Perimeter
10/21/2012
02:56 PM
Wendy Nather
Wendy Nather
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

The Elephant In The Security Monitoring Room

It's right in front of us, but is too rarely taken into account within monitoring and risk systems: the policy exception

If you think about it, a firewall is an exception: Just connecting to the Internet is a risk, and a firewall is there to allow in (or out) the things you need despite that risk. Even when you have a full set of policies in place that govern how your infrastructure is configured, not everything will follow the rules. For every setting, there is an equal and opposite exception.

CISOs spend a lot of time granting and tracking these exceptions -- and then explaining them to an auditor. "Yes, I know we haven't changed this account password in two years. That's because to do it across the whole network will require six weeks of dedicated effort and reconfiguration of legacy hosts and business-critical applications that rely on jobs running under this account. There is no way we're going to do this every 90 days."

There are exceptions everywhere you look, either time-based ("We'll fix this when we have more money in the next fiscal year") or permanent ("We meant to do that -- please stop bugging us about it"). And don't forget what are probably your biggest sources of exceptions: your developers, who need to try new things, and your senior management, who probably get to have whatever they want; I once caught an executive doing the exact thing that he was most vocal about preventing.

So it's important to be aware of exceptions and have them centrally controlled and tracked for a more complete view of the risk you're taking on ("Who thought THAT was a good idea??"). It also saves time and effort when you are trying to troubleshoot something -- or, more importantly, when you're interpreting events in your monitoring system.

If I could wave a magic wand, I would have annotation features for every product that controls or monitors security. And I would have the annotation at the very spot where the controls are listed. This is available today with some systems: When I read firewall rules, I want to know immediately who created them, when they were created, and who authorized them.

But I also want annotation for alerts: "Don't show this as a problem, but keep tracking it, and let me know if it continues beyond this date because that's when they said they would stop needing it." And I want them for logs: "These are all the entries that resulted from this change that we approved last Wednesday." I don't want to have to track them all and look them up separately in the world's most popular business intelligence tool (Excel).

Exceptions require deep institutional knowledge, not only of systems, but of business processes and risk appetite. It's critical to understand what policy exceptions you have in place so that you can identify false-positives as well as real anomalies. And in an ideal world, you would roll all of your exceptions into one place so you could tell when your exposure was reaching the limits of acceptable risk. This probably won't happen if the exception is in the process and isn't visible in technology, but it sure would be nice to move in this direction with all of our assessment and monitoring systems.

Otherwise, you're only monitoring half of what your business is actually doing.

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy. Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-0460
Published: 2014-04-16
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.

CVE-2011-0993
Published: 2014-04-16
SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2011-3180
Published: 2014-04-16
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

CVE-2011-4089
Published: 2014-04-16
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

CVE-2011-4192
Published: 2014-04-16
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."

Best of the Web