Risk
11/30/2010
07:44 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Verizon's VERIS Aims To Push Security Beyond Fuzzy Numbers

When it comes to sharing data in IT security the bad guys always seem to be way ahead. They employ far-flung networks used for sharing stolen data, buying and selling exploits, and information on how to launch successful attacks. However, when it comes to enterprises sharing attack and breach incident data there has not been a lot of sharing going on.

When it comes to sharing data in IT security the bad guys always seem to be way ahead. They employ far-flung networks used for sharing stolen data, buying and selling exploits, and information on how to launch successful attacks. However, when it comes to enterprises sharing attack and breach incident data there has not been a lot of sharing going on.There have been numerous voluntary attempts to get organizations to share breach data both within the private sector with the federal government. Unfortunately, those efforts haven't spurred much in the way of widespread incident data sharing. Consider the findings from this report [.pdf] from the U.S. Government Accountability Office which found that while 98 percent of the private sector businesses surveyed expected timely and actionable cyber threat information from the government to be shared, only 27 percent thought that such sharing was occurring to any great or even moderate extent.

That historical lack of sharing is why I was intrigued when Verizon Business launched a free Web site designed to enable organizations to share anonymous details about security breaches. The VERIS (Verizon Incident-Sharing) site is building upon Verizon's having already released a copy of the framework it uses to create its annual Data Breach Investigations Report. VERIS [.pdf] aims to provide breached organizations a way to, hopefully, identify the cause of a breach; measure it's potential impact; and compare the incident with other organizations who have also shared information with the site. The framework is available here.

Such data sharing can go a long way to help security managers not only better protect against new threats and attacks, shore-up vulnerabilities that are being exploited, but to also help show them where they may be able to reduce the most risk for their IT security investment.

The challenge for VERIS will be to get enterprises willing to share their breach data. For insight on how Verizon plans to get enterprises in the mood to share this sensitive information, I asked Alex Hutton, principal, risk and intelligence for Verizon's business RISK team why they think VERIS would be different than many other efforts.

In an e-mail exchange, Hutton explained how VERIS is a complement to existing information sharing efforts, and the that both the breadth and the depth of data collected and shared is unique. "Next, there's the application itself. We've put a lot of time and effort into making the application straightforward and easy to use. The development process was as rugged as possible. And through our partnership with ICSA Labs, all participants can maintain a strong degree of privacy, especially when users submit information from public WiFi or using Tor," he wrote.

That's good stuff, but perhaps most importantly, Hutton argued that chief information sewcurity officers are ready to share, especially to start getting real value out of their security Governance, Risk, and Compliance (GRC) investment. "I think the industry is about to take the next step. CISOs tell me about pouring tons of time, effort, and money into GRC and operational security only to feel like they're still just making stuff up. It's frustrating to them, their employees, their auditors, and their bosses. I think the success of VERIS and similar projects is inevitable simply because the current situation is untenable. We're ready for it - we're ready to move to evidence-based risk management," he wrote.

I hope so. I know I am. And if you are, too, the framework is available here if you're interested in checking it out.

The attackers are sharing information and comparing notes, it's about time the defenders do the same.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-4350
Published: 2014-09-19
Buffer overflow in QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIDI file.

CVE-2014-4376
Published: 2014-09-19
IOKit in IOAcceleratorFamily in Apple OS X before 10.9.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an application that provides crafted API arguments.

CVE-2014-4390
Published: 2014-09-19
Bluetooth in Apple OS X before 10.9.5 does not properly validate API calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application.

Best of the Web
Dark Reading Radio