Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/30/2014
10:00 AM
Lysa Myers
Lysa Myers
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

4 Infosec Resolutions For The New Year

Don't look in the crystal ball, look in the mirror to protect data and defend against threats in 2015.

As the year draws to a close, security gurus begin the annual ritual of predicting what horrors will befall us after the calendar turns from December to January. While this gloomy approach ignores the potential for actually improving infosec, it also sidesteps the opportunity for reflection. The truth is, any security incidents that will occur in 2015 will be the result of lingering errors created in the past. Here are four dangers that will continue unless we resolve to act now.

Legacy code, present danger
Just because some bit of code has been used since the dawn of time does not mean it has been thoroughly vetted. In the past few months, we saw years-old (or even decades-old) vulnerabilities unearthed in the form of the Heartbleed, Shellshock, Poodle, and Unicorn bugs. It’s nearly impossible to predict where the next of these ancient vulnerabilities will surface, but it’s a fair bet that you’ll find them wherever there is a piece of code that has been used by millions and has been largely unchanged for years. In 2015, security teams should resolve to give that legacy code a thorough review.

Expedience at the expense of security
Last year was not a good one as far as major payment card security goes. It brought us breaches at Neiman Marcus, Michael's craft store, P.F. Chang's, Dairy Queen, Jimmy Johns, Goodwill, Staples, and Home Depot, among others. Predicting another year full of yet more breaches seems like something of a no-brainer.

In the largest of these breaches, at Home Depot, company officials had been warned about flaws in their security. Instead of taking action, they chose expediency over security, and they are now paying the price of millions of unhappy customers. The causes of all these breaches are all basic security concerns: loss of login credentials, lack of adequate network segmentation, absence of encryption, use of default device passwords, and disabling of security features. While we can’t say better security would have prevented all of these events, we can resolve to make breaking-in far more difficult for the attackers.

Malware: Everything old is new again
The headlines may be all about the newest and most unusual malware, but the majority of what affects the average person is still the same old, boring stuff that has been around for ages. Infecting computers usually doesn’t require the newest vulnerabilities, and it doesn’t necessitate the stealthiest tactics. The most effective threats often still rely on old-fashioned social engineering, because criminals are not going to pull out the metaphorical “big guns” if they know they can get their payday with tactics that are simply “good enough.”

Right now, the cost of entry for malware writers is exceedingly low, and the return on investment is very high. Until that equation changes, we’re not likely to see much of a decrease in malware in particular or cybercrime in general. The coming year is likely to bring some improvements, but in fits and starts rather than as a complete sea change. Let’s get that process moving faster.

Looking back to look ahead
For most people, technology is a new and often confusing thing. Many organizations are going digital fairly reluctantly, choosing only the easiest and most user-friendly aspects to deploy. Historically, this has led to a general perception that information security is a drag on innovation -- not an essential feature of the technology infrastructure. As people become more informed, as security products become easier to implement, and as more people become aware of the costs of leaving themselves open to attack, this situation is likely to evolve for the better.

The good news is that old problems, by and large, already have solutions: All we have to do is recognize and implement them. There are a lot of things that we can all do to improve our security. Once we remove the low-hanging fruit, we will make it more costly and difficult for criminals to do their jobs. That’s not to say that removing that fruit will be an easy task -- in fact, it’s far more difficult than our current policy of worrying about the most challenging (one might even say “advanced, persistent”) fruit.

It is my hope that in the coming year, the brilliant minds in this industry will reflect on what we can do to make security simpler and more approachable for the general public.

What are your infosec resolutions for 2015? Please share them in the comments.

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
1/6/2015 | 6:33:24 PM
Re: Malware: Everything old is new again -- the human factor
@Marilyn Cohodas - Consider where we were in terms of safety 20 years after cars became a common phenomenon. These things take time, especially when there are few people who adequately understand the technology. I don't expect a sea change any time soon, but I see a hunger in the general populace for better information, which it is our obligation (as people who know what's up, and can communicate well) to fill.
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
1/6/2015 | 6:29:07 PM
Re: "Expedience at the expense of security"
@RyanSepe - Thank you!

Expedience, in this case, is not necessarily the same as ease of use. It's a combination of expertise, effectiveness, and expense, with an element of ease of use. Finding all 4 of those things is not necessarily easy, you kind of have to put some effort into finding them. If you don't make the effort, you may be taking the easy route in the short term, but you're likely to pay for it in the end. 
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
1/6/2015 | 6:23:19 PM
Re: What about VDI and DaaS?
@kbannan100 - Virtual/snapshot-style desktops can be a great boon for security, but cloud-based implementations may not work for all organizations. Beyond that, many breaches happen due to lost credentials or files, especially on mobile devices/laptops. Every different configuration has its own level of risk, and I don't think we should abandon any well-worn technology entirely, in favor of newer or less-tested technologies. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/6/2015 | 9:06:25 AM
Re: Malware: Everything old is new again -- the human factor
Totally agree with you @Ryan that hardening humans is really the essential problem. And the enterprise is only one part of the solution. Schools, banking, entertainment, retail all have a stake in educating the public about basic cyber hygiene. But I don't see a groundswell of support for such a comprehensive initiative....
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/6/2015 | 9:01:10 AM
Re: Malware: Everything old is new again -- the human factor
Thats a very difficult topic to theorize. It seems that user security education is rearing its head across the enterprise level, which I think is due to employee negligence being one of the largest causes of an event, in the form of security awareness training. But security awareness training is not prevalent at the academic level unless your have a track of computer related academics. Which is not completely comprehensive to say the least. At the everyday technology user level security features are merely an option and not mandated. I think to truly have everyone realize the importance of security, hardened systems and best practices need to become the baseline. Most people will choose the easiest method of performing something if they have never been exploited before because the danger has not yet become real for them. This last comment is directed at device configuration. I think the only way to reach everyone as to why security is so important is to make their devices mirror these principles.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/5/2015 | 3:42:28 PM
Malware: Everything old is new again -- the human factor
I wonder what the critical mass in user education needs to be to shift the balance in favor in favor of the security professionals versus the cybercriminals. Are we making any progress in this area?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/31/2014 | 12:44:42 PM
Re: What about VDI and DaaS?
@kbannan100. The security risk would decrease under those configurations but would not eliminate it. Snapshot methodology can help against malware from a desktop perspective but there are still logical instances and can be infiltrated because they have factors a physical infrasture would have such as IP address and the way the OS handles data transit is similar. This is because virtual infrastructure was designed to minimize the physical aspect and cut costs so it was modeled closely after. However, there have been break throughs with these configurations that do vastly increase security posture. Such as what I referenced above, physical access control(eliminated), etc.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/31/2014 | 12:40:30 PM
"Expedience at the expense of security"
"Expedience at the expense of security"

It is a common misconception that ease of use and security are contrasting ideals. Whenever a technology is implemented there is a planning phase regardless if security is even on the docket. Following an agile methodology would dictate that security be ingrained at the initial phases. An efficient organization versed in change management can attest to the implementation of security into a product or hardware implementation will not add an extensive amount of time to the endeavor and in fact in the long run could utilize more man hours as the referenced organizations are experiencing.


The 4 InfoSec resolutions are well founded. Those without a knowledge of history are doomed to repeat it and it seems that enterprise infrastructure is not experiencing the required changes quick enough.
kbannan100
50%
50%
kbannan100,
User Rank: Moderator
12/30/2014 | 1:35:39 PM
What about VDI and DaaS?
What do you think about taking desktops out of the equation -- at least traditional ones? Users are constantly doing stupid things. (Or at least short-sighted things.) By switching people over to DaaS or VDI instead of a traditional desktop doesn't the security risk go down, too?

--KB
Karen J. Bannan, commenting on behalf of IDG and VMware.
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17513
PUBLISHED: 2019-10-18
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
CVE-2019-8216
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8217
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-8218
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8219
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .