Risk
11/30/2010
07:44 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Verizon's VERIS Aims To Push Security Beyond Fuzzy Numbers

When it comes to sharing data in IT security the bad guys always seem to be way ahead. They employ far-flung networks used for sharing stolen data, buying and selling exploits, and information on how to launch successful attacks. However, when it comes to enterprises sharing attack and breach incident data there has not been a lot of sharing going on.

When it comes to sharing data in IT security the bad guys always seem to be way ahead. They employ far-flung networks used for sharing stolen data, buying and selling exploits, and information on how to launch successful attacks. However, when it comes to enterprises sharing attack and breach incident data there has not been a lot of sharing going on.There have been numerous voluntary attempts to get organizations to share breach data both within the private sector with the federal government. Unfortunately, those efforts haven't spurred much in the way of widespread incident data sharing. Consider the findings from this report [.pdf] from the U.S. Government Accountability Office which found that while 98 percent of the private sector businesses surveyed expected timely and actionable cyber threat information from the government to be shared, only 27 percent thought that such sharing was occurring to any great or even moderate extent.

That historical lack of sharing is why I was intrigued when Verizon Business launched a free Web site designed to enable organizations to share anonymous details about security breaches. The VERIS (Verizon Incident-Sharing) site is building upon Verizon's having already released a copy of the framework it uses to create its annual Data Breach Investigations Report. VERIS [.pdf] aims to provide breached organizations a way to, hopefully, identify the cause of a breach; measure it's potential impact; and compare the incident with other organizations who have also shared information with the site. The framework is available here.

Such data sharing can go a long way to help security managers not only better protect against new threats and attacks, shore-up vulnerabilities that are being exploited, but to also help show them where they may be able to reduce the most risk for their IT security investment.

The challenge for VERIS will be to get enterprises willing to share their breach data. For insight on how Verizon plans to get enterprises in the mood to share this sensitive information, I asked Alex Hutton, principal, risk and intelligence for Verizon's business RISK team why they think VERIS would be different than many other efforts.

In an e-mail exchange, Hutton explained how VERIS is a complement to existing information sharing efforts, and the that both the breadth and the depth of data collected and shared is unique. "Next, there's the application itself. We've put a lot of time and effort into making the application straightforward and easy to use. The development process was as rugged as possible. And through our partnership with ICSA Labs, all participants can maintain a strong degree of privacy, especially when users submit information from public WiFi or using Tor," he wrote.

That's good stuff, but perhaps most importantly, Hutton argued that chief information sewcurity officers are ready to share, especially to start getting real value out of their security Governance, Risk, and Compliance (GRC) investment. "I think the industry is about to take the next step. CISOs tell me about pouring tons of time, effort, and money into GRC and operational security only to feel like they're still just making stuff up. It's frustrating to them, their employees, their auditors, and their bosses. I think the success of VERIS and similar projects is inevitable simply because the current situation is untenable. We're ready for it - we're ready to move to evidence-based risk management," he wrote.

I hope so. I know I am. And if you are, too, the framework is available here if you're interested in checking it out.

The attackers are sharing information and comparing notes, it's about time the defenders do the same.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
DNS Threats: What Every Enterprise Should Know
Domain Name System exploits could put your data at risk. Here's some advice on how to avoid them.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Tim Wilson speaks to two experts on vulnerability research – independent consultant Jeremiah Grossman and Black Duck Software’s Mike Pittenger – about the latest wave of vulnerabilities being exploited by online attackers