Risk
7/15/2013
12:08 PM
Connect Directly
RSS
E-Mail
50%
50%

In-Q-Tel, HyTrust Fight Insider Threats

CIA's investment arm cuts deal with HyTrust, maker of virtual appliance that monitors virtualized and cloud-based environments to spot insider abuses.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
The actions of Edward Snowden, the National Security Agency contract employee who has been leaking information on vast classified data-gathering programs carried out by the agency, has raised fresh questions about how to guard against risks from insiders exposing government secrets.

Agencies might take a cue from In-Q-Tel, the investment arm of the U.S. intelligence community, which said it is investing in a strategic partnership with HyTrust. The California firm offers a virtual appliance that acts as a gateway between systems administrators and their virtualized and cloud-based systems that can help identify the risk of insider abuses.

Although In-Q-Tel's action isn't likely in response to the Snowden incident, it does reflect growing efforts to deal more effectively with insider threats, and shore up the defenses of virtual infrastructure and cloud environments.

"The world does an appalling job of securing against inside threats -- they just care about the perimeter," said Eric Chiu, president and cofounder of HyTrust, in an interview with InformationWeek.

[ Did you know about the government trade in bugs? Read Bug Data Buys Businesses Intel From U.S. Government. ]

"What's really happened here is a wakeup call to government agencies and commercial companies that inside threats are real. Whether systems administrators are trying to steal information [or it's] outside threats that are trying to act like sys admins, you need a system to protect the crown jewels that make up your organization," he warned. "If people don't care about protecting data from the inside, you get what happened with Snowden."

HyTrust's virtual appliance monitors all administrative requests made to the virtual infrastructure and matches them to the organization's defined policies for access and allowable actions; the appliance allows requests to go through if they fit the policies, but denies them if they're inappropriate.

"That leads to a key piece of functionality -- continuous role-based monitoring and alerting," said Chiu. "Everything is being logged. We can compare what's happening against what is supposed to be happening. We can detect breaches with near 100% accuracy, and within seconds."

The IQT partnership is significant for HyTrust, he said, both in financial investment and market reach. As the agencies of the intelligence community move to virtual environments for their computing and data management, the need to protect that infrastructure -- and avoid another big breach -- becomes more urgent, he said.

"The assurance of critical infrastructure and data assets is paramount, and we believe that the HyTrust solution has the potential to greatly benefit our government customers," said Robert Ames, senior VP in charge of IQT's Information and Communication Technologies Practice, in a press release.

The HyTrust appliance works with both VMware (another investor, Chiu noted) and Cisco. "It's a great alignment point to have both of the biggest providers in the space," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-3828
Published: 2014-10-22
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.