Risk
10/18/2010
04:32 PM
Connect Directly
RSS
E-Mail
50%
50%

Pentagon's Insider Threat Push Offers Lessons For Enterprises

Companies, like the federal government, need to maximize the data they collect, experts say

The research arm of the Pentagon, known as the Defense Advanced Research Projects Agency (DARPA), put out a call last week for better methods of detecting soldiers and employees who may be preparing to attack that nation's military from the inside. Known as the Anomaly Detection at Multiple Scales (ADAMS) program, the research project aims to detect insiders just before or after they go rogue.

It's the second time in two months that the agency has launched a project to focus on insider threats. In late August, DARPA issued a call for proposals for its Cyber Insider Threat (CINDER) initiative, which aims to increase the accuracy of detecting adversaries already present in networks.

"Unfortunately, virtual insider threats have been largely identified due only to incompetence on the part of the perpetrator or by accident," says Peiter "Mudge" Zatko, the manager in charge of the program at DARPA.

Both projects attempt to advance beyond the simple analysis of data that occurs in most enterprises today, says Eddie Schwartz, CSO for security firm NetWitness.

"Part of the problem classically has been that legacy approaches to detecting insiders or detecting network anomalies or security policy violations ... have been trying to identify simplistic patterns, whether it is an object in a log file or signature in AV or IDS," Schwartz says.

Unfortunately, the results of the federal projects might not be visible to the private sector anytime soon. The CINDER program's goal is to have a working demonstration in a little more than a year, deploying the systems to real military networks in four years. While DARPA is looking into ways of allowing the private sector to use the technology, there will likely be further delays.

Yet there are lessons companies can learn from the focus of the projects and the goals of the Department of Defense, the experts say.

First, companies should collect as much information as possible -- there is no such thing as too much data, NetWitness' Schwartz says.

"Our viewpoint is capture everything, record everything that goes on on the network," he says. "And then the challenge is how to make good use of that."

While this advice plays into NetWitness' Investigator product, which allows the storage and retrieval of historical data on the network, Schwartz is not alone in making the recommendation. A major problem for insider threat researchers is the lack of good data on compromised networks and clean networks, says Malek Ben Salem, a PhD student in computer science at Columbia University and one of the authors of a paper that surveyed approaches to insider-threat detection.

"The data problem is a huge problem ... particularly for insider threats," Ben Salem says. "Not only are you missing the attack data, but also what constitutes the normal behavior of the user."

While the detection of insider threats is still a wide-open area of research, one thing is certain: Companies have a better chance of detecting attacks if they bring together data not only from network sources, but from a variety of other sources as well, including physical security logs -- from automated doors, for example -- and telephone records.

"No longer are we just focusing on what the insider is doing while interacting with a computer, for instance, but we are looking at other signs -- not necessarily digital -- that may be indicative of user behavior," Ben Salem says.

Finally, both the CINDER and ADAMS programs are attempting to better enable detection by looking at the context of action, either by focusing on the methods that current attackers use or the goals that an attacker might be pursuing. Enumerating these missions are a primary focus of the CINDER project.

"CINDER will attempt to address some of the flaws in current detection systems by modeling the adversary mission -- not by attempting to monitor a person or their particular traits -- and by beginning with the assumption that a given system has already been compromised," DARPA's Zatko says.

Such missions might include intelligence gathering and recon by advanced worms and botnets, and subterfuge and sabotage using embedded insiders or programs to place logic bombs, Zatko says.

"There are almost an unlimited number of missions that an adversary might theoretically pursue," Zatko says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5316
Published: 2014-09-21
Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page.

CVE-2014-5320
Published: 2014-09-21
The Bump application for Android does not properly handle implicit intents, which allows attackers to obtain sensitive owner-name information via a crafted application.

CVE-2014-5321
Published: 2014-09-21
FileMaker Pro before 13 and Pro Advanced before 13 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2319...

CVE-2014-5322
Published: 2014-09-21
Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 13 and Pro Advanced before 13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-3640.

CVE-2014-6602
Published: 2014-09-21
Microsoft Asha OS on the Microsoft Mobile Nokia Asha 501 phone 14.0.4 allows physically proximate attackers to bypass the lock-screen protection mechanism, and read or modify contact information or dial arbitrary telephone numbers, by tapping the SOS Option and then tapping the Green Call Option.

Best of the Web
Dark Reading Radio