Perimeter
6/7/2012
01:06 PM
Wendy Nather
Wendy Nather
Commentary
Connect Directly
RSS
E-Mail
50%
50%

When Is A Breach Not A Breach?

Monitoring: It's not just for breaches anymore -- and actually it never was. Here are some of the other uses for security monitoring

When most people think of security monitoring, they think of external attackers breaking into systems, or they think of insider fraud. But there's a whole spectrum of monitoring cases that security groups have to deal with, and they're not all Threat Level Orange.

Sometimes the team is asked to investigate a suspicion of a suspicion -- to determine whether it’s worth anyone’s time to dig further. Sometimes the "breach" is actually a turf war between departments, branch offices, or system administrators, when someone uses a root password that they weren’t supposed to have. And sometimes the monitoring is just for distasteful behavior that, strictly speaking, isn’t security-related.

One of the most difficult tasks to do well with any kind of monitoring system is to support an HR investigation. Let’s take the classic example of an employee being suspected of visiting inappropriate websites using company systems. Most Web filtering reporting systems will list every single URL that the user’s browser accesses, and that’s a lot of them. Just think of how many ads, graphics, and frames are displayed on any given page, and throw in any automatic authentication processes behind the scenes.

The first task is to sort out which main site the user was actually visiting; the second is to determine which sites the user accessed on purpose. Determining intent in browsing behavior is not something that comes easily to a SIEM, but it’s crucial for any potential disciplinary action. Did the user just visit the Exotic Singles Club site, or did he log in there, indicating that this was more than a one-time thing?

Other "breach" incidents that monitoring can pick up include unscheduled code changes, strategic alteration of a legal document, employee naps at the keyboard, leaks to a reporter, accidental publication, magically appearing and disappearing servers (and I’m not even talking about virtual machines), and one person calling another a doodyhead on instant messaging.

Security monitoring can be supportive of the business as well. It can be used to prove to an auditor that actions were taken by a required deadline. I saw it used once in a grievance case to show that the company assumed an important email was successfully delivered by a certain time because it tracked all email bounces and didn’t get one for that recipient’s address. The right kind of security monitoring can help troubleshoot operational issues and collect information at a certain point in time that is no longer available anywhere else.

So when you’re designing your security monitoring system, make sure it supports more use cases than just "catching APTs." Gather requirements from your business areas, HR, legal, audit, and your colleagues in IT, because it can potentially be useful to all of them. Of course, you also need to be sure that your monitoring doesn’t clash with any data or privacy laws, but in all other ways, think bigger than "breach."

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy.

Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0640
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

CVE-2014-0641
Published: 2014-08-20
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

CVE-2014-2505
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.

CVE-2014-2511
Published: 2014-08-20
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.

CVE-2014-2515
Published: 2014-08-20
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.