Vulnerabilities / Threats
8/9/2013
04:46 PM
Mike Rothman
Mike Rothman
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Black Hat: The Problems Don't Change, But The Solutions Have

An increase in attacker capabilities has drawn an innovative response from industry, and emerging research promises more to come

Bill Brenner figures there is nothing new in security. But it seems he's looking at it only from the perspective of the problem space. I agree that the problems we face as security professionals remain consistent. Bad folks want to steal our stuff. Employees and senior management don't care about security. And these same employees get very pissed when you tell them they can't do something, like watch adult movies on their iPads while connected to the VPN looking at next quarter's financials. Go figure.

Click here for more of Dark Reading's Black Hat articles.

But here's the deal: For the first time in a long time, there is real innovation happening in security. And we need that kind of innovation because the adversaries continue to up their games -- big time. They game applications, they blow up business processes, and they seem to have inside information about how your defenses work. So to think that your signature-based controls and traditional PCI-approved security products will stop these adversaries is naive. And, of course, you aren't naive, right?

Combine that with some pretty good outcomes for investors, like Sourcefire's multibillion-dollar deal with Cisco and FireEye's projected IPO, and you have a Internet bubble-style feeding frenzy on all things cybersecurity. And with new business models and technology architectures (yes, cloud, I'm looking at you), the attack surface is getting bigger and the risk continues to skyrocket. The only thing constant in security is change. So if you thought you were getting into a nice, cushy gig when you studied for that CISSP, forget about it.

Having just returned from a month at Black Hat (well, three days in Vegas seems like a month), there is a lot of stuff to talk about. Remember that Black Hat (and DEF CON, as well) are about emerging research. The stuff I talk about in the Vulnerabilities and Threats section now -- that will be covered in Dark Reading's Attacks and Breaches section in 12 to 18 months. The research at Black Hat was split among a number of pretty timely areas, including malware detection and evading those detections, security monitoring, and mobility.

The most active for research (and innovation) continues to be advanced malware detection. I mentioned a little of what's happening in Controlling the Big 7 a few weeks ago. These new endpoint-centric controls are the tip of the iceberg. Expect to see significant innovation coming to market relative to endpoint forensics and network-based malware detection. Is it perfect yet? No. Will these new tools promise to block every attack? Of course not. The reality is, today's traditional controls can't even block script kiddies using attack kits they bought on Craigslist with Bitcoins. These new offerings will fair better, although they'll be far from perfect.

The tactics to detect malware continue to advance as well. A few years ago, doing malware analysis required a significant investment (think millions of dollars) for both highly skilled people and gear to figure out what malware was doing and to profile it. Now we're seeing folks offering up Web-based services to do the same thing, and open-source initiatives to leverage Big Data analytics to decipher patterns across large data sets to isolate bad behaviors. I guess Big Data can be useful for more than figuring out how to make you pay the most for your airplane ticket or hotel room, and figuring out what should be on the shelves of your local Wal-Mart.

We also saw a bunch of research that can be useful to improve your protection against these malware attacks. But the sessions weren't pitched like that. You saw talk after talk about evasion, and there's a reason for that. Researchers don't really find protection that compelling. But getting around existing protections? Yeah, that's cool. So that means you (as a defender) need to figure out how these new evasion tactics obviate your preventive controls. Then you need to respond and evolve your defenses. Given the sexiness of sandboxes (on both the endpoint and network), it wasn't surprising to see a lot of research focused on bypassing these sandboxes. I hope the vendors were listening, since by the time research is shown at Black Hat, it's well on its way to being weaponized by the adversaries.

There was also Black Hat research on timely issues, like denial-of-service (DoS) attacks and attacking mobile devices. Actually, I was surprised by the modest number of sessions on mobile. Mobility was all over Black Hat last year, so either the topic is not as interesting (unlikely) or the selection committee has mobile exhaustion (more likely). And with the preponderance of DoS attacks, it's not surprising that research is going into figuring out how to evade the scrubbing services and other mitigation techniques.

I understand that Bill may be frustrated that the industry continues to have the same discussions about the same problems year after year without seeming to make any progress. But when you look under the covers both on the attack front and the defense front -- there is plenty of innovation happening. You just need to know where to look.

Mike Rothman is President of Securosis and author of The Pragmatic CSO Mike's bold perspectives and irreverent style are invaluable as companies determine effective strategies to grapple with the dynamic security threatscape. Mike specializes in the sexy aspects of security, like protecting networks and endpoints, security management, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
8/10/2013 | 12:47:23 PM
re: Black Hat: The Problems Don't Change, But The Solutions Have
the single consistent thread in computer based business is a failure to authenticate,-- whether that be financial transactions -- or software. the solution has been available for years -- public key encryption. It was developed back in the 60s and made publicly available by Phil Zimmerman.

that PGP has not become a general practice is a question that needs to be examined: Cui Bono?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web