Vulnerabilities / Threats
11/15/2013
08:00 AM
Venky Ganesan
Venky Ganesan
Commentary
Connect Directly
RSS
E-Mail
100%
0%

Secure Your Network From Modern Hazards

Traditional security measures don't stand a chance in a data-centric world. But within the crisis lie opportunities for IT security pros.

Information security discussions have moved from wiring closets to corporate boardrooms. In early 2012, Bloomberg Government and the Ponemon Institute issued a study that showed 172 US-based organizations -- from multinational corporations to the federal government -- spend a combined $5.3 billion on cybersecurity.

These institutions estimated they will have to spend $46.6 billion to adequately address today's attacks -- from state-sponsored campaigns to rogue activism that threaten data and the nation's critical infrastructure. Our systems have become so tied to the Internet, this "grid" can be compromised with a single swipe. The threat is real, relevant, and happening right now.

It appears 2013 will be remembered as the year when the avalanche of data -- from social media and enterprise big data -- collided head on with our ability to maintain the security and privacy of that data. The data generated by individuals, corporations, and government organizations is exploding and can neither be contained nor controlled. Chief information security officers (CISOs) and IT professionals, as the stewards of that data, with conventional approaches are bringing a sword to a gunfight.

[ Here's how to make your network more bulletproof. Read Can Your Network Beat Malware? ]

The world has become fluid. There are few enforceable boundaries between the corporate and the personal, the local and the remote, the datacenter and the cloud. According to Cisco's Global Mobile Data Traffic Forecast, by the end of this year, "the number of mobile-connected devices will exceed the number of people on Earth." Data is being consumed and produced across billions of devices scattered across ad-hoc network connections and crossing boundaries without pause. There's no perimeter in the cloud and the tools we have no longer work.

As a venture capitalist actively investing in the security market, I see three critical issues and related opportunities for information security pros:

1. Walled gardens have become wild gardens
CISOs are losing the security arms race. Even highly secure organizations -- including the security companies themselves -- have been breached. The reason is simple: the security model traditionally applied no longer matches the real world. Systems fail because of an attempt to control and contain by drawing boundaries, while data, users, and devices are becoming dynamic and mobile. Data has become liquid. Location-centric, device-centric, port-centric tools are simply inadequate to the task.

Security architecture has to become both dynamic and adaptive. Security tools will become more automated, using machine learning and big data analytics to respond to attacks. This will be done in a more fluid manner, focused on the data and the applications themselves and less on the port and the device. CISOs need to re-architect their security paradigm and invest in data-centric approaches such as DNSSEC, AES encryption, and TLS/SSL, and assume their perimeter has been compromised.

2. BYOD = BLOT
Organizations tolerate a "bring your own device" policy, but it actually "brings lots of trouble." Intellectual property leaks are multiplying. The reason? Security is focused on the containers rather than the data itself. Mobile security is mostly about device management. Datacenters and operating systems protect their perimeter with network and file-access controls. This containment model is failing because the data is moving too fast between devices and users. Even the NSA fell victim with an internal, human-led compromise. Mobile device makers are rushing to add containment controls, such as fingerprint scanners, but there is still inadequate focus on the data itself.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
11/15/2013 | 12:32:47 PM
Encryption
Your comment "one way to attain broad data encryption is to institute corporate-wide policies that say data can never be in the clear when it is in rest or in motion and to standardize on a commercial key management system." makes a huge amount of sense. However, actual use of encryption is in the single-digits in many surveys. Best case, databases at rest are encrypted. End user devices? Forget it. The usual excuse is key management -- that  these systems are still too complex and expensive.

What's your advice to IT pros who want to expand encryption but are running scared of losing keys?
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
11/15/2013 | 12:33:44 PM
Security evolution
I agree that security needs to focus on the data, rather than the devices, systems and locations where we keep it. Those other elements are changing so quickly we can't possibly keep up. Another transition for security pros is to learn how to respond and recover after a breach or attack, and to put as much effort into that as into prevention. If your company is singled out and targeted, the best you may be able to do is cut your losses.
Kim Davis
50%
50%
Kim Davis,
User Rank: Apprentice
11/15/2013 | 4:37:36 PM
The Perimeter is Less Important
I think your general approach is right.  We can't ignore the perimeter, but defending it is no longer the be all and end all of security.  What's required is constant, real-time (and therefore automated) monitoring of data within the perimeter.
Li Tan
50%
50%
Li Tan,
User Rank: Apprentice
11/17/2013 | 10:17:27 PM
Re: Encryption
@Lorna, very good question - in my opinion the data encryption is always a kind of paradox. Without encryption, the data will not be secure and you are exposed to security breach. If you try to encrypt everything, then what about if you lose your encryption key? The modern key management mechanism helped to give some relief on this issue. But the problem is not completly solved - there is still the trouble to renew the certificate in case it's lost. Another more severe question is that, how can we fully trust the root CA itself?
venkyganesan
50%
50%
venkyganesan,
User Rank: Apprentice
11/19/2013 | 1:16:19 AM
Re: Encryption
Lorna - you are right! Encryption currently has very low usage - key management is an issue so is latency and performance.  However there are solutions emerging that address all elements of this.  The security discussion is now in the boardroom and the downside of data leakage is so high that I believe top down mandates are coming to push encryption to the data level.  We will see.

Venky
venkyganesan
50%
50%
venkyganesan,
User Rank: Apprentice
11/19/2013 | 1:18:45 AM
Re: Encryption
There are distributed key management solutions coming along so you are not dependent on a root key.  True security woudl require you not to be exposed to a single point of failure with a root key.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
11/19/2013 | 8:36:43 AM
Re: Encryption
I hope so. We plan to run a survey on encryption use in Q1, and trend it back to one we did in 2011. I will be very interested to see movement. What are some of the companies that you find interesting?
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5242
Published: 2014-10-21
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a get_template action.

CVE-2012-5243
Published: 2014-10-21
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.

CVE-2012-5702
Published: 2014-10-21
Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a color_selector action, (2) field parameter in a date_format action, or (3) company_name parameter in an addedit action to i...

CVE-2013-7406
Published: 2014-10-21
SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2531
Published: 2014-10-21
SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.14 build 577 allows remote authenticated users to execute arbitrary SQL commands via the i parameter in a search action to the (1) NodeWorx , (2) SiteWorx, or (3) R...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.