Perimeter
6/3/2009
02:45 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Security Incident Ratings Made Easy

Management likes numbers. They get the the warm fuzzies when numbers can be graphed in a way that they can quickly discern what's going on. Of course, if the numbers are bad, then they may not feel those warm fuzzies. In the IT security world, we try to provide useful numbers to show what a great job we're doing, but it's hard to quantify thwarted attacks -- other than relying on numbers from an IPS and anti-malware system.

Management likes numbers. They get the the warm fuzzies when numbers can be graphed in a way that they can quickly discern what's going on. Of course, if the numbers are bad, then they may not feel those warm fuzzies. In the IT security world, we try to provide useful numbers to show what a great job we're doing, but it's hard to quantify thwarted attacks -- other than relying on numbers from an IPS and anti-malware system.Rating systems for attacks and vulnerabilities have been around for a while, but most are crude, risk-based matrices that rate security incidents with high, medium, and low ratings for probability on one axis, and impact on the other. Otherwise, I haven't seen anything that rates incidents well until a recent post from Richard Bejtlich on the TaoSecurity blog.

I'm not going to rehash his rating scheme, but what I do want to bring attention to are two factors: the granularity of the 10-point scale and moving it into the high/medium/low categorization, and the use of vulnerability as a type of incident.

A couple of readers commented that having 10 levels was too granular, but I disagree. If you need to break ratings down to a high, medium, or low classification, then Richard offers the option of viewing 1-3 as low, 4-6 as medium, 7-9 as high, and 10 as game over. The granularity is good for better reporting later on. I personally like graphs that have a smaller scale and more points to graph than ones that are more jagged. I think it helps to pinpoint more subtle changes in the data over time.

Richard said his reasoning for including vulnerabilities as an incident type is that some of his businesses classify them as such, even though it goes against how traditional incident detectors and responders think. I have mixed feelings on this one. The incident responder in me wants to agree and say that vulnerabilities shouldn't be included, but the security pro in me who wears many hats says it should. Why?

For security teams who are small and do incident response, vulnerability scanning, and penetration testing, detecting vulnerabilities and dealing with incidents tends to blur. If their experience is like mine, you have one ticketing system to manage it all, so it's often easy to simply and have an incident type of vulnerability. In fact, sometimes the detection of the vulnerability leads to a determination that a true incident has occurred already as a result of the vulnerability.

For teams who already have a mature incident rating system, this may seem old hat, but for those of you who don't, it may be just what you're looking for. And, remember, you don't have to use it verbatim. You can mix it up and use it as you please so that it best fits your organization.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0750
Published: 2015-05-22
The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786.

CVE-2012-1978
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admi...

CVE-2015-0741
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.

CVE-2015-0742
Published: 2015-05-21
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registrati...

CVE-2015-0746
Published: 2015-05-21
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.