Perimeter
10/21/2012
02:56 PM
Wendy Nather
Wendy Nather
Commentary
50%
50%

The Elephant In The Security Monitoring Room

It's right in front of us, but is too rarely taken into account within monitoring and risk systems: the policy exception

If you think about it, a firewall is an exception: Just connecting to the Internet is a risk, and a firewall is there to allow in (or out) the things you need despite that risk. Even when you have a full set of policies in place that govern how your infrastructure is configured, not everything will follow the rules. For every setting, there is an equal and opposite exception.

CISOs spend a lot of time granting and tracking these exceptions -- and then explaining them to an auditor. "Yes, I know we haven't changed this account password in two years. That's because to do it across the whole network will require six weeks of dedicated effort and reconfiguration of legacy hosts and business-critical applications that rely on jobs running under this account. There is no way we're going to do this every 90 days."

There are exceptions everywhere you look, either time-based ("We'll fix this when we have more money in the next fiscal year") or permanent ("We meant to do that -- please stop bugging us about it"). And don't forget what are probably your biggest sources of exceptions: your developers, who need to try new things, and your senior management, who probably get to have whatever they want; I once caught an executive doing the exact thing that he was most vocal about preventing.

So it's important to be aware of exceptions and have them centrally controlled and tracked for a more complete view of the risk you're taking on ("Who thought THAT was a good idea??"). It also saves time and effort when you are trying to troubleshoot something -- or, more importantly, when you're interpreting events in your monitoring system.

If I could wave a magic wand, I would have annotation features for every product that controls or monitors security. And I would have the annotation at the very spot where the controls are listed. This is available today with some systems: When I read firewall rules, I want to know immediately who created them, when they were created, and who authorized them.

But I also want annotation for alerts: "Don't show this as a problem, but keep tracking it, and let me know if it continues beyond this date because that's when they said they would stop needing it." And I want them for logs: "These are all the entries that resulted from this change that we approved last Wednesday." I don't want to have to track them all and look them up separately in the world's most popular business intelligence tool (Excel).

Exceptions require deep institutional knowledge, not only of systems, but of business processes and risk appetite. It's critical to understand what policy exceptions you have in place so that you can identify false-positives as well as real anomalies. And in an ideal world, you would roll all of your exceptions into one place so you could tell when your exposure was reaching the limits of acceptable risk. This probably won't happen if the exception is in the process and isn't visible in technology, but it sure would be nice to move in this direction with all of our assessment and monitoring systems.

Otherwise, you're only monitoring half of what your business is actually doing.

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy. Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?