Vulnerabilities / Threats
11/15/2013
08:00 AM
Venky Ganesan
Venky Ganesan
Commentary
Connect Directly
RSS
E-Mail
100%
0%

Secure Your Network From Modern Hazards

Traditional security measures don't stand a chance in a data-centric world. But within the crisis lie opportunities for IT security pros.

Rather than focusing on the containers, CISOs and IT pros must take a more data-centric approach with an emphasis on data encryption, both at rest and in transit. To achieve security in a world of mobile and dynamic data, encryption must be ubiquitous, automatic, and on by default. Ubiquitous encryption at scale is hard to do, but it can be done. And if done well, it can render data irrelevant if breached. One way to attain broad data encryption is to institute corporate-wide policies that say data can never be in the clear when it is in rest or in motion and to standardize on a commercial key management system.

Fingerprint scanners, like the one in Apple's iPhone 5s, do nothing to protect the data stored on a mobile device.
Fingerprint scanners, like the one in Apple's iPhone 5s, do nothing to protect the data stored on a mobile device.

3. Third parties: The weakest link might not be yours
As data moves between devices and users and finally comes to rest, it might not end up on your own infrastructure. Rather, the data might end up in a cloud server or in an online backup service, file share, collaboration software, workgroup server, or partner database. Most likely it's in all of the above.

CISOs increasingly rely on partners for data processing and data storage, whether in the form of cloud providers or more traditional data processors and colocation facilities. Few companies operate without some footprint on Amazon's Cloud, Salesforce's CRM, or smaller SaaS players. Third parties represent a risk vector and companies must evaluate the risk of offloading data to a third party. There are new services available from vendors such as BitSight, Mandiant, and Terremark that offer independent metrics and scoring services for third-party risk.

You can prepare for the risks of moving data or processes to third parties by cataloguing all the third parties that store your data, requesting a security audit, and implementing encryption algorithms so that the data is not stored in the clear.

The information security market is in a perfect storm, but I see tremendous opportunity in this crisis. After all, every cloud has a silver lining.

Having a wealth of data is a good thing -- if you can make sense of it. Most companies are challenged with aggregating and analyzing the plethora of data being generated by their security applications and devices. The How Existing Security Data Can Help Identify Potential Attacks report recommends how to effectively leverage security data in order to make informed decisions and spot areas of vulnerability. (Free registration required.)

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
11/19/2013 | 8:36:43 AM
Re: Encryption
I hope so. We plan to run a survey on encryption use in Q1, and trend it back to one we did in 2011. I will be very interested to see movement. What are some of the companies that you find interesting?
venkyganesan
50%
50%
venkyganesan,
User Rank: Apprentice
11/19/2013 | 1:18:45 AM
Re: Encryption
There are distributed key management solutions coming along so you are not dependent on a root key.  True security woudl require you not to be exposed to a single point of failure with a root key.
venkyganesan
50%
50%
venkyganesan,
User Rank: Apprentice
11/19/2013 | 1:16:19 AM
Re: Encryption
Lorna - you are right! Encryption currently has very low usage - key management is an issue so is latency and performance.  However there are solutions emerging that address all elements of this.  The security discussion is now in the boardroom and the downside of data leakage is so high that I believe top down mandates are coming to push encryption to the data level.  We will see.

Venky
Li Tan
50%
50%
Li Tan,
User Rank: Apprentice
11/17/2013 | 10:17:27 PM
Re: Encryption
@Lorna, very good question - in my opinion the data encryption is always a kind of paradox. Without encryption, the data will not be secure and you are exposed to security breach. If you try to encrypt everything, then what about if you lose your encryption key? The modern key management mechanism helped to give some relief on this issue. But the problem is not completly solved - there is still the trouble to renew the certificate in case it's lost. Another more severe question is that, how can we fully trust the root CA itself?
Kim Davis
50%
50%
Kim Davis,
User Rank: Apprentice
11/15/2013 | 4:37:36 PM
The Perimeter is Less Important
I think your general approach is right.  We can't ignore the perimeter, but defending it is no longer the be all and end all of security.  What's required is constant, real-time (and therefore automated) monitoring of data within the perimeter.
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
11/15/2013 | 12:33:44 PM
Security evolution
I agree that security needs to focus on the data, rather than the devices, systems and locations where we keep it. Those other elements are changing so quickly we can't possibly keep up. Another transition for security pros is to learn how to respond and recover after a breach or attack, and to put as much effort into that as into prevention. If your company is singled out and targeted, the best you may be able to do is cut your losses.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
11/15/2013 | 12:32:47 PM
Encryption
Your comment "one way to attain broad data encryption is to institute corporate-wide policies that say data can never be in the clear when it is in rest or in motion and to standardize on a commercial key management system." makes a huge amount of sense. However, actual use of encryption is in the single-digits in many surveys. Best case, databases at rest are encrypted. End user devices? Forget it. The usual excuse is key management -- that  these systems are still too complex and expensive.

What's your advice to IT pros who want to expand encryption but are running scared of losing keys?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio