Risk
7/15/2013
12:08 PM
Connect Directly
RSS
E-Mail
50%
50%

In-Q-Tel, HyTrust Fight Insider Threats

CIA's investment arm cuts deal with HyTrust, maker of virtual appliance that monitors virtualized and cloud-based environments to spot insider abuses.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
The actions of Edward Snowden, the National Security Agency contract employee who has been leaking information on vast classified data-gathering programs carried out by the agency, has raised fresh questions about how to guard against risks from insiders exposing government secrets.

Agencies might take a cue from In-Q-Tel, the investment arm of the U.S. intelligence community, which said it is investing in a strategic partnership with HyTrust. The California firm offers a virtual appliance that acts as a gateway between systems administrators and their virtualized and cloud-based systems that can help identify the risk of insider abuses.

Although In-Q-Tel's action isn't likely in response to the Snowden incident, it does reflect growing efforts to deal more effectively with insider threats, and shore up the defenses of virtual infrastructure and cloud environments.

"The world does an appalling job of securing against inside threats -- they just care about the perimeter," said Eric Chiu, president and cofounder of HyTrust, in an interview with InformationWeek.

[ Did you know about the government trade in bugs? Read Bug Data Buys Businesses Intel From U.S. Government. ]

"What's really happened here is a wakeup call to government agencies and commercial companies that inside threats are real. Whether systems administrators are trying to steal information [or it's] outside threats that are trying to act like sys admins, you need a system to protect the crown jewels that make up your organization," he warned. "If people don't care about protecting data from the inside, you get what happened with Snowden."

HyTrust's virtual appliance monitors all administrative requests made to the virtual infrastructure and matches them to the organization's defined policies for access and allowable actions; the appliance allows requests to go through if they fit the policies, but denies them if they're inappropriate.

"That leads to a key piece of functionality -- continuous role-based monitoring and alerting," said Chiu. "Everything is being logged. We can compare what's happening against what is supposed to be happening. We can detect breaches with near 100% accuracy, and within seconds."

The IQT partnership is significant for HyTrust, he said, both in financial investment and market reach. As the agencies of the intelligence community move to virtual environments for their computing and data management, the need to protect that infrastructure -- and avoid another big breach -- becomes more urgent, he said.

"The assurance of critical infrastructure and data assets is paramount, and we believe that the HyTrust solution has the potential to greatly benefit our government customers," said Robert Ames, senior VP in charge of IQT's Information and Communication Technologies Practice, in a press release.

The HyTrust appliance works with both VMware (another investor, Chiu noted) and Cisco. "It's a great alignment point to have both of the biggest providers in the space," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio