Perimeter
10/21/2012
02:56 PM
Wendy Nather
Wendy Nather
Commentary
50%
50%

The Elephant In The Security Monitoring Room

It's right in front of us, but is too rarely taken into account within monitoring and risk systems: the policy exception

If you think about it, a firewall is an exception: Just connecting to the Internet is a risk, and a firewall is there to allow in (or out) the things you need despite that risk. Even when you have a full set of policies in place that govern how your infrastructure is configured, not everything will follow the rules. For every setting, there is an equal and opposite exception.

CISOs spend a lot of time granting and tracking these exceptions -- and then explaining them to an auditor. "Yes, I know we haven't changed this account password in two years. That's because to do it across the whole network will require six weeks of dedicated effort and reconfiguration of legacy hosts and business-critical applications that rely on jobs running under this account. There is no way we're going to do this every 90 days."

There are exceptions everywhere you look, either time-based ("We'll fix this when we have more money in the next fiscal year") or permanent ("We meant to do that -- please stop bugging us about it"). And don't forget what are probably your biggest sources of exceptions: your developers, who need to try new things, and your senior management, who probably get to have whatever they want; I once caught an executive doing the exact thing that he was most vocal about preventing.

So it's important to be aware of exceptions and have them centrally controlled and tracked for a more complete view of the risk you're taking on ("Who thought THAT was a good idea??"). It also saves time and effort when you are trying to troubleshoot something -- or, more importantly, when you're interpreting events in your monitoring system.

If I could wave a magic wand, I would have annotation features for every product that controls or monitors security. And I would have the annotation at the very spot where the controls are listed. This is available today with some systems: When I read firewall rules, I want to know immediately who created them, when they were created, and who authorized them.

But I also want annotation for alerts: "Don't show this as a problem, but keep tracking it, and let me know if it continues beyond this date because that's when they said they would stop needing it." And I want them for logs: "These are all the entries that resulted from this change that we approved last Wednesday." I don't want to have to track them all and look them up separately in the world's most popular business intelligence tool (Excel).

Exceptions require deep institutional knowledge, not only of systems, but of business processes and risk appetite. It's critical to understand what policy exceptions you have in place so that you can identify false-positives as well as real anomalies. And in an ideal world, you would roll all of your exceptions into one place so you could tell when your exposure was reaching the limits of acceptable risk. This probably won't happen if the exception is in the process and isn't visible in technology, but it sure would be nice to move in this direction with all of our assessment and monitoring systems.

Otherwise, you're only monitoring half of what your business is actually doing.

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy. Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?