Risk
7/15/2013
12:08 PM
50%
50%

In-Q-Tel, HyTrust Fight Insider Threats

CIA's investment arm cuts deal with HyTrust, maker of virtual appliance that monitors virtualized and cloud-based environments to spot insider abuses.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
The actions of Edward Snowden, the National Security Agency contract employee who has been leaking information on vast classified data-gathering programs carried out by the agency, has raised fresh questions about how to guard against risks from insiders exposing government secrets.

Agencies might take a cue from In-Q-Tel, the investment arm of the U.S. intelligence community, which said it is investing in a strategic partnership with HyTrust. The California firm offers a virtual appliance that acts as a gateway between systems administrators and their virtualized and cloud-based systems that can help identify the risk of insider abuses.

Although In-Q-Tel's action isn't likely in response to the Snowden incident, it does reflect growing efforts to deal more effectively with insider threats, and shore up the defenses of virtual infrastructure and cloud environments.

"The world does an appalling job of securing against inside threats -- they just care about the perimeter," said Eric Chiu, president and cofounder of HyTrust, in an interview with InformationWeek.

[ Did you know about the government trade in bugs? Read Bug Data Buys Businesses Intel From U.S. Government. ]

"What's really happened here is a wakeup call to government agencies and commercial companies that inside threats are real. Whether systems administrators are trying to steal information [or it's] outside threats that are trying to act like sys admins, you need a system to protect the crown jewels that make up your organization," he warned. "If people don't care about protecting data from the inside, you get what happened with Snowden."

HyTrust's virtual appliance monitors all administrative requests made to the virtual infrastructure and matches them to the organization's defined policies for access and allowable actions; the appliance allows requests to go through if they fit the policies, but denies them if they're inappropriate.

"That leads to a key piece of functionality -- continuous role-based monitoring and alerting," said Chiu. "Everything is being logged. We can compare what's happening against what is supposed to be happening. We can detect breaches with near 100% accuracy, and within seconds."

The IQT partnership is significant for HyTrust, he said, both in financial investment and market reach. As the agencies of the intelligence community move to virtual environments for their computing and data management, the need to protect that infrastructure -- and avoid another big breach -- becomes more urgent, he said.

"The assurance of critical infrastructure and data assets is paramount, and we believe that the HyTrust solution has the potential to greatly benefit our government customers," said Robert Ames, senior VP in charge of IQT's Information and Communication Technologies Practice, in a press release.

The HyTrust appliance works with both VMware (another investor, Chiu noted) and Cisco. "It's a great alignment point to have both of the biggest providers in the space," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4692
Published: 2015-07-27
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.

CVE-2015-1840
Published: 2015-07-26
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space cha...

CVE-2015-1872
Published: 2015-07-26
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via craft...

CVE-2015-2847
Published: 2015-07-26
Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.

CVE-2015-2848
Published: 2015-07-26
Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!