Perimeter
6/7/2012
01:06 PM
Wendy Nather
Wendy Nather
Commentary
50%
50%

When Is A Breach Not A Breach?

Monitoring: It's not just for breaches anymore -- and actually it never was. Here are some of the other uses for security monitoring

When most people think of security monitoring, they think of external attackers breaking into systems, or they think of insider fraud. But there's a whole spectrum of monitoring cases that security groups have to deal with, and they're not all Threat Level Orange.

Sometimes the team is asked to investigate a suspicion of a suspicion -- to determine whether it’s worth anyone’s time to dig further. Sometimes the "breach" is actually a turf war between departments, branch offices, or system administrators, when someone uses a root password that they weren’t supposed to have. And sometimes the monitoring is just for distasteful behavior that, strictly speaking, isn’t security-related.

One of the most difficult tasks to do well with any kind of monitoring system is to support an HR investigation. Let’s take the classic example of an employee being suspected of visiting inappropriate websites using company systems. Most Web filtering reporting systems will list every single URL that the user’s browser accesses, and that’s a lot of them. Just think of how many ads, graphics, and frames are displayed on any given page, and throw in any automatic authentication processes behind the scenes.

The first task is to sort out which main site the user was actually visiting; the second is to determine which sites the user accessed on purpose. Determining intent in browsing behavior is not something that comes easily to a SIEM, but it’s crucial for any potential disciplinary action. Did the user just visit the Exotic Singles Club site, or did he log in there, indicating that this was more than a one-time thing?

Other "breach" incidents that monitoring can pick up include unscheduled code changes, strategic alteration of a legal document, employee naps at the keyboard, leaks to a reporter, accidental publication, magically appearing and disappearing servers (and I’m not even talking about virtual machines), and one person calling another a doodyhead on instant messaging.

Security monitoring can be supportive of the business as well. It can be used to prove to an auditor that actions were taken by a required deadline. I saw it used once in a grievance case to show that the company assumed an important email was successfully delivered by a certain time because it tracked all email bounces and didn’t get one for that recipient’s address. The right kind of security monitoring can help troubleshoot operational issues and collect information at a certain point in time that is no longer available anywhere else.

So when you’re designing your security monitoring system, make sure it supports more use cases than just "catching APTs." Gather requirements from your business areas, HR, legal, audit, and your colleagues in IT, because it can potentially be useful to all of them. Of course, you also need to be sure that your monitoring doesn’t clash with any data or privacy laws, but in all other ways, think bigger than "breach."

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy.

Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?