Risk
10/18/2010
04:32 PM
50%
50%

Pentagon's Insider Threat Push Offers Lessons For Enterprises

Companies, like the federal government, need to maximize the data they collect, experts say

The research arm of the Pentagon, known as the Defense Advanced Research Projects Agency (DARPA), put out a call last week for better methods of detecting soldiers and employees who may be preparing to attack that nation's military from the inside. Known as the Anomaly Detection at Multiple Scales (ADAMS) program, the research project aims to detect insiders just before or after they go rogue.

It's the second time in two months that the agency has launched a project to focus on insider threats. In late August, DARPA issued a call for proposals for its Cyber Insider Threat (CINDER) initiative, which aims to increase the accuracy of detecting adversaries already present in networks.

"Unfortunately, virtual insider threats have been largely identified due only to incompetence on the part of the perpetrator or by accident," says Peiter "Mudge" Zatko, the manager in charge of the program at DARPA.

Both projects attempt to advance beyond the simple analysis of data that occurs in most enterprises today, says Eddie Schwartz, CSO for security firm NetWitness.

"Part of the problem classically has been that legacy approaches to detecting insiders or detecting network anomalies or security policy violations ... have been trying to identify simplistic patterns, whether it is an object in a log file or signature in AV or IDS," Schwartz says.

Unfortunately, the results of the federal projects might not be visible to the private sector anytime soon. The CINDER program's goal is to have a working demonstration in a little more than a year, deploying the systems to real military networks in four years. While DARPA is looking into ways of allowing the private sector to use the technology, there will likely be further delays.

Yet there are lessons companies can learn from the focus of the projects and the goals of the Department of Defense, the experts say.

First, companies should collect as much information as possible -- there is no such thing as too much data, NetWitness' Schwartz says.

"Our viewpoint is capture everything, record everything that goes on on the network," he says. "And then the challenge is how to make good use of that."

While this advice plays into NetWitness' Investigator product, which allows the storage and retrieval of historical data on the network, Schwartz is not alone in making the recommendation. A major problem for insider threat researchers is the lack of good data on compromised networks and clean networks, says Malek Ben Salem, a PhD student in computer science at Columbia University and one of the authors of a paper that surveyed approaches to insider-threat detection.

"The data problem is a huge problem ... particularly for insider threats," Ben Salem says. "Not only are you missing the attack data, but also what constitutes the normal behavior of the user."

While the detection of insider threats is still a wide-open area of research, one thing is certain: Companies have a better chance of detecting attacks if they bring together data not only from network sources, but from a variety of other sources as well, including physical security logs -- from automated doors, for example -- and telephone records.

"No longer are we just focusing on what the insider is doing while interacting with a computer, for instance, but we are looking at other signs -- not necessarily digital -- that may be indicative of user behavior," Ben Salem says.

Finally, both the CINDER and ADAMS programs are attempting to better enable detection by looking at the context of action, either by focusing on the methods that current attackers use or the goals that an attacker might be pursuing. Enumerating these missions are a primary focus of the CINDER project.

"CINDER will attempt to address some of the flaws in current detection systems by modeling the adversary mission -- not by attempting to monitor a person or their particular traits -- and by beginning with the assumption that a given system has already been compromised," DARPA's Zatko says.

Such missions might include intelligence gathering and recon by advanced worms and botnets, and subterfuge and sabotage using embedded insiders or programs to place logic bombs, Zatko says.

"There are almost an unlimited number of missions that an adversary might theoretically pursue," Zatko says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.