Risk
10/18/2010
04:32 PM
Connect Directly
RSS
E-Mail
50%
50%

Pentagon's Insider Threat Push Offers Lessons For Enterprises

Companies, like the federal government, need to maximize the data they collect, experts say

The research arm of the Pentagon, known as the Defense Advanced Research Projects Agency (DARPA), put out a call last week for better methods of detecting soldiers and employees who may be preparing to attack that nation's military from the inside. Known as the Anomaly Detection at Multiple Scales (ADAMS) program, the research project aims to detect insiders just before or after they go rogue.

It's the second time in two months that the agency has launched a project to focus on insider threats. In late August, DARPA issued a call for proposals for its Cyber Insider Threat (CINDER) initiative, which aims to increase the accuracy of detecting adversaries already present in networks.

"Unfortunately, virtual insider threats have been largely identified due only to incompetence on the part of the perpetrator or by accident," says Peiter "Mudge" Zatko, the manager in charge of the program at DARPA.

Both projects attempt to advance beyond the simple analysis of data that occurs in most enterprises today, says Eddie Schwartz, CSO for security firm NetWitness.

"Part of the problem classically has been that legacy approaches to detecting insiders or detecting network anomalies or security policy violations ... have been trying to identify simplistic patterns, whether it is an object in a log file or signature in AV or IDS," Schwartz says.

Unfortunately, the results of the federal projects might not be visible to the private sector anytime soon. The CINDER program's goal is to have a working demonstration in a little more than a year, deploying the systems to real military networks in four years. While DARPA is looking into ways of allowing the private sector to use the technology, there will likely be further delays.

Yet there are lessons companies can learn from the focus of the projects and the goals of the Department of Defense, the experts say.

First, companies should collect as much information as possible -- there is no such thing as too much data, NetWitness' Schwartz says.

"Our viewpoint is capture everything, record everything that goes on on the network," he says. "And then the challenge is how to make good use of that."

While this advice plays into NetWitness' Investigator product, which allows the storage and retrieval of historical data on the network, Schwartz is not alone in making the recommendation. A major problem for insider threat researchers is the lack of good data on compromised networks and clean networks, says Malek Ben Salem, a PhD student in computer science at Columbia University and one of the authors of a paper that surveyed approaches to insider-threat detection.

"The data problem is a huge problem ... particularly for insider threats," Ben Salem says. "Not only are you missing the attack data, but also what constitutes the normal behavior of the user."

While the detection of insider threats is still a wide-open area of research, one thing is certain: Companies have a better chance of detecting attacks if they bring together data not only from network sources, but from a variety of other sources as well, including physical security logs -- from automated doors, for example -- and telephone records.

"No longer are we just focusing on what the insider is doing while interacting with a computer, for instance, but we are looking at other signs -- not necessarily digital -- that may be indicative of user behavior," Ben Salem says.

Finally, both the CINDER and ADAMS programs are attempting to better enable detection by looking at the context of action, either by focusing on the methods that current attackers use or the goals that an attacker might be pursuing. Enumerating these missions are a primary focus of the CINDER project.

"CINDER will attempt to address some of the flaws in current detection systems by modeling the adversary mission -- not by attempting to monitor a person or their particular traits -- and by beginning with the assumption that a given system has already been compromised," DARPA's Zatko says.

Such missions might include intelligence gathering and recon by advanced worms and botnets, and subterfuge and sabotage using embedded insiders or programs to place logic bombs, Zatko says.

"There are almost an unlimited number of missions that an adversary might theoretically pursue," Zatko says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio