Risk
11/30/2010
07:44 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Verizon's VERIS Aims To Push Security Beyond Fuzzy Numbers

When it comes to sharing data in IT security the bad guys always seem to be way ahead. They employ far-flung networks used for sharing stolen data, buying and selling exploits, and information on how to launch successful attacks. However, when it comes to enterprises sharing attack and breach incident data there has not been a lot of sharing going on.

When it comes to sharing data in IT security the bad guys always seem to be way ahead. They employ far-flung networks used for sharing stolen data, buying and selling exploits, and information on how to launch successful attacks. However, when it comes to enterprises sharing attack and breach incident data there has not been a lot of sharing going on.There have been numerous voluntary attempts to get organizations to share breach data both within the private sector with the federal government. Unfortunately, those efforts haven't spurred much in the way of widespread incident data sharing. Consider the findings from this report [.pdf] from the U.S. Government Accountability Office which found that while 98 percent of the private sector businesses surveyed expected timely and actionable cyber threat information from the government to be shared, only 27 percent thought that such sharing was occurring to any great or even moderate extent.

That historical lack of sharing is why I was intrigued when Verizon Business launched a free Web site designed to enable organizations to share anonymous details about security breaches. The VERIS (Verizon Incident-Sharing) site is building upon Verizon's having already released a copy of the framework it uses to create its annual Data Breach Investigations Report. VERIS [.pdf] aims to provide breached organizations a way to, hopefully, identify the cause of a breach; measure it's potential impact; and compare the incident with other organizations who have also shared information with the site. The framework is available here.

Such data sharing can go a long way to help security managers not only better protect against new threats and attacks, shore-up vulnerabilities that are being exploited, but to also help show them where they may be able to reduce the most risk for their IT security investment.

The challenge for VERIS will be to get enterprises willing to share their breach data. For insight on how Verizon plans to get enterprises in the mood to share this sensitive information, I asked Alex Hutton, principal, risk and intelligence for Verizon's business RISK team why they think VERIS would be different than many other efforts.

In an e-mail exchange, Hutton explained how VERIS is a complement to existing information sharing efforts, and the that both the breadth and the depth of data collected and shared is unique. "Next, there's the application itself. We've put a lot of time and effort into making the application straightforward and easy to use. The development process was as rugged as possible. And through our partnership with ICSA Labs, all participants can maintain a strong degree of privacy, especially when users submit information from public WiFi or using Tor," he wrote.

That's good stuff, but perhaps most importantly, Hutton argued that chief information sewcurity officers are ready to share, especially to start getting real value out of their security Governance, Risk, and Compliance (GRC) investment. "I think the industry is about to take the next step. CISOs tell me about pouring tons of time, effort, and money into GRC and operational security only to feel like they're still just making stuff up. It's frustrating to them, their employees, their auditors, and their bosses. I think the success of VERIS and similar projects is inevitable simply because the current situation is untenable. We're ready for it - we're ready to move to evidence-based risk management," he wrote.

I hope so. I know I am. And if you are, too, the framework is available here if you're interested in checking it out.

The attackers are sharing information and comparing notes, it's about time the defenders do the same.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6477
Published: 2014-11-23
Unspecified vulnerability in the JPublisher component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4...

CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?