Perimeter
6/7/2012
01:06 PM
Wendy Nather
Wendy Nather
Commentary
Connect Directly
RSS
E-Mail
50%
50%

When Is A Breach Not A Breach?

Monitoring: It's not just for breaches anymore -- and actually it never was. Here are some of the other uses for security monitoring

When most people think of security monitoring, they think of external attackers breaking into systems, or they think of insider fraud. But there's a whole spectrum of monitoring cases that security groups have to deal with, and they're not all Threat Level Orange.

Sometimes the team is asked to investigate a suspicion of a suspicion -- to determine whether it’s worth anyone’s time to dig further. Sometimes the "breach" is actually a turf war between departments, branch offices, or system administrators, when someone uses a root password that they weren’t supposed to have. And sometimes the monitoring is just for distasteful behavior that, strictly speaking, isn’t security-related.

One of the most difficult tasks to do well with any kind of monitoring system is to support an HR investigation. Let’s take the classic example of an employee being suspected of visiting inappropriate websites using company systems. Most Web filtering reporting systems will list every single URL that the user’s browser accesses, and that’s a lot of them. Just think of how many ads, graphics, and frames are displayed on any given page, and throw in any automatic authentication processes behind the scenes.

The first task is to sort out which main site the user was actually visiting; the second is to determine which sites the user accessed on purpose. Determining intent in browsing behavior is not something that comes easily to a SIEM, but it’s crucial for any potential disciplinary action. Did the user just visit the Exotic Singles Club site, or did he log in there, indicating that this was more than a one-time thing?

Other "breach" incidents that monitoring can pick up include unscheduled code changes, strategic alteration of a legal document, employee naps at the keyboard, leaks to a reporter, accidental publication, magically appearing and disappearing servers (and I’m not even talking about virtual machines), and one person calling another a doodyhead on instant messaging.

Security monitoring can be supportive of the business as well. It can be used to prove to an auditor that actions were taken by a required deadline. I saw it used once in a grievance case to show that the company assumed an important email was successfully delivered by a certain time because it tracked all email bounces and didn’t get one for that recipient’s address. The right kind of security monitoring can help troubleshoot operational issues and collect information at a certain point in time that is no longer available anywhere else.

So when you’re designing your security monitoring system, make sure it supports more use cases than just "catching APTs." Gather requirements from your business areas, HR, legal, audit, and your colleagues in IT, because it can potentially be useful to all of them. Of course, you also need to be sure that your monitoring doesn’t clash with any data or privacy laws, but in all other ways, think bigger than "breach."

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy.

Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.