Risk
11/30/2010
07:44 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Verizon's VERIS Aims To Push Security Beyond Fuzzy Numbers

When it comes to sharing data in IT security the bad guys always seem to be way ahead. They employ far-flung networks used for sharing stolen data, buying and selling exploits, and information on how to launch successful attacks. However, when it comes to enterprises sharing attack and breach incident data there has not been a lot of sharing going on.

When it comes to sharing data in IT security the bad guys always seem to be way ahead. They employ far-flung networks used for sharing stolen data, buying and selling exploits, and information on how to launch successful attacks. However, when it comes to enterprises sharing attack and breach incident data there has not been a lot of sharing going on.There have been numerous voluntary attempts to get organizations to share breach data both within the private sector with the federal government. Unfortunately, those efforts haven't spurred much in the way of widespread incident data sharing. Consider the findings from this report [.pdf] from the U.S. Government Accountability Office which found that while 98 percent of the private sector businesses surveyed expected timely and actionable cyber threat information from the government to be shared, only 27 percent thought that such sharing was occurring to any great or even moderate extent.

That historical lack of sharing is why I was intrigued when Verizon Business launched a free Web site designed to enable organizations to share anonymous details about security breaches. The VERIS (Verizon Incident-Sharing) site is building upon Verizon's having already released a copy of the framework it uses to create its annual Data Breach Investigations Report. VERIS [.pdf] aims to provide breached organizations a way to, hopefully, identify the cause of a breach; measure it's potential impact; and compare the incident with other organizations who have also shared information with the site. The framework is available here.

Such data sharing can go a long way to help security managers not only better protect against new threats and attacks, shore-up vulnerabilities that are being exploited, but to also help show them where they may be able to reduce the most risk for their IT security investment.

The challenge for VERIS will be to get enterprises willing to share their breach data. For insight on how Verizon plans to get enterprises in the mood to share this sensitive information, I asked Alex Hutton, principal, risk and intelligence for Verizon's business RISK team why they think VERIS would be different than many other efforts.

In an e-mail exchange, Hutton explained how VERIS is a complement to existing information sharing efforts, and the that both the breadth and the depth of data collected and shared is unique. "Next, there's the application itself. We've put a lot of time and effort into making the application straightforward and easy to use. The development process was as rugged as possible. And through our partnership with ICSA Labs, all participants can maintain a strong degree of privacy, especially when users submit information from public WiFi or using Tor," he wrote.

That's good stuff, but perhaps most importantly, Hutton argued that chief information sewcurity officers are ready to share, especially to start getting real value out of their security Governance, Risk, and Compliance (GRC) investment. "I think the industry is about to take the next step. CISOs tell me about pouring tons of time, effort, and money into GRC and operational security only to feel like they're still just making stuff up. It's frustrating to them, their employees, their auditors, and their bosses. I think the success of VERIS and similar projects is inevitable simply because the current situation is untenable. We're ready for it - we're ready to move to evidence-based risk management," he wrote.

I hope so. I know I am. And if you are, too, the framework is available here if you're interested in checking it out.

The attackers are sharing information and comparing notes, it's about time the defenders do the same.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.