Perimeter
6/7/2012
01:06 PM
Wendy Nather
Wendy Nather
Commentary
50%
50%

When Is A Breach Not A Breach?

Monitoring: It's not just for breaches anymore -- and actually it never was. Here are some of the other uses for security monitoring

When most people think of security monitoring, they think of external attackers breaking into systems, or they think of insider fraud. But there's a whole spectrum of monitoring cases that security groups have to deal with, and they're not all Threat Level Orange.

Sometimes the team is asked to investigate a suspicion of a suspicion -- to determine whether it’s worth anyone’s time to dig further. Sometimes the "breach" is actually a turf war between departments, branch offices, or system administrators, when someone uses a root password that they weren’t supposed to have. And sometimes the monitoring is just for distasteful behavior that, strictly speaking, isn’t security-related.

One of the most difficult tasks to do well with any kind of monitoring system is to support an HR investigation. Let’s take the classic example of an employee being suspected of visiting inappropriate websites using company systems. Most Web filtering reporting systems will list every single URL that the user’s browser accesses, and that’s a lot of them. Just think of how many ads, graphics, and frames are displayed on any given page, and throw in any automatic authentication processes behind the scenes.

The first task is to sort out which main site the user was actually visiting; the second is to determine which sites the user accessed on purpose. Determining intent in browsing behavior is not something that comes easily to a SIEM, but it’s crucial for any potential disciplinary action. Did the user just visit the Exotic Singles Club site, or did he log in there, indicating that this was more than a one-time thing?

Other "breach" incidents that monitoring can pick up include unscheduled code changes, strategic alteration of a legal document, employee naps at the keyboard, leaks to a reporter, accidental publication, magically appearing and disappearing servers (and I’m not even talking about virtual machines), and one person calling another a doodyhead on instant messaging.

Security monitoring can be supportive of the business as well. It can be used to prove to an auditor that actions were taken by a required deadline. I saw it used once in a grievance case to show that the company assumed an important email was successfully delivered by a certain time because it tracked all email bounces and didn’t get one for that recipient’s address. The right kind of security monitoring can help troubleshoot operational issues and collect information at a certain point in time that is no longer available anywhere else.

So when you’re designing your security monitoring system, make sure it supports more use cases than just "catching APTs." Gather requirements from your business areas, HR, legal, audit, and your colleagues in IT, because it can potentially be useful to all of them. Of course, you also need to be sure that your monitoring doesn’t clash with any data or privacy laws, but in all other ways, think bigger than "breach."

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy.

Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9688
Published: 2015-03-05
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.

CVE-2015-2214
Published: 2015-03-05
NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php.

CVE-2015-2215
Published: 2015-03-05
Open redirect vulnerability in the Services single sign-on server helper (services_sso_server_helper) module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters.

CVE-2015-2216
Published: 2015-03-05
SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter.

CVE-2015-2218
Published: 2015-03-05
Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a w...

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.