Analytics //

Security Monitoring

11/13/2014
02:06 PM
Amit Yoran
Amit Yoran
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Time To Turn The Tables On Attackers

As a security industry, we need to arm business with innovative technologies that provide visibility, analysis, and action to prevent inevitable breaches from causing irreparable damage.

Last week, Amit Yoran was named the President of RSA. Amit joined RSA after the company's acquisition of NetWitness, a market leading network forensic vendor which he co-founded and served as CEO. Since the acquisition he has been the driving force behind expanding and transforming RSA's product strategy and portfolio. Amit previously co-founded and served as the CEO of Riptech, which was acquired by Symantec in 2002. He has also served as the founding director of the US Computer Emergency Response Team and as a founding member of the US Department of Defense's CERT program.

Dark Reading asked Amit to reflect on the changes he has seen in the threat and defensive landscape in his career, the future of the security industry and how he hopes to affect that in his role at RSA.

I've been fortunate enough to work in a field that I am very passionate about, and to work alongside so many extraordinary people. I started my career in information security doing incident response work in the Department of Defense over 20 years ago and was exposed to some of the most aggressive adversaries. Those early years made a profound and lasting impression on me. I saw firsthand how well-designed systems can fail, how mature security programs can be circumvented and how focused adversaries orchestrate strategic campaigns.

In the years since we've been faced with the reality that as an industry we've reached a point of catastrophic failure. Networks have become more complex, perimeters have become more porous, mobile and BYOD have become widely adopted and SaaS platforms more prevalent. Cyber criminals have taken advantage of our shortcomings and are winning the war.

How has the industry responded? Unfortunately the response is not enough, offering up more of the same old solutions with only modest improvements in firewalls and signature-based approaches to antivirus and intrusion detection systems. Solutions that by their very definition can't address sophisticated threats and lack the context to adequately scope what is going on in the network. Organizations weren't getting the visibility they so desperately needed to stand a chance going up against increasingly sophisticated adversaries. An adversary with technical acumen, focus, intent, and enough time can make compromises an inevitable reality for any network.

It all sounds very ominous, so how do we turn the tables on our attackers? Where do we go from here?

As an industry we're positioned to incite change in how organizations are securing their notably more modern and complex corporate environments. It's our obligation to arm businesses with the most innovative technologies fit to combat these advanced threats. I believe in an intelligence-driven security -- a strategy that provides the visibility, analysis and action needed to help prevent inevitable breaches from causing irreparable damage or loss. This strategy empowers organizations to effectively address the challenges they can see today and those still beyond the horizon.

The first steps toward stronger security are aligning and integrating our capabilities to better enable organizations to embrace modern computing, and also deliver the most effective security possible. Security has evolved beyond just simply seeing an exploit attempt, and now requires pervasive visibility that identifies an entire sequence of activities, or an orchestrated, strategic campaign. Technology needs to keep pace with this need and facilitate organizations' migration to next-generation computing platforms.

So how exactly do we achieve this? What are the tools we need?

With perimeters on their way out the door, identity matters now more than ever. For RSA, that means creating flexible multifactor authentication that the end user won't find burdensome and moving identity and access management (IAM) and governance from theoretical or a paper-based model to an operational, living, breathing organism that organizations can rely on. Security technologies should leverage the wealth of information offered by identity that offers critical context for a much broader understanding of what's happening in traditional environments, as well as mobile and cloud-based applications and services.

Equally crucial as managing identity is forming comprehensive visibility into network operations and a deep understanding of the digital environment. By establishing pervasive and true visibility we enable organizations to see not only what is occurring across their networks, but give them the analytics to understand what they're seeing. This paired with a mature GRC practice gives the business context and insight necessary to prioritize security efforts where they can make the greatest difference.

In my new role I'll be working across the business to deliver a simpler, seamless, and more unified customer experience alongside an industry poised to drive awareness about threats enterprises face, and the most advanced technologies they will need to combat those threats. As compromise has become inevitable, so must change. Hoping our current defensive technologies will keep us safe is ignoring the attacker already in the room. Historical attack patterns only tell us what has already been attempted, while the adversary has likely already changed their approach.

Intelligence-driven security isn't a marketing term. It requires businesses to know everything they can about their environment, their activity, their risk and their vulnerability. Only then can a business truly adopt a more agile stance, one in which it can confidently say, "I am ready for anything that comes at me, even if I've never seen it before." Today's advanced adversaries, in many cases, know businesses better than the businesses know themselves. As an industry and as individual organizations, it's time to take a hard look in the mirror, and use what we see to reflect, deflect, and fight the enemy on a level playing field.

Amit Yoran is chairman and CEO of Tenable, overseeing the company's strategic vision and direction. As the threat landscape expands, Amit is leading Tenable into a new era of security solutions, empowering organizations to meet the challenges of evolving threats with ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
11/20/2014 | 7:31:48 AM
Re: Two things,--
look up the meaning of "apoplectic" : Extremely angry; furious:

="the "NSA was apoplectic."

this explains why this critical technology has been diluted (x.509)  and is not well understood.     This needs to change.
macker490
50%
50%
macker490,
User Rank: Ninja
11/20/2014 | 7:27:17 AM
Two things,--
two things need to happen:

(1) use a secure operating system

(2) insist on authentication of transmittals


a Secure O/S will not allow itself to be modified by activity of an application program.

authentication is something that each user needs to be involved in: each of us needs to vett the x.509 certificates we want to trust and each of us needs to learn how to authenticate transmittals and then make a practice of insisting on authentication.

the need and method for authentication has been established since the '70s:

see: https://medium.com/stanford-select/keeping-secrets-84a7697bf89f

EXCERPT

A year earlier, Hellman had published "New Directions in Cryptography" with his student Whitfield Diffie, Gr. '78. The paper introduced the principles that now form the basis for all modern cryptography, and its publication rightfully caused a stir among electrical engineers and computer scientists. As Hellman recalled in a 2004 oral history, the nonmilitary community's reaction to the paper was "ecstatic." In contrast, the "NSA was apoplectic."
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/16/2014 | 1:58:51 PM
Re: It's time to wake up.
The vision sounds great to me. But I'm wondering how, as a competitive industry, will security vendors unite to deliver that vision to their customers.
gmerriman112
100%
0%
gmerriman112,
User Rank: Strategist
11/15/2014 | 6:37:44 AM
It's time to wake up.
"In the years since we've been faced with the reality that as an industry we've reached a point of catastrophic failure."

It's nice to see someone state the ugly truth. I've been saying this for a while now, but most folks I talk to think I'm being alarmist. They think that we will all muddle through somehow.

Yet the pace of serious breaches quickens with every passing month. Most disturbing to me is that so many of these incidents are the result of bone-headed blunders by folks who are getting paid to know better. Also disturbing are the complaints from folks who do know better that their managers are unwilling to make the necessary investment to improve the situation.

I'm not a security expert; I don't have a solution to the problem. I can only hope that the folks who are in a position to do something will wake up before it is too late.
Christian Bryant
100%
0%
Christian Bryant,
User Rank: Ninja
11/13/2014 | 6:25:18 PM
FOSS Access to RSA Innovation
I completely agree with your vision and I feel this is a great step in the right direction.  One of the best ways to innovate across an industry is to share knowledge, make APIs available and demonstrate solid functionality across platforms.  I hope that part of this initiative includes a deeper relationship with the Free and Open Source Software (FOSS) communities.  One reason is that, because FOSS is so "cheap" many start-ups and established companies use it in an Enterprise setting.  However, this is not always the most secure way to operate, especially for IT shops using FOSS that aren't well-versed in security and haven't done all they can do to tighten access to their digital assets.  This doesn't necessarily mean free up all your source, and make "free" your tools; rather, developing that tight relationship with one of the most influential technical bodies in the Enterprise (FOSS) can mean better code coverage (even if the source isn't open, the FOSS community can be hard on new tools and technologies, often revealing vulnerabilities before any other group), and when the relationship is a good one, FOSS users might be more willing to spend money on a solution than simply roll out a free one.
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
Why Enterprises Can't Ignore Third-Party IoT-Related Risks
Charlie Miller, Senior Vice President, The Santa Fe Group,  5/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11232
PUBLISHED: 2018-05-18
The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service (panic) because a parameter is incorrectly used as a local variable.
CVE-2017-15855
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, the camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in u...
CVE-2018-3567
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in WLAN while processing the HTT_T2H_MSG_TYPE_PEER_MAP or HTT_T2H_MSG_TYPE_PEER_UNMAP messages.
CVE-2018-3568
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, in __wlan_hdd_cfg80211_vendor_scan(), a buffer overwrite can potentially occur.
CVE-2018-5827
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in WLAN while processing an extscan hotlist event.