04:32 PM
Connect Directly

Pentagon's Insider Threat Push Offers Lessons For Enterprises

Companies, like the federal government, need to maximize the data they collect, experts say

The research arm of the Pentagon, known as the Defense Advanced Research Projects Agency (DARPA), put out a call last week for better methods of detecting soldiers and employees who may be preparing to attack that nation's military from the inside. Known as the Anomaly Detection at Multiple Scales (ADAMS) program, the research project aims to detect insiders just before or after they go rogue.

It's the second time in two months that the agency has launched a project to focus on insider threats. In late August, DARPA issued a call for proposals for its Cyber Insider Threat (CINDER) initiative, which aims to increase the accuracy of detecting adversaries already present in networks.

"Unfortunately, virtual insider threats have been largely identified due only to incompetence on the part of the perpetrator or by accident," says Peiter "Mudge" Zatko, the manager in charge of the program at DARPA.

Both projects attempt to advance beyond the simple analysis of data that occurs in most enterprises today, says Eddie Schwartz, CSO for security firm NetWitness.

"Part of the problem classically has been that legacy approaches to detecting insiders or detecting network anomalies or security policy violations ... have been trying to identify simplistic patterns, whether it is an object in a log file or signature in AV or IDS," Schwartz says.

Unfortunately, the results of the federal projects might not be visible to the private sector anytime soon. The CINDER program's goal is to have a working demonstration in a little more than a year, deploying the systems to real military networks in four years. While DARPA is looking into ways of allowing the private sector to use the technology, there will likely be further delays.

Yet there are lessons companies can learn from the focus of the projects and the goals of the Department of Defense, the experts say.

First, companies should collect as much information as possible -- there is no such thing as too much data, NetWitness' Schwartz says.

"Our viewpoint is capture everything, record everything that goes on on the network," he says. "And then the challenge is how to make good use of that."

While this advice plays into NetWitness' Investigator product, which allows the storage and retrieval of historical data on the network, Schwartz is not alone in making the recommendation. A major problem for insider threat researchers is the lack of good data on compromised networks and clean networks, says Malek Ben Salem, a PhD student in computer science at Columbia University and one of the authors of a paper that surveyed approaches to insider-threat detection.

"The data problem is a huge problem ... particularly for insider threats," Ben Salem says. "Not only are you missing the attack data, but also what constitutes the normal behavior of the user."

While the detection of insider threats is still a wide-open area of research, one thing is certain: Companies have a better chance of detecting attacks if they bring together data not only from network sources, but from a variety of other sources as well, including physical security logs -- from automated doors, for example -- and telephone records.

"No longer are we just focusing on what the insider is doing while interacting with a computer, for instance, but we are looking at other signs -- not necessarily digital -- that may be indicative of user behavior," Ben Salem says.

Finally, both the CINDER and ADAMS programs are attempting to better enable detection by looking at the context of action, either by focusing on the methods that current attackers use or the goals that an attacker might be pursuing. Enumerating these missions are a primary focus of the CINDER project.

"CINDER will attempt to address some of the flaws in current detection systems by modeling the adversary mission -- not by attempting to monitor a person or their particular traits -- and by beginning with the assumption that a given system has already been compromised," DARPA's Zatko says.

Such missions might include intelligence gathering and recon by advanced worms and botnets, and subterfuge and sabotage using embedded insiders or programs to place logic bombs, Zatko says.

"There are almost an unlimited number of missions that an adversary might theoretically pursue," Zatko says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.