Vulnerabilities / Threats
11/15/2013
08:00 AM
Venky Ganesan
Venky Ganesan
Commentary
Connect Directly
RSS
E-Mail
100%
0%

Secure Your Network From Modern Hazards

Traditional security measures don't stand a chance in a data-centric world. But within the crisis lie opportunities for IT security pros.

Information security discussions have moved from wiring closets to corporate boardrooms. In early 2012, Bloomberg Government and the Ponemon Institute issued a study that showed 172 US-based organizations -- from multinational corporations to the federal government -- spend a combined $5.3 billion on cybersecurity.

These institutions estimated they will have to spend $46.6 billion to adequately address today's attacks -- from state-sponsored campaigns to rogue activism that threaten data and the nation's critical infrastructure. Our systems have become so tied to the Internet, this "grid" can be compromised with a single swipe. The threat is real, relevant, and happening right now.

It appears 2013 will be remembered as the year when the avalanche of data -- from social media and enterprise big data -- collided head on with our ability to maintain the security and privacy of that data. The data generated by individuals, corporations, and government organizations is exploding and can neither be contained nor controlled. Chief information security officers (CISOs) and IT professionals, as the stewards of that data, with conventional approaches are bringing a sword to a gunfight.

[ Here's how to make your network more bulletproof. Read Can Your Network Beat Malware? ]

The world has become fluid. There are few enforceable boundaries between the corporate and the personal, the local and the remote, the datacenter and the cloud. According to Cisco's Global Mobile Data Traffic Forecast, by the end of this year, "the number of mobile-connected devices will exceed the number of people on Earth." Data is being consumed and produced across billions of devices scattered across ad-hoc network connections and crossing boundaries without pause. There's no perimeter in the cloud and the tools we have no longer work.

As a venture capitalist actively investing in the security market, I see three critical issues and related opportunities for information security pros:

1. Walled gardens have become wild gardens
CISOs are losing the security arms race. Even highly secure organizations -- including the security companies themselves -- have been breached. The reason is simple: the security model traditionally applied no longer matches the real world. Systems fail because of an attempt to control and contain by drawing boundaries, while data, users, and devices are becoming dynamic and mobile. Data has become liquid. Location-centric, device-centric, port-centric tools are simply inadequate to the task.

Security architecture has to become both dynamic and adaptive. Security tools will become more automated, using machine learning and big data analytics to respond to attacks. This will be done in a more fluid manner, focused on the data and the applications themselves and less on the port and the device. CISOs need to re-architect their security paradigm and invest in data-centric approaches such as DNSSEC, AES encryption, and TLS/SSL, and assume their perimeter has been compromised.

2. BYOD = BLOT
Organizations tolerate a "bring your own device" policy, but it actually "brings lots of trouble." Intellectual property leaks are multiplying. The reason? Security is focused on the containers rather than the data itself. Mobile security is mostly about device management. Datacenters and operating systems protect their perimeter with network and file-access controls. This containment model is failing because the data is moving too fast between devices and users. Even the NSA fell victim with an internal, human-led compromise. Mobile device makers are rushing to add containment controls, such as fingerprint scanners, but there is still inadequate focus on the data itself.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
11/15/2013 | 12:32:47 PM
Encryption
Your comment "one way to attain broad data encryption is to institute corporate-wide policies that say data can never be in the clear when it is in rest or in motion and to standardize on a commercial key management system." makes a huge amount of sense. However, actual use of encryption is in the single-digits in many surveys. Best case, databases at rest are encrypted. End user devices? Forget it. The usual excuse is key management -- that  these systems are still too complex and expensive.

What's your advice to IT pros who want to expand encryption but are running scared of losing keys?
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
11/15/2013 | 12:33:44 PM
Security evolution
I agree that security needs to focus on the data, rather than the devices, systems and locations where we keep it. Those other elements are changing so quickly we can't possibly keep up. Another transition for security pros is to learn how to respond and recover after a breach or attack, and to put as much effort into that as into prevention. If your company is singled out and targeted, the best you may be able to do is cut your losses.
Kim Davis
50%
50%
Kim Davis,
User Rank: Apprentice
11/15/2013 | 4:37:36 PM
The Perimeter is Less Important
I think your general approach is right.  We can't ignore the perimeter, but defending it is no longer the be all and end all of security.  What's required is constant, real-time (and therefore automated) monitoring of data within the perimeter.
Li Tan
50%
50%
Li Tan,
User Rank: Apprentice
11/17/2013 | 10:17:27 PM
Re: Encryption
@Lorna, very good question - in my opinion the data encryption is always a kind of paradox. Without encryption, the data will not be secure and you are exposed to security breach. If you try to encrypt everything, then what about if you lose your encryption key? The modern key management mechanism helped to give some relief on this issue. But the problem is not completly solved - there is still the trouble to renew the certificate in case it's lost. Another more severe question is that, how can we fully trust the root CA itself?
venkyganesan
50%
50%
venkyganesan,
User Rank: Apprentice
11/19/2013 | 1:16:19 AM
Re: Encryption
Lorna - you are right! Encryption currently has very low usage - key management is an issue so is latency and performance.  However there are solutions emerging that address all elements of this.  The security discussion is now in the boardroom and the downside of data leakage is so high that I believe top down mandates are coming to push encryption to the data level.  We will see.

Venky
venkyganesan
50%
50%
venkyganesan,
User Rank: Apprentice
11/19/2013 | 1:18:45 AM
Re: Encryption
There are distributed key management solutions coming along so you are not dependent on a root key.  True security woudl require you not to be exposed to a single point of failure with a root key.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
11/19/2013 | 8:36:43 AM
Re: Encryption
I hope so. We plan to run a survey on encryption use in Q1, and trend it back to one we did in 2011. I will be very interested to see movement. What are some of the companies that you find interesting?
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

CVE-2014-7292
Published: 2014-10-23
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to ct.ashx.

CVE-2014-8071
Published: 2014-10-23
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/registerPatient.page; the (5) comment parameter to all...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.