Ames, senior VP in charge of IQT's Information and Communication Technologies Practice, in a press release.

The HyTrust appliance works with both VMware (another investor, Chiu noted) and Cisco. "It's a great alignment point to have both of the biggest providers in the space," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4231
Published: 2015-07-03
The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.

CVE-2015-4232
Published: 2015-07-03
Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.

CVE-2015-4234
Published: 2015-07-03
Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127.

CVE-2015-4237
Published: 2015-07-03
The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv0...

CVE-2015-4239
Published: 2015-07-03
Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report