Perimeter
10/21/2012
02:56 PM
Wendy Nather
Wendy Nather
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

The Elephant In The Security Monitoring Room

It's right in front of us, but is too rarely taken into account within monitoring and risk systems: the policy exception

If you think about it, a firewall is an exception: Just connecting to the Internet is a risk, and a firewall is there to allow in (or out) the things you need despite that risk. Even when you have a full set of policies in place that govern how your infrastructure is configured, not everything will follow the rules. For every setting, there is an equal and opposite exception.

CISOs spend a lot of time granting and tracking these exceptions -- and then explaining them to an auditor. "Yes, I know we haven't changed this account password in two years. That's because to do it across the whole network will require six weeks of dedicated effort and reconfiguration of legacy hosts and business-critical applications that rely on jobs running under this account. There is no way we're going to do this every 90 days."

There are exceptions everywhere you look, either time-based ("We'll fix this when we have more money in the next fiscal year") or permanent ("We meant to do that -- please stop bugging us about it"). And don't forget what are probably your biggest sources of exceptions: your developers, who need to try new things, and your senior management, who probably get to have whatever they want; I once caught an executive doing the exact thing that he was most vocal about preventing.

So it's important to be aware of exceptions and have them centrally controlled and tracked for a more complete view of the risk you're taking on ("Who thought THAT was a good idea??"). It also saves time and effort when you are trying to troubleshoot something -- or, more importantly, when you're interpreting events in your monitoring system.

If I could wave a magic wand, I would have annotation features for every product that controls or monitors security. And I would have the annotation at the very spot where the controls are listed. This is available today with some systems: When I read firewall rules, I want to know immediately who created them, when they were created, and who authorized them.

But I also want annotation for alerts: "Don't show this as a problem, but keep tracking it, and let me know if it continues beyond this date because that's when they said they would stop needing it." And I want them for logs: "These are all the entries that resulted from this change that we approved last Wednesday." I don't want to have to track them all and look them up separately in the world's most popular business intelligence tool (Excel).

Exceptions require deep institutional knowledge, not only of systems, but of business processes and risk appetite. It's critical to understand what policy exceptions you have in place so that you can identify false-positives as well as real anomalies. And in an ideal world, you would roll all of your exceptions into one place so you could tell when your exposure was reaching the limits of acceptable risk. This probably won't happen if the exception is in the process and isn't visible in technology, but it sure would be nice to move in this direction with all of our assessment and monitoring systems.

Otherwise, you're only monitoring half of what your business is actually doing.

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy. Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web