07:44 PM
George V. Hulme
George V. Hulme

Verizon's VERIS Aims To Push Security Beyond Fuzzy Numbers

When it comes to sharing data in IT security the bad guys always seem to be way ahead. They employ far-flung networks used for sharing stolen data, buying and selling exploits, and information on how to launch successful attacks. However, when it comes to enterprises sharing attack and breach incident data there has not been a lot of sharing going on.

When it comes to sharing data in IT security the bad guys always seem to be way ahead. They employ far-flung networks used for sharing stolen data, buying and selling exploits, and information on how to launch successful attacks. However, when it comes to enterprises sharing attack and breach incident data there has not been a lot of sharing going on.There have been numerous voluntary attempts to get organizations to share breach data both within the private sector with the federal government. Unfortunately, those efforts haven't spurred much in the way of widespread incident data sharing. Consider the findings from this report [.pdf] from the U.S. Government Accountability Office which found that while 98 percent of the private sector businesses surveyed expected timely and actionable cyber threat information from the government to be shared, only 27 percent thought that such sharing was occurring to any great or even moderate extent.

That historical lack of sharing is why I was intrigued when Verizon Business launched a free Web site designed to enable organizations to share anonymous details about security breaches. The VERIS (Verizon Incident-Sharing) site is building upon Verizon's having already released a copy of the framework it uses to create its annual Data Breach Investigations Report. VERIS [.pdf] aims to provide breached organizations a way to, hopefully, identify the cause of a breach; measure it's potential impact; and compare the incident with other organizations who have also shared information with the site. The framework is available here.

Such data sharing can go a long way to help security managers not only better protect against new threats and attacks, shore-up vulnerabilities that are being exploited, but to also help show them where they may be able to reduce the most risk for their IT security investment.

The challenge for VERIS will be to get enterprises willing to share their breach data. For insight on how Verizon plans to get enterprises in the mood to share this sensitive information, I asked Alex Hutton, principal, risk and intelligence for Verizon's business RISK team why they think VERIS would be different than many other efforts.

In an e-mail exchange, Hutton explained how VERIS is a complement to existing information sharing efforts, and the that both the breadth and the depth of data collected and shared is unique. "Next, there's the application itself. We've put a lot of time and effort into making the application straightforward and easy to use. The development process was as rugged as possible. And through our partnership with ICSA Labs, all participants can maintain a strong degree of privacy, especially when users submit information from public WiFi or using Tor," he wrote.

That's good stuff, but perhaps most importantly, Hutton argued that chief information sewcurity officers are ready to share, especially to start getting real value out of their security Governance, Risk, and Compliance (GRC) investment. "I think the industry is about to take the next step. CISOs tell me about pouring tons of time, effort, and money into GRC and operational security only to feel like they're still just making stuff up. It's frustrating to them, their employees, their auditors, and their bosses. I think the success of VERIS and similar projects is inevitable simply because the current situation is untenable. We're ready for it - we're ready to move to evidence-based risk management," he wrote.

I hope so. I know I am. And if you are, too, the framework is available here if you're interested in checking it out.

The attackers are sharing information and comparing notes, it's about time the defenders do the same.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
New 'Mac-A-Mal' Tool Automates Mac Malware Hunting & Analysis
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/14/2018
IoT Product Safety: If It Appears Too Good to Be True, It Probably Is
Pat Osborne, Principal - Executive Consultant at Outhaul Consulting, LLC, & Cybersecurity Advisor for the Security Innovation Center,  3/12/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.