Risk
10/18/2010
04:32 PM
Connect Directly
RSS
E-Mail
50%
50%

Pentagon's Insider Threat Push Offers Lessons For Enterprises

Companies, like the federal government, need to maximize the data they collect, experts say

The research arm of the Pentagon, known as the Defense Advanced Research Projects Agency (DARPA), put out a call last week for better methods of detecting soldiers and employees who may be preparing to attack that nation's military from the inside. Known as the Anomaly Detection at Multiple Scales (ADAMS) program, the research project aims to detect insiders just before or after they go rogue.

It's the second time in two months that the agency has launched a project to focus on insider threats. In late August, DARPA issued a call for proposals for its Cyber Insider Threat (CINDER) initiative, which aims to increase the accuracy of detecting adversaries already present in networks.

"Unfortunately, virtual insider threats have been largely identified due only to incompetence on the part of the perpetrator or by accident," says Peiter "Mudge" Zatko, the manager in charge of the program at DARPA.

Both projects attempt to advance beyond the simple analysis of data that occurs in most enterprises today, says Eddie Schwartz, CSO for security firm NetWitness.

"Part of the problem classically has been that legacy approaches to detecting insiders or detecting network anomalies or security policy violations ... have been trying to identify simplistic patterns, whether it is an object in a log file or signature in AV or IDS," Schwartz says.

Unfortunately, the results of the federal projects might not be visible to the private sector anytime soon. The CINDER program's goal is to have a working demonstration in a little more than a year, deploying the systems to real military networks in four years. While DARPA is looking into ways of allowing the private sector to use the technology, there will likely be further delays.

Yet there are lessons companies can learn from the focus of the projects and the goals of the Department of Defense, the experts say.

First, companies should collect as much information as possible -- there is no such thing as too much data, NetWitness' Schwartz says.

"Our viewpoint is capture everything, record everything that goes on on the network," he says. "And then the challenge is how to make good use of that."

While this advice plays into NetWitness' Investigator product, which allows the storage and retrieval of historical data on the network, Schwartz is not alone in making the recommendation. A major problem for insider threat researchers is the lack of good data on compromised networks and clean networks, says Malek Ben Salem, a PhD student in computer science at Columbia University and one of the authors of a paper that surveyed approaches to insider-threat detection.

"The data problem is a huge problem ... particularly for insider threats," Ben Salem says. "Not only are you missing the attack data, but also what constitutes the normal behavior of the user."

While the detection of insider threats is still a wide-open area of research, one thing is certain: Companies have a better chance of detecting attacks if they bring together data not only from network sources, but from a variety of other sources as well, including physical security logs -- from automated doors, for example -- and telephone records.

"No longer are we just focusing on what the insider is doing while interacting with a computer, for instance, but we are looking at other signs -- not necessarily digital -- that may be indicative of user behavior," Ben Salem says.

Finally, both the CINDER and ADAMS programs are attempting to better enable detection by looking at the context of action, either by focusing on the methods that current attackers use or the goals that an attacker might be pursuing. Enumerating these missions are a primary focus of the CINDER project.

"CINDER will attempt to address some of the flaws in current detection systems by modeling the adversary mission -- not by attempting to monitor a person or their particular traits -- and by beginning with the assumption that a given system has already been compromised," DARPA's Zatko says.

Such missions might include intelligence gathering and recon by advanced worms and botnets, and subterfuge and sabotage using embedded insiders or programs to place logic bombs, Zatko says.

"There are almost an unlimited number of missions that an adversary might theoretically pursue," Zatko says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-6651
Published: 2014-07-31
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.

CVE-2014-2970
Published: 2014-07-31
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5139. Reason: This candidate is a duplicate of CVE-2014-5139, and has also been used to refer to an unrelated topic that is currently outside the scope of CVE. This unrelated topic is a LibreSSL code change adding functionality ...

CVE-2014-3488
Published: 2014-07-31
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

CVE-2014-3554
Published: 2014-07-31
Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.

CVE-2014-5171
Published: 2014-07-31
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

Best of the Web
Dark Reading Radio